GHSA: Tool List API Leaks Source Code with Hardcoded Credentials to Read-Only Users (CVE-2026-70491)

Vulnerability Overview Vulnerability Title: Tool source code disclosed to read-only users via the tool list and get endpoints Vulnerability ID: GHSA-3r7g-q5cq-q2vx Severity: 6.5 / 10 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: None - Availability: None CVE ID: CVE-2026-70491 Weakness: CWE-200 Impact Scope Affected Versions: <= 0.10.2 Fixed Version: 0.11.0 Impact Description: Non-administrator users can obtain the server-side tool source code of other users. Tool source code typically contains hardcoded API keys, credentials, and internal service URLs, so the actual damage may be more severe than the code itself. The attack does not require special permissions; it only requires a regular account to share the tool. It only affects confidentiality and does not grant permissions to create, modify, or execute tools, nor does it affect integrity or availability. Remediation Fixed Version: 0.11.0 Fix Details: Fixed in commits c65e43b4 (627005) and 31aa9338. The per-id endpoint no longer provides source code to callers without write permissions, and both list endpoints no longer load source code. Function stations remain visible to read-only users because the chat tool list renders tool functions from them. Tool execution loads source code server-side, so shared tools continue to work. Upgrading to 0.11.0 fully resolves this issue without any configuration changes. Proof of Concept (POC) Code Additional Information Reporter: bogdancherry11-sudo Fix Developer: Classic298

Goal Reached Thanks to every supporter — we hit 100%!

GHSA: Tool List API Leaks Source Code with Hardcoded Credentials to Read-Only Users (CVE-2026-70491)

More from this source