CVE-2026-58171: Vibe-Trading Path Traversal Vulnerability

CVE-2026-58171 Overview

CVE-2026-58171 is a path traversal vulnerability in Vibe-Trading versions prior to 0.1.10. The run_dir function in agent/src/swarm/store.py constructs the swarm run directory by joining a caller-supplied run identifier onto the runs base directory without validation. Attackers supplying a crafted run identifier through the Model Context Protocol (MCP) swarm tools can read arbitrary run.json files outside the runs directory. The same flaw allows overwriting existing run.json files at traversed filesystem locations. The issue is tracked as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
Authenticated MCP callers can read and overwrite run.json files outside the designated runs directory, breaching filesystem isolation of the swarm agent.

Affected Products

Vibe-Trading versions prior to 0.1.10
agent/src/swarm/store.pyrun_dir function
MCP swarm tools exposed by agent/mcp_server.py

Discovery Timeline

2026-06-30 - CVE-2026-58171 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-58171

Vulnerability Analysis

The vulnerability resides in the run_dir method of the SwarmStore class in agent/src/swarm/store.py. The pre-patch implementation returned self.base_dir / run_id directly, with no validation of run_id. Python's pathlib treats an absolute path or path containing traversal segments as an override or navigation, allowing the resulting path to escape base_dir.

When a caller invokes MCP swarm tools such as load_run or reconcile_run with a controlled run_id, the store operates on files at attacker-selected locations. Reads leak the contents of any run.json accessible to the process. Writes replace the target run.json, corrupting or overwriting arbitrary files with that name.

Root Cause

The root cause is missing input validation on the run_id parameter. The function accepts absolute paths, paths containing .., and paths with / or \ separators without rejecting them. Because run_id originates from MCP tool arguments, any authenticated MCP client can influence the filesystem path.

Attack Vector

An attacker with permission to call the MCP swarm tools submits a run_id value such as ../../etc/some_dir or an absolute path. The resulting run_dir points outside the runs base directory. Subsequent load_run calls disclose the target run.json, while create_run or reconcile_run writes attacker-influenced content to the traversed location.

python

# Security patch in agent/src/swarm/store.py
# Source: https://github.com/HKUDS/Vibe-Trading/commit/f45fd85392f07b5e404e41d4fcb0ef0d6c2f87ab

        Returns:
            Path to the run directory.

        Raises:
            ValueError: If run_id is empty, absolute, or path-shaped.
        """
        candidate = Path(run_id)
        if (
            not run_id.strip()
            or candidate.is_absolute()
            or len(candidate.parts) != 1
            or any(part in {"", ".", ".."} for part in candidate.parts)
            or "/" in run_id
            or "\\" in run_id
        ):
            raise ValueError(f"run_id {run_id!r} must be a bare run directory name")
        return self.base_dir / candidate.name

The patch enforces that run_id is a single bare directory name and rejects empty strings, absolute paths, traversal segments, and path separators. See the GitHub commit and Pull Request #258 for full context.

Detection Methods for CVE-2026-58171

Indicators of Compromise

MCP tool invocations containing run_id values with ../, ..\, leading /, or drive letters.
run.json files appearing in filesystem locations outside the configured swarm runs base directory.
Unexpected modification timestamps on run.json files under sensitive paths accessible to the agent process.
Application logs showing load_run or reconcile_run calls referencing paths outside base_dir.

Detection Strategies

Instrument the MCP server to log every run_id argument and alert on values containing path separators or traversal tokens.
Compare resolved run_dir paths against the canonicalized base_dir and flag any that fall outside it.
Perform file integrity monitoring on directories containing run.json files to detect unauthorized writes.

Monitoring Recommendations

Forward MCP swarm tool audit logs to a centralized log platform for retention and correlation.
Monitor process-level file access from the Vibe-Trading agent for reads and writes outside base_dir.
Track anomalous MCP client behavior such as repeated failed run_id lookups following the patch, indicating probing.

How to Mitigate CVE-2026-58171

Immediate Actions Required

Upgrade Vibe-Trading to version 0.1.10 or later, which contains the fix from Pull Request #258.
Restrict which principals can reach the MCP swarm tools until the upgrade is applied.
Audit existing run.json files on disk for locations outside the configured runs base directory.

Patch Information

The fix is included in Vibe-Trading v0.1.10. The patch adds validation in SwarmStore.run_dir to raise ValueError on empty, absolute, or path-shaped run_id values, and wraps store.load_run calls in agent/mcp_server.py to return a structured error response. Refer to the VulnCheck Advisory for the coordinated disclosure summary.

Workarounds

Place the Vibe-Trading agent behind a reverse proxy or wrapper that rejects run_id values containing /, \, .., or absolute path markers.
Run the agent under a dedicated low-privilege service account with filesystem access limited to the runs base directory.
Apply mandatory access controls such as AppArmor or SELinux to confine the agent process to its runs directory.

bash

# Upgrade to the patched release
pip install --upgrade "vibe-trading>=0.1.10"

# Verify installed version
python -c "import importlib.metadata; print(importlib.metadata.version('vibe-trading'))"