CVE-2026-92360: ag-ui-protocol ag-ui 1.0 RCE Vulnerability

CVE-2026-92360 Overview

CVE-2026-92360 is an origin validation error [CWE-345] affecting ag-ui-protocol ag-ui version 1.0. The flaw resides in the prepareRunAgentInput function inside agent/agent.ts, part of the Event Application Layer. An attacker who manipulates the TEXT_MESSAGE_START argument can trigger improper origin validation over the network. A pull request to remediate the issue is currently pending acceptance by the maintainers.

Critical Impact
Remote attackers with low privileges can bypass origin validation checks in the ag-ui agent event pipeline, potentially leading to limited confidentiality, integrity, and availability impact on affected deployments.

Affected Products

ag-ui-protocol ag-ui 1.0
Component: Event Application Layer (agent/agent.ts)
Function: prepareRunAgentInput

Discovery Timeline

2026-09-16 - CVE-2026-92360 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92360

Vulnerability Analysis

The vulnerability originates in the prepareRunAgentInput function within agent/agent.ts, which handles event input processing for ag-ui agents. When the function processes the TEXT_MESSAGE_START argument, it fails to properly validate the origin of the incoming event data. This weakness maps to [CWE-345] Insufficient Verification of Data Authenticity.

Because the Event Application Layer trusts incoming message data without confirming its source, an authenticated remote attacker can craft events that the agent will accept and process as legitimate. The consequence is a limited breach of authenticity across the agent runtime, which can cascade into downstream integrity and confidentiality issues within the agent's workflow.

Root Cause

The root cause is missing or inadequate origin checks on the TEXT_MESSAGE_START event argument inside prepareRunAgentInput. Trust decisions are made based on event content rather than a verified origin, allowing malformed or spoofed events to enter the processing pipeline.

Attack Vector

Exploitation occurs over the network and requires low privileges without user interaction. An attacker submits a manipulated TEXT_MESSAGE_START event to a reachable ag-ui endpoint. The agent processes the event without validating its origin, allowing the attacker to influence agent state or downstream actions.

No verified proof-of-concept code is publicly available. See GitHub Issue #2437 and the pending fix in GitHub Pull Request #2701 for technical details.

Detection Methods for CVE-2026-92360

Indicators of Compromise

Unexpected TEXT_MESSAGE_START events arriving from unauthenticated or unknown network sources.
Agent runs initiated without a corresponding upstream user or client session identifier.
Anomalous sequences of ag-ui events that do not follow the expected client-driven lifecycle.

Detection Strategies

Inspect ag-ui event logs for TEXT_MESSAGE_START payloads that lack expected origin metadata or arrive out of sequence.
Correlate agent execution events with authenticated client sessions to identify orphaned or spoofed runs.
Deploy application-layer monitoring on endpoints exposing the ag-ui protocol to flag malformed event structures.

Monitoring Recommendations

Enable verbose logging of the Event Application Layer, including source IP, session identifiers, and event types.
Alert on spikes in prepareRunAgentInput invocations from a single client or across previously idle endpoints.
Forward ag-ui service telemetry to a centralized analytics platform for baseline comparison and anomaly detection.

How to Mitigate CVE-2026-92360

Immediate Actions Required

Inventory all deployments using ag-ui-protocol ag-ui 1.0 and identify network-exposed instances.
Restrict access to ag-ui endpoints using authentication proxies, allowlists, or network segmentation.
Track GitHub Pull Request #2701 and apply the fix once merged and released.

Patch Information

At publication time, no official patched release is available. The proposed fix is tracked in GitHub Pull Request #2701 and awaits maintainer acceptance. Additional context is available in the VulDB entry for CVE-2026-92360 and the upstream ag-ui-protocol repository.

Workarounds

Place ag-ui services behind a reverse proxy that enforces authenticated sessions and validates event origin headers.
Apply strict input validation at the application boundary to reject TEXT_MESSAGE_START events lacking verified session context.
Limit exposure of the Event Application Layer to trusted internal networks until a patched release is available.

bash

# Example: restrict ag-ui service exposure to a trusted subnet using iptables
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP