CVE-2026-45046— Gryph Agents Payload Filter Fails to Strip Tool Payload for Sensitive Content
Possible ATT&CK Techniques 1AI
T1530 · Data from Cloud StorageGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-45046
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Gryph Agents Payload Filter Fails to Strip Tool Payload for Sensitive Content
Source: NVD (National Vulnerability Database)
Vulnerability Description
Gryph provides a security layer for AI coding agents. Prior to 0.7.0, Gryph implements logging levels that determine what content is logged to a local sqlite database. The README incorrectly mentions that the default log level is minimal while it is standard. Source code review shows sensitive file-write content remains in the stored payload as ContentPreview, OldString, or NewString at the default standard logging level and at full. This leads to logging of potentially sensitive file content in the local sqlite database, violating Gryphs sensitive file filter and log level contracts. This vulnerability is fixed in 0.7.0.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
敏感数据的不恰当跨边界移除
Source: NVD (National Vulnerability Database)
Vulnerability Title
gryph 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
gryph是SafeDep开源的一个AI编码代理活动审计与调试工具。 Gryph 0.7.0之前版本存在安全漏洞，该漏洞源于默认日志级别为标准而非最小，导致敏感文件写入内容存储在本地sqlite数据库中，可能违反敏感文件过滤器和日志级别合约。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-45046
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-45046
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-45046 (1)
IV. Related Vulnerabilities
Same weakness: CWE-212
- CVE-2026-42186
OpenBao's Namespace Deletion May Not Delete Data Properly - CVE-2024-43384
Phoenix Contact: Improper removal of sensitive information i - CVE-2026-43528
OpenClaw < 2026.4.14 - Redaction Bypass via sourceConfig and - CVE-2026-43824
Argo CD 安全漏洞 - CVE-2026-20928
Windows Recovery Environment Security Feature Bypass Vulnera
V. Comments for CVE-2026-45046
No comments yet