CVE-2026-87988: Mistral Vibe Path Traversal Vulnerability

CVE-2026-87988 Overview

CVE-2026-87988 is an arbitrary file access vulnerability in Mistral Vibe. The flaw allows an attacker to bypass workspace restrictions through commands classified as unconditionally allowed. Missing path validation on these commands enables access to files outside the active workspace without user approval.

The vulnerability is categorized under [CWE-732] Incorrect Permission Assignment for Critical Resource. It affects the trust boundary between user-approved workspace scope and the underlying file system.

Critical Impact
An unauthenticated network attacker can read or interact with files outside the active workspace, exposing sensitive host data without triggering the approval workflow.

Affected Products

Mistral Vibe (agentic coding assistant)
Deployments relying on workspace-scoped command restrictions
Environments where Mistral Vibe processes untrusted prompts or repositories

Discovery Timeline

2026-09-11 - CVE CVE-2026-87988 published to the National Vulnerability Database (NVD)
2026-09-11 - Last updated in NVD database
2026-09-21 - Exploit Prediction Scoring System (EPSS) data refreshed

Technical Details for CVE-2026-87988

Vulnerability Analysis

Mistral Vibe enforces workspace isolation by requiring user approval for commands that touch resources outside the active project. To reduce friction, a subset of commands is classified as unconditionally allowed and executes without prompting the user.

The vulnerability stems from these unconditionally allowed commands lacking path validation. An attacker can supply file paths that resolve outside the workspace root, and the assistant executes them without invoking the approval workflow. This breaks the security boundary users rely on to constrain the agent.

Because the flaw is exposed over a network attack vector and requires no privileges or user interaction, exploitation is straightforward once an attacker can influence the agent's input. Consult the HiddenLayer Security Advisory for vendor-provided technical detail.

Root Cause

The root cause is a missing canonical path check on commands in the allow-list. The classifier trusts the command category and skips validation of arguments. Files outside the workspace directory can therefore be read, listed, or otherwise accessed through legitimate command wrappers.

Attack Vector

An attacker delivers a crafted prompt, repository file, or tool instruction that causes Mistral Vibe to invoke an unconditionally allowed command with a path pointing outside the workspace. The agent executes the command without approval, returning file contents or metadata to the attacker-controlled channel. Refer to the HiddenLayer Security Advisory for exploitation specifics.

Detection Methods for CVE-2026-87988

Indicators of Compromise

Mistral Vibe accessing file paths outside the declared workspace root, such as /etc/, ~/.ssh/, or cloud credential directories.
Command execution logs showing allow-listed commands invoked with absolute paths or .. traversal segments.
Unexpected reads of sensitive artifacts like id_rsa, .aws/credentials, or .env files during agent sessions.

Detection Strategies

Instrument the agent host to log every command invocation with resolved canonical paths and compare against the workspace root.
Correlate agent-initiated file reads with the user approval log; flag executions of allow-listed commands that touched out-of-scope paths.
Apply file integrity monitoring on credential and configuration directories to catch reads originating from the Vibe process.

Monitoring Recommendations

Forward Mistral Vibe process telemetry, including child-process arguments, to a centralized analytics platform for behavioral review.
Alert on any agent process spawning shell commands that reference paths outside the active project directory.
Track prompts or repository content containing directory traversal patterns targeting agent tool interfaces.

How to Mitigate CVE-2026-87988

Immediate Actions Required

Upgrade Mistral Vibe to the fixed release identified in the HiddenLayer Security Advisory as soon as it is available.
Restrict Mistral Vibe execution to isolated user accounts with no access to sensitive host files or credentials.
Review recent agent session logs for out-of-workspace file access and rotate any credentials that may have been exposed.

Patch Information

Refer to the vendor advisory published by HiddenLayer for the authoritative patch reference and fixed version details: HiddenLayer Security Advisory. No specific patched version was listed in the NVD record at the time of publication.

Workarounds

Run Mistral Vibe inside a container or sandbox with a bind mount limited to the intended workspace directory.
Remove or relocate sensitive files (SSH keys, cloud credentials, .env files) from the user profile that runs the agent.
Disable or narrow the set of unconditionally allowed commands where the client configuration permits.
Treat any repository or prompt from untrusted sources as hostile input until the fix is deployed.

bash

# Example: run Mistral Vibe in a restricted sandbox with only the workspace mounted
docker run --rm -it \
  --user 1000:1000 \
  --read-only \
  --tmpfs /tmp \
  -v "$PWD/workspace":/workspace:rw \
  -w /workspace \
  mistral-vibe:latest