CVE-2026-18974 Overview
CVE-2026-18974 is an information disclosure vulnerability in heshengtao super-agent-party versions up to 0.4.1. The flaw resides in the get_file_content function within server.py, reachable through the execute_tool_manually endpoint. Attackers can manipulate the tool_name and tool_params arguments to trigger unauthorized disclosure of file contents. The issue is exploitable remotely without authentication or user interaction. A public proof-of-concept has been published on GitHub Gist, increasing exposure risk. According to the disclosure, the vendor was contacted early but did not respond, and no fixed release is available at the time of publication. The weakness maps to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
Unauthenticated remote attackers can read arbitrary file content exposed through the execute_tool_manually endpoint, with a public exploit available and no vendor patch released.
Affected Products
- heshengtao super-agent-party versions up to and including 0.4.1
- Component: execute_tool_manually endpoint
- File: server.py, function get_file_content
Discovery Timeline
- 2026-08-06 - CVE-2026-18974 published to the National Vulnerability Database
- 2026-08-06 - Last updated in NVD database
Technical Details for CVE-2026-18974
Vulnerability Analysis
The vulnerability affects the get_file_content function inside server.py, invoked by the execute_tool_manually endpoint in heshengtao super-agent-party. The endpoint accepts tool_name and tool_params arguments from remote clients. Insufficient validation of these parameters allows an attacker to influence file selection and disclose file contents that should not be exposed through the tool interface. Because the endpoint requires no authentication and no user interaction, exploitation reduces to sending a crafted HTTP request. The exploit has been made public, which raises the operational risk for any exposed instance.
Root Cause
The root cause is improper handling of untrusted input passed to a file-reading routine. The get_file_content function trusts the tool_name and tool_params values supplied to execute_tool_manually and reads file data based on those values without adequate authorization or path constraints. This design fault falls under [CWE-200], where sensitive information is returned to an actor that should not have access to it.
Attack Vector
The attack vector is network-based. An unauthenticated remote attacker sends a request to the execute_tool_manually endpoint with manipulated tool_name or tool_params values. The server returns file content the attacker should not be able to read. No privileges are required, and no user interaction is needed. Because a proof-of-concept is publicly hosted on GitHub Gist, opportunistic scanning and exploitation are plausible against internet-exposed deployments. See the GitHub Gist PoC Repository and the VulDB CVE-2026-18974 entry for further technical detail.
Detection Methods for CVE-2026-18974
Indicators of Compromise
- Inbound HTTP requests to the execute_tool_manually endpoint from unexpected external sources
- Requests containing unusual or path-like values in the tool_name or tool_params parameters
- Response payloads from super-agent-party containing file contents outside the expected tool response schema
Detection Strategies
- Enable verbose access logging on the super-agent-party service and alert on execute_tool_manually calls originating from untrusted network segments.
- Deploy a web application firewall rule that flags execute_tool_manually requests containing traversal sequences, absolute paths, or references to sensitive filenames.
- Correlate application logs with network telemetry to identify repeated probing patterns that mirror the public PoC.
Monitoring Recommendations
- Track outbound response sizes from the endpoint; large or anomalous payloads may indicate file exfiltration.
- Monitor for spikes in traffic to the super-agent-party process shortly after PoC publication windows.
- Baseline legitimate tool invocations and alert on argument values that deviate from the expected format.
How to Mitigate CVE-2026-18974
Immediate Actions Required
- Restrict network access to the super-agent-party service so the execute_tool_manually endpoint is not reachable from untrusted networks.
- Place the application behind an authenticating reverse proxy until an upstream fix is available.
- Audit historical logs for requests to execute_tool_manually and validate whether sensitive files were returned.
Patch Information
No vendor patch is available. According to the disclosure recorded in VulDB Vulnerability #386263, the maintainer of heshengtao super-agent-party was contacted before public disclosure but did not respond. Users should track the upstream repository for a corrected release beyond version 0.4.1 and review the VulDB CTI record for updates.
Workarounds
- Disable the execute_tool_manually endpoint in deployments that do not require it, or remove the route from server.py in local builds.
- Enforce strict input validation on tool_name and tool_params at a proxy layer, rejecting path separators and absolute paths.
- Run the service as a low-privilege user with a restricted filesystem view so that any disclosed content is limited in scope.
- Isolate the service in a container or dedicated namespace with read-only mounts for non-essential paths.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
