CVE-2026-92359
ag-ui-protocol ag-ui CORSMiddleware utils.py create_strands_app cross-domain policy
Description
A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. The affected element is the function create_strands_app of the file integrations/aws-strands/python/src/ag_ui_strands/utils.py of the component CORSMiddleware. The manipulation results in permissive cross-domain policy with untrusted domains. The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is described as difficult. Upgrading to version [email protected] is sufficient to fix this issue. The patch is identified as 9b143b9668fa52c2054ede9d34a45ac4b4401089. It is suggested to upgrade the affected component.
INFO
Published Date :
Sept. 16, 2026, 1:18 p.m.
Last Modified :
Sept. 23, 2026, 11:10 a.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 2.0 | LOW | [email protected] | ||||
| CVSS 3.1 | LOW | [email protected] | ||||
| CVSS 4.0 | LOW | [email protected] |
Solution
- Upgrade ag-ui-protocol to version [email protected].
- Review and tighten CORSMiddleware domain policies.
- Apply patch 9b143b9668fa52c2054ede9d34a45ac4b4401089.
- Limit cross-domain access to trusted domains only.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-92359.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-92359 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-92359
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-92359 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-92359 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Sep. 23, 2026
Action Type Old Value New Value Added Translation Title: ag-ui de ag-ui-protocol, Description: Se ha descubierto una falla de seguridad en ag-ui-protocol ag-ui 0.3.0. El elemento afectado es la función create_strands_app del archivo integrations/aws-strands/python/src/ag_ui_strands/utils.py del componente CORSMiddleware. La manipulación resulta en una política de dominio cruzado permisiva con dominios no confiables. El ataque puede ser lanzado remotamente. El ataque requiere un alto nivel de complejidad. La explotabilidad se describe como difícil. Actualizar a la versión [email protected] es suficiente para solucionar este problema. El parche se identifica como 9b143b9668fa52c2054ede9d34a45ac4b4401089. Se sugiere actualizar el componente afectado. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Sep. 16, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-92359', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-09-16T13:15:05.598960Z'} -
New CVE Received by [email protected]
Sep. 16, 2026
Action Type Old Value New Value Added Description A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. The affected element is the function create_strands_app of the file integrations/aws-strands/python/src/ag_ui_strands/utils.py of the component CORSMiddleware. The manipulation results in permissive cross-domain policy with untrusted domains. The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is described as difficult. Upgrading to version [email protected] is sufficient to fix this issue. The patch is identified as 9b143b9668fa52c2054ede9d34a45ac4b4401089. It is suggested to upgrade the affected component. Added CVSS V4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CVSS V3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N Added CVSS V2 (AV:N/AC:H/Au:N/C:P/I:N/A:N) Added CWE CWE-346 Added CWE CWE-942 Added Affected New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/92xxx/CVE-2026-92359.json">CVE-2026-92359</a> Added Reference https://github.com/ag-ui-protocol/ag-ui/ Added Reference https://github.com/ag-ui-protocol/ag-ui/commit/9b143b9668fa52c2054ede9d34a45ac4b4401089 Added Reference https://github.com/ag-ui-protocol/ag-ui/issues/2433 Added Reference https://github.com/ag-ui-protocol/ag-ui/pull/2492 Added Reference https://github.com/ag-ui-protocol/ag-ui/releases/tag/AGUI.Abstractions%400.0.6 Added Reference https://vuldb.com/cve/CVE-2026-92359 Added Reference https://vuldb.com/submit/934120 Added Reference https://vuldb.com/vuln/405445 Added Reference https://vuldb.com/vuln/405445/cti