CVE-2026-75482: SWE-agent Path Traversal Vulnerability

CVE-2026-75482 Overview

CVE-2026-75482 is a path traversal vulnerability [CWE-22] in the SWE-agent trajectory inspector (sweagent inspector), confirmed in version 1.1.0. The inspector's HTTP server joins request paths to the trajectory directory in its /trajectory/ handler without rejecting parent-directory (..) sequences, bypassing built-in path sanitization. The server binds all interfaces (0.0.0.0), applies wildcard CORS, and requires no authentication. An unauthenticated network attacker, or a malicious web page abusing CORS, can read files outside the intended directory.

Critical Impact
Unauthenticated remote attackers can read trajectory-shaped JSON files outside the intended directory, potentially disclosing repository contents, command output, and embedded secrets or API keys.

Affected Products

SWE-agent trajectory inspector (sweagent inspector)
Confirmed affected version: v1.1.0
Component: sweagent/inspector/server.py

Discovery Timeline

2026-08-17 - CVE-2026-75482 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-75482

Vulnerability Analysis

The SWE-agent inspector exposes an HTTP endpoint at /trajectory/ that serves trajectory JSON files from a configured directory. The handler constructs the target file path by joining the incoming request path with the trajectory directory root. The join operation does not reject .. segments before path normalization, so traversal sequences escape the intended base directory.

Compounding factors turn a local debugging tool into a network-reachable disclosure primitive. The server binds 0.0.0.0, making it reachable on every interface. It applies a wildcard CORS policy, so any browser origin can issue cross-origin fetches. It also requires no authentication.

The read sink parses returned bytes as trajectory JSON, so disclosure is constrained to files whose content parses as a trajectory structure. Trajectory files routinely contain repository source, executed command output, and secrets such as API keys embedded in agent context.

Root Cause

The root cause is missing validation of user-supplied path components before file system access. The /trajectory/ handler in sweagent/inspector/server.py concatenates request path input with the trajectory root without canonicalizing the result and verifying it remains inside the intended directory. This maps directly to [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

An unauthenticated attacker with network reachability to the inspector port sends an HTTP request containing .. sequences in the /trajectory/ path. Alternatively, a victim visiting a malicious page triggers cross-origin fetches from the browser to a locally bound inspector, which the wildcard CORS policy permits. The server resolves the traversed path, opens the file, and returns its content parsed as trajectory JSON. Because the parser expects trajectory shape, exploitation targets other trajectory files or JSON artifacts on the host that conform to that structure.

See the VulnCheck advisory and the inspector server source for technical details.

Detection Methods for CVE-2026-75482

Indicators of Compromise

HTTP requests to the inspector containing /trajectory/ with .., %2e%2e, or URL-encoded traversal sequences in the path.
Cross-origin browser requests to the inspector port from unexpected external Origin headers, permitted by the wildcard CORS policy.
Inspector process reading files outside the configured trajectory directory, visible in file access telemetry.

Detection Strategies

Inspect web server or reverse proxy logs for /trajectory/ requests containing path traversal patterns, including double-encoded variants.
Correlate sweagent inspector process file opens against the expected trajectory directory and alert on reads outside that root.
Flag inbound connections to the inspector listener on non-loopback interfaces, since production use rarely justifies binding 0.0.0.0.

Monitoring Recommendations

Monitor listening sockets on hosts running SWE-agent for inspector ports exposed beyond 127.0.0.1.
Alert on HTTP responses from the inspector larger than typical trajectory files or containing strings resembling API keys or credentials.
Track outbound connections from developer workstations to unknown origins immediately followed by inspector reads, indicating browser-driven CORS abuse.

How to Mitigate CVE-2026-75482

Immediate Actions Required

Stop exposing the sweagent inspector service to untrusted networks; restrict binding to 127.0.0.1 and use SSH tunneling for remote access.
Rotate any API keys, tokens, or credentials that may have been captured in trajectory JSON files on affected hosts.
Audit inspector deployments for version v1.1.0 and inventory trajectory directories that could contain sensitive repository content.

Patch Information

No fixed version is enumerated in the NVD entry at publication. Track the upstream SWE-agent repository and GitHub Issue #1472 for the remediation commit. Apply the fix once released and verify that /trajectory/ rejects .. segments and canonicalizes paths against the trajectory root.

Workarounds

Bind the inspector to loopback only by running it behind a local interface and reaching it through an authenticated tunnel.
Place the inspector behind a reverse proxy that enforces authentication, strips .. from request paths, and applies a strict same-origin CORS policy.
Run the inspector inside a container or sandbox whose filesystem view contains only the trajectory directory, eliminating traversal targets.
Disable the inspector entirely in shared or multi-tenant environments until a patched release is available.

bash

# Configuration example: restrict inspector to loopback and tunnel over SSH
# On the host running SWE-agent:
sweagent inspector --host 127.0.0.1 --port 8000

# From an operator workstation:
ssh -L 8000:127.0.0.1:8000 user@swe-agent-host
# Then browse to http://127.0.0.1:8000 locally