CVE-2026-18974

CVE-2026-18974 exposes a critical architectural flaw in agent frameworks: a direct tool invocation endpoint that bypasses the security boundaries assumed by the system's execution model. The execute_tool_manually endpoint accepts arbitrary tool_name and tool_params and executes them directly, which the CVE characterizes as information disclosure only because the affected function happens to read files. The underlying primitive is arbitrary tool invocation—not data leakage—and any tool the framework registers becomes a potential attack vector. The core issue is authorization failure, not any specific parameter vulnerability. If your deployment exposes this endpoint, treat it as a privileged administrative interface immediately: it should require authentication and authorization independent of the agent session, enforce explicit parameter schema validation rather than passthrough, and be unreachable from untrusted network contexts. Beyond access controls, audit logging must distinguish between LLM-mediated tool calls and direct endpoint invocations. Without provenance annotation, incident responders cannot determine whether a tool execution was adversarial (direct endpoint access) or a manipulated-but-otherwise-legitimate LLM decision. The forensic record should explicitly label callers of execute_tool_manually as such in all downstream systems. This vulnerability should be rated higher than the CVSS suggests. The 'information disclosure' label reflects what the current tool happens to do, not the capability the endpoint actually provides. If get_file_content were replaced with or supplemented by a tool performing destructive operations, the same endpoint becomes remote code execution. The severity assessment should weight the primitive (arbitrary tool invocation) rather than the artifact (current tool behavior).

Reviewed through automated stages and approved by a human before publication.