CVE-2026-36719: AgentChat Information Disclosure Flaw

CVE-2026-36719 Overview

CVE-2026-36719 is an information disclosure vulnerability in AgentChat v2.3.0. The flaw affects the /api/v1/user/info endpoint, which fails to enforce authentication before returning user records. Unauthenticated attackers can enumerate sequential user IDs to harvest sensitive account data, including SHA256 password hashes. The exposed hashes enable offline cracking attempts against user credentials. The issue is categorized under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Remote, unauthenticated attackers can extract SHA256 password hashes and user account details from AgentChat v2.3.0 by iterating through user IDs against an exposed API endpoint.

Affected Products

AgentChat v2.3.0
/api/v1/user/info API endpoint
Deployments exposing the AgentChat API to untrusted networks

Discovery Timeline

2026-06-09 - CVE-2026-36719 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-36719

Vulnerability Analysis

The /api/v1/user/info endpoint in AgentChat v2.3.0 returns user record data without verifying caller authentication or authorization. The endpoint accepts a user identifier parameter and responds with the corresponding account profile. The response payload includes the SHA256 password hash stored for that user. Attackers iterate through sequential or guessable user IDs to enumerate the full user base. The harvested hashes can be subjected to offline dictionary and brute-force attacks, particularly because SHA256 alone is fast to compute and lacks per-user salting protections when used directly for password storage.

Root Cause

The root cause is missing access control on a sensitive API route combined with the inclusion of credential material in the API response. The endpoint does not require a session token, API key, or ownership check tying the requester to the queried user ID. Returning password hashes in any user-info response also violates the principle of least privilege, as no client workflow requires this field.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends HTTP GET requests to /api/v1/user/info while incrementing the user ID parameter. Each successful response yields a user record containing a SHA256 password hash. The attacker collects the hashes and performs offline cracking against common password lists. Recovered credentials can then be reused against AgentChat or other services where users reuse passwords.

No verified proof-of-concept code is published. Technical details are available in the GitHub Vulnerability Repository.

Detection Methods for CVE-2026-36719

Indicators of Compromise

Repeated unauthenticated HTTP requests to /api/v1/user/info with sequentially incrementing user ID parameters.
Large volumes of 200 OK responses from /api/v1/user/info originating from a single source IP within a short time window.
Outbound traffic from AgentChat servers correlated with unusual API request bursts on the user-info route.

Detection Strategies

Inspect web server and application logs for sequential ID enumeration patterns against /api/v1/user/info.
Deploy WAF or API gateway rules that flag unauthenticated access to user-info endpoints.
Hunt for response bodies containing hash-shaped strings (64-character hex) being transmitted from API endpoints.

Monitoring Recommendations

Enable rate-limit and anomaly alerts on the /api/v1/user/info endpoint.
Monitor authentication logs for credential-stuffing activity following any suspected enumeration event.
Track API access metrics by source IP and user agent to surface scraping behavior.

How to Mitigate CVE-2026-36719

Immediate Actions Required

Restrict network access to the AgentChat API until a vendor patch is applied.
Enforce authentication on /api/v1/user/info at a reverse proxy or API gateway as a compensating control.
Rotate all user passwords on affected AgentChat v2.3.0 deployments to invalidate any exfiltrated hashes.
Review access logs for the endpoint and identify any prior enumeration activity.

Patch Information

No vendor-supplied patch is referenced in the NVD record at the time of publication. Operators should monitor the GitHub Vulnerability Repository and AgentChat project channels for an upstream fix. The remediation must require authentication on the endpoint, enforce per-user authorization checks, and remove password hash fields from API responses.

Workarounds

Place AgentChat behind an authenticating reverse proxy that blocks anonymous requests to /api/v1/user/info.
Apply API gateway rules to strip sensitive fields such as password_hash from response bodies.
Implement rate limiting and account lockout on the endpoint to slow enumeration attempts.
Migrate stored credentials from raw SHA256 to a salted, memory-hard algorithm such as Argon2 or bcrypt to reduce offline cracking risk.

bash

# Example NGINX rule to block unauthenticated access to the vulnerable endpoint
location = /api/v1/user/info {
    auth_request /auth/validate;
    limit_req zone=api_user_info burst=5 nodelay;
    proxy_pass http://agentchat_backend;
}