Is CVE-2026-12203 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12203 being exploited in the wild.

How severe is CVE-2026-12203?

Medium severity, with a CVSS score of 5.3, published 15 June 2026.

Which products and versions are affected?

HKUDS AI-Trader up to 74caf996f78dcc0c657df8365c8544678a16e215.

Is there a fix for CVE-2026-12203?

A patch was published on 2026-05-20: Patch commit 91a31aac1b0f4dbc6b8bef9f6eff0b7912e0bc65 merged Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-12203 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-12203?

Check whether you run HKUDS AI-Trader at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12203: HKUDS AI-Trader information disclosure in Research Export

CVE-2026-12203 · Severity: medium · CVSS 5.3 · Published 2026-06-15

HKUDS AI-Trader, an automated trading platform, contains a vulnerability in its research data export feature. An unauthenticated remote attacker can access and download a database of registered agents, including internal IDs and financial balances. This exposure could allow unauthorized parties to gather competitive intelligence or sensitive user data.

Vendors: HKUDS.

Quick answers

Is CVE-2026-12203 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12203 being exploited in the wild.
How severe is CVE-2026-12203?: Medium severity, with a CVSS score of 5.3, published 15 June 2026.
Which products and versions are affected?: HKUDS AI-Trader up to 74caf996f78dcc0c657df8365c8544678a16e215.
Is there a fix for CVE-2026-12203?: A patch was published on 2026-05-20: Patch commit 91a31aac1b0f4dbc6b8bef9f6eff0b7912e0bc65 merged Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-12203 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-12203?: Check whether you run HKUDS AI-Trader at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper access control vulnerability (CWE-284/CWE-200) exists in the Research Export component of HKUDS AI-Trader. The endpoint `/api/research/agents.csv` failed to require authentication, allowing any network-based attacker to perform bulk data scraping. Exposed data includes internal Agent IDs and precise financial balances. While some fields were hashed, the lack of an authentication gate facilitated unauthorized information disclosure. The issue was addressed in commit 91a31aac1b0f4dbc6b8bef9f6eff0b7912e0bc65 by requiring the 'research_exports' capability for authenticated agents.

Affected products

HKUDS AI-Trader up to 74caf996f78dcc0c657df8365c8544678a16e215

Timeline

2026-05-20: patched: Patch commit 91a31aac1b0f4dbc6b8bef9f6eff0b7912e0bc65 merged
2026-06-02: disclosed: Issue reported on GitHub by external researcher
2026-06-15: advisory: CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.