CVE-2026-92359: ag-ui-protocol CSRF Vulnerability

CVE-2026-92359 Overview

CVE-2026-92359 is a low-severity origin validation flaw in the ag-ui-protocol ag-ui project, version 0.3.0. The issue lives in the create_strands_app function in integrations/aws-strands/python/src/ag_ui_strands/utils.py, which configures the FastAPI CORSMiddleware. The middleware applies a permissive cross-domain policy that trusts untrusted origins. Remote attackers can attempt to leverage this misconfiguration against browser clients of an ag-ui deployment. Exploitation requires user interaction and is characterized as difficult. Upgrading to release AGUI.Abstractions@0.0.6 resolves the flaw. The weakness is tracked under [CWE-346] Origin Validation Error.

Critical Impact
A permissive CORS configuration in the AWS Strands integration can allow untrusted web origins to interact with the agent endpoint through a victim's browser, potentially exposing limited response data.

Affected Products

ag-ui-protocol ag-ui version 0.3.0
AWS Strands integration component (integrations/aws-strands/python/src/ag_ui_strands/utils.py)
Deployments using CORSMiddleware configured through create_strands_app

Discovery Timeline

2026-09-16 - CVE-2026-92359 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database
Patch commit 9b143b9668fa52c2054ede9d34a45ac4b4401089 merged via Pull Request #2492, addressing Issue #2433

Technical Details for CVE-2026-92359

Vulnerability Analysis

The flaw is an origin validation error in the FastAPI application factory for the AWS Strands agent integration. The create_strands_app helper installs CORSMiddleware with an overly broad allow-list, effectively trusting cross-origin requests from arbitrary domains. Because credentialed requests or state-changing operations can be initiated from any origin the browser will follow, a malicious site can coax a victim's browser into calling the agent endpoint.

The patch in the AWS Strands endpoint tightens request handling by enforcing a strict application/json (or application/*+json) content type on inbound requests. This complements the CORS hardening by rejecting requests that use simple, non-preflighted content types, which are the primary vehicle for CORS abuse against JSON APIs.

Root Cause

The root cause is a permissive CORS policy applied without allow-list restrictions in create_strands_app. The design assumed benign browser callers and did not validate the Origin header against a known trust boundary. Combined with a lax content-type contract on the agent endpoint, this exposed the API to cross-origin abuse from any web page the victim visits.

Attack Vector

An attacker hosts a malicious page that a victim with browser access to an internal or authenticated ag-ui AWS Strands deployment visits. The page issues cross-origin fetch calls to the agent endpoint. Because the server echoes back permissive CORS headers, the attacker's script can read responses that would normally be protected by the same-origin policy. Exploitation requires user interaction and network reachability to the target endpoint.

python

# Patch excerpt: integrations/aws-strands/python/src/ag_ui_strands/endpoint.py
# Enforces a strict content type on the agent endpoint as part of the CORS/auth fix.

async def _require_json_content_type(request: Request) -> None:
    """Reject requests whose media type cannot carry JSON."""
    content_type = request.headers.get("content-type")
    media_type = content_type.split(";", 1)[0].strip().lower() if content_type else ""
    is_json = media_type == "application/json"
    is_structured_json = media_type.startswith("application/") and media_type.endswith(
        "+json"
    )

    if not (is_json or is_structured_json):
        raise HTTPException(
            status_code=415,
            detail="Content-Type must be application/json or application/*+json",
        )

Source: GitHub Commit 9b143b9

Detection Methods for CVE-2026-92359

Indicators of Compromise

HTTP responses from ag-ui Strands endpoints containing Access-Control-Allow-Origin: * or reflecting arbitrary values from the Origin request header.
Requests to the Strands agent endpoint with Origin headers referencing unexpected external domains.
Preflight OPTIONS requests to / or agent routes from unknown web origins followed by successful cross-origin POST calls.

Detection Strategies

Inspect deployed ag-ui versions and confirm whether create_strands_app is invoked with a permissive CORS configuration.
Add web application firewall or reverse-proxy rules that flag responses echoing arbitrary origins from Strands endpoints.
Correlate outbound browser telemetry with cross-origin calls to internal ag-ui hosts that lack a legitimate business use case.

Monitoring Recommendations

Log the Origin, Referer, and Content-Type headers for all requests to Strands-integrated FastAPI applications.
Alert on non-preflighted POST requests to agent endpoints using content types other than application/json.
Track dependency inventories to identify hosts still running ag-ui 0.3.0 in production or staging environments.

How to Mitigate CVE-2026-92359

Immediate Actions Required

Upgrade the affected component to AGUI.Abstractions@0.0.6 or later as published in the official release.
Inventory all services that instantiate create_strands_app and confirm they pull the patched code.
Restrict network exposure of ag-ui Strands endpoints to trusted internal networks pending patch rollout.

Patch Information

The fix is delivered in commit 9b143b9668fa52c2054ede9d34a45ac4b4401089 and shipped in release AGUI.Abstractions@0.0.6. See the security patch commit, Pull Request #2492, and Issue #2433 for full technical context. Additional metadata is available in the VulDB entry for CVE-2026-92359.

Workarounds

Manually replace the permissive CORSMiddleware configuration with an explicit allow_origins allow-list of trusted domains.
Set allow_credentials=False unless credentialed cross-origin access is required, and never combine credentials with wildcard origins.
Front the Strands endpoint with a reverse proxy that strips or validates Origin headers and enforces Content-Type: application/json.

bash

# Example FastAPI CORS hardening for ag-ui Strands integration
from fastapi.middleware.cors import CORSMiddleware

app.add_middleware(
    CORSMiddleware,
    allow_origins=["https://app.internal.example.com"],
    allow_credentials=False,
    allow_methods=["POST", "OPTIONS"],
    allow_headers=["Content-Type", "Authorization"],
)