# CVE-2026-120233: ag-ui HttpAgent credential and request body forwarding via redirect

Source: https://junglewise.ai/threats/cve-2026-120233-a-security-flaw-has-been-discovered-in-ag-ui-protocol-ag-ui-up  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-01. Updated: 2026-11-01  
License: CC BY 4.0 with a link back

CVE-2026-120233 · Severity: medium · CVSS 5.3 · Published 2026-11-01

AG-UI is a protocol for integrating AI agents into frontend applications. The HttpAgent component in the TypeScript client library (versions up to 0.0.58) fails to validate HTTP redirects, allowing a malicious or compromised agent endpoint to redirect requests to an attacker-controlled server while forwarding sensitive credentials, API keys, and the full request body containing conversation history and tool schemas. This enables credential theft and server-side request forgery attacks.

Technologies: [Ag-Ui-Protocol Ag-Ui](https://junglewise.ai/threats/technologies/ag-ui). Vendors: [Ag-Ui-Protocol](https://junglewise.ai/threats/vendors/ag-ui-protocol).

## Quick answers

**Is CVE-2026-120233 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120233 being exploited in the wild.

**How severe is CVE-2026-120233?** Medium severity, with a CVSS score of 5.3, published 1 November 2026.

**Which products and versions are affected?** Ag-Ui-Protocol Ag-Ui up to 0.0.58.

**Is there a fix for CVE-2026-120233?** No fixed version is recorded yet. Set redirect: "manual" or redirect: "error" in the HttpAgent's requestInit to disable automatic redirect following and treat redirect responses as errors instead of forwarding the credential-bearing request body.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-11-01"},{"kind":"other","note":"Public exploit released; fix awaiting pull request acceptance"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-120233 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-120233?** Check whether you run Ag-Ui-Protocol Ag-Ui at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Set redirect: "manual" or redirect: "error" in the HttpAgent's requestInit to disable automatic redirect following and treat redirect responses as errors instead of forwarding the credential-bearing request body.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-11-01"},{"kind":"other","note":"Public exploit released; fix awaiting pull request acceptance"}]

## Technical details

The vulnerability exists in the HttpAgent's requestInit configuration, which omits the redirect option, causing the Fetch API to default to "follow" and automatically re-issue requests to attacker-chosen URLs. When a 307/308 redirect is returned, the method and body are preserved, and developer-supplied headers (X-Tenant, API keys) are forwarded across origins. The attack requires a malicious or compromised agent endpoint but is remotely exploitable and can exfiltrate credentials and run-request envelopes (threadId, runId, conversation data) to arbitrary origins or perform client-side request forgery against internal endpoints.

## Affected products

- ag-ui-protocol ag-ui up to 0.0.58

## References

- [https://github.com/ag-ui-protocol/ag-ui/](https://github.com/ag-ui-protocol/ag-ui/)
- [https://github.com/ag-ui-protocol/ag-ui/issues/2520](https://github.com/ag-ui-protocol/ag-ui/issues/2520)

## Related threats

- [ag-ui-protocol ag-ui resource exhaustion in interrupt expiry](https://junglewise.ai/threats/cve-2026-120237-a-flaw-has-been-found-in-ag-ui-protocol-ag-ui-up-to-0-0-58)
- [ag-ui Transport Decoder Handler improper input validation](https://junglewise.ai/threats/cve-2026-120236-a-vulnerability-was-detected-in-ag-ui-protocol-ag-ui-up-to-0-0)
- [ag-ui SSE parser resource exhaustion](https://junglewise.ai/threats/cve-2026-120235-a-security-vulnerability-has-been-detected-in-ag-ui-protocol-ag)
- [ag-ui HTTP Transport unbounded response buffering](https://junglewise.ai/threats/cve-2026-120234-a-weakness-has-been-identified-in-ag-ui-protocol-ag-ui-up-to-0-0)
- [ag-ui JSON.parse uncaught exception in middleware](https://junglewise.ai/threats/cve-2026-101101-a-vulnerability-has-been-found-in-ag-ui-protocol-ag-ui-up-to)