Executive brief
HKUDS AI-Trader, an automated trading platform, contains a vulnerability in its research data export feature. An unauthenticated remote attacker can access and download a database of registered agents, including internal IDs and financial balances. This exposure could allow unauthorized parties to gather competitive intelligence or sensitive user data.
Technical details
An improper access control vulnerability (CWE-284/CWE-200) exists in the Research Export component of HKUDS AI-Trader. The endpoint `/api/research/agents.csv` failed to require authentication, allowing any network-based attacker to perform bulk data scraping. Exposed data includes internal Agent IDs and precise financial balances. While some fields were hashed, the lack of an authentication gate facilitated unauthorized information disclosure. The issue was addressed in commit 91a31aac1b0f4dbc6b8bef9f6eff0b7912e0bc65 by requiring the 'research_exports' capability for authenticated agents.
Affected products
- HKUDS AI-Trader up to 74caf996f78dcc0c657df8365c8544678a16e215
Timeline
- 2026-05-20: patched: Patch commit 91a31aac1b0f4dbc6b8bef9f6eff0b7912e0bc65 merged
- 2026-06-02: disclosed: Issue reported on GitHub by external researcher
- 2026-06-15: advisory: CVE published
References
- https://github.com/Dave-gilmore-aus/security-advisories/blob/main/AI-Trader-Unauthenticated%20Sensitive%20Data%20Exposure%20in%20Research%20Export%20(CVE-Pending).md
- https://github.com/HKUDS/AI-Trader/
- https://github.com/HKUDS/AI-Trader/commit/91a31aac1b0f4dbc6b8bef9f6eff0b7912e0bc65
- https://github.com/HKUDS/AI-Trader/issues/242
- https://github.com/HKUDS/AI-Trader/pull/227
- https://vuldb.com/cve/CVE-2026-12203
- https://vuldb.com/submit/830273