CVE-2026-19019: Poco-AI Poco-Agent RCE Vulnerability

CVE-2026-19019 Overview

CVE-2026-19019 affects poco-ai poco-agent versions up to 0.5.4. The flaw resides in the WorkspaceManager._setup_session_persistence function within executor/app/core/workspace.py, part of the Claude File Handler component. The weakness is classified as incomplete cleanup [CWE-459], where the software fails to properly release resources or artifacts after use.

An attacker can trigger the condition remotely, though exploitation is described as highly complex and difficult. Public exploit code has been released, increasing the possibility of opportunistic attempts against exposed instances.

Critical Impact
Incomplete cleanup in session persistence handling can leave residual workspace artifacts accessible, potentially exposing limited integrity and availability characteristics of the affected component.

Affected Products

poco-ai poco-agent versions up to and including 0.5.4
Component: Claude File Handler (executor/app/core/workspace.py)
Function: WorkspaceManager._setup_session_persistence

Discovery Timeline

2026-08-06 - CVE CVE-2026-19019 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-19019

Vulnerability Analysis

The vulnerability originates in the session persistence setup routine of the WorkspaceManager class. When poco-agent handles Claude-related file operations, _setup_session_persistence fails to fully clean up transient state, files, or references created during session initialization.

Incomplete cleanup issues categorized under [CWE-459] typically leave workspace artifacts on disk or in memory after operations complete. In multi-session or shared-workspace deployments, this residue can influence subsequent sessions or expose limited data to actors with network reachability.

Exploitation requires specific timing and environmental conditions, which is why the attack complexity is rated high. A public exploit exists, but reliable weaponization against production instances requires attacker skill.

Root Cause

The root cause is missing or incomplete release of resources allocated during session persistence setup. The function does not guarantee that all temporary files, handles, or session state are removed on completion or failure paths within executor/app/core/workspace.py.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker interacts with the poco-agent service to invoke session persistence flows in a way that leaves artifacts behind. Because the complexity is high, successful exploitation depends on race conditions or precise sequencing of session operations. For detailed technical context, see the GitHub Issue #131 and the associated GitHub Pull Request #132.

No verified proof-of-concept code is available in the enriched dataset. Refer to the VulDB CVE-2026-19019 entry for additional exploit context.

Detection Methods for CVE-2026-19019

Indicators of Compromise

Unexpected residual files or directories persisting in poco-agent workspace directories after session termination
Session persistence artifacts belonging to prior or unrelated sessions appearing under paths managed by WorkspaceManager
Anomalous inbound requests to poco-agent endpoints that repeatedly initiate and abort session setup

Detection Strategies

Audit the poco-agent workspace directory for orphaned session state that outlives its parent session
Instrument WorkspaceManager._setup_session_persistence with logging around resource allocation and release paths
Compare running poco-agent versions against the fixed release identified in GitHub Pull Request #132

Monitoring Recommendations

Monitor filesystem growth in poco-agent workspace paths for unexplained accumulation
Alert on high-frequency session creation patterns from a single remote source
Track process and file handle counts of the poco-agent process for unbounded growth

How to Mitigate CVE-2026-19019

Immediate Actions Required

Upgrade poco-ai poco-agent to a version later than 0.5.4 that incorporates the fix from GitHub Pull Request #132
Restrict network exposure of poco-agent instances to trusted management networks until patched
Review workspace directories and remove stale session artifacts from previous runs

Patch Information

The fix is delivered through the upstream repository. Review the code changes in GitHub Pull Request #132 and track the referenced GitHub Issue #131 for release status. Apply the patched release to all deployments running poco-agent 0.5.4 or earlier.

Workarounds

Place poco-agent behind an authenticated reverse proxy to eliminate unauthenticated network reachability
Schedule periodic cleanup of the poco-agent workspace directory to remove residual session artifacts
Isolate each poco-agent deployment in a dedicated container with an ephemeral filesystem so residues do not persist across restarts

bash

# Configuration example: restrict poco-agent exposure and enforce ephemeral workspace
# 1. Bind poco-agent to localhost only
export POCO_AGENT_BIND_ADDR=127.0.0.1

# 2. Run in a container with a tmpfs-backed workspace
docker run --rm \
  --read-only \
  --tmpfs /app/workspace:rw,size=256m \
  -p 127.0.0.1:8080:8080 \
  poco-ai/poco-agent:latest