Executive brief
ag-ui is a framework for integrating AI agents into frontend applications. The vulnerability allows attackers to bypass cross-origin security restrictions through a misconfigured CORS (Cross-Origin Resource Sharing) middleware, potentially enabling attackers to make unauthorized requests to ag-ui endpoints from untrusted domains. This could lead to unauthorized access to agent functionality or data exposure if the application relies on browser-based CORS enforcement for security.
Technical details
The vulnerability is a permissive CORS policy misconfiguration in the CORSMiddleware component affecting the create_strands_app function in integrations/aws-strands/python/src/ag_ui_strands/utils.py. The middleware accepts requests from untrusted domains by not properly validating the origin header, allowing cross-domain requests that should have been blocked. The attack is network-accessible and can be launched remotely, though exploitation requires high complexity due to application-specific constraints. The vulnerability is fixed in version AGUI.Abstractions@0.0.6 (commit 9b143b9668fa52c2054ede9d34a45ac4b4401089), which adds an optional authentication hook parameter (auth=None) to provide proper request validation before processing.
Affected products
- ag-ui-protocol ag-ui 0.3.0
Timeline
- 2026-09-16: disclosed
- 2026-08-25: patched: Fix commit 9b143b9668fa52c2054ede9d34a45ac4b4401089 merged