CVE-2026-101100

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-101100", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-09-28T02:53:37.761Z", "datePublished": "2026-09-28T17:30:15.988Z", "dateUpdated": "2026-09-28T17:47:55.078Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-09-28T17:30:15.988Z"}, "title": "ag-ui-protocol ag-ui Middleware filter-tool-calls.ts FilterToolCallsMiddleware cleanup", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-459", "lang": "en", "description": "Incomplete Cleanup"}]}], "affected": [{"vendor": "ag-ui-protocol", "product": "ag-ui", "versions": [{"version": "2026-09-07", "status": "affected"}, {"version": "2026-09-08", "status": "unaffected"}], "cpes": ["cpe:2.3:a:ag-ui-protocol:ag-ui:*:*:*:*:*:*:*:*"], "modules": ["Middleware"]}], "descriptions": [{"lang": "en", "value": "A flaw has been found in ag-ui-protocol ag-ui up to 2026-09-07. This vulnerability affects the function FilterToolCallsMiddleware of the file sdks/typescript/packages/client/src/middleware/filter-tool-calls.ts of the component Middleware. Executing a manipulation can lead to incomplete cleanup. The attack may be launched remotely. Upgrading to version 2026-09-08 is able to resolve this issue. This patch is called c346119fe870b70f5c19738ee5119f3e1456e59d. It is suggested to upgrade the affected component."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.4, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5.5, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P/E:ND/RL:OF/RC:C"}}], "timeline": [{"time": "2026-09-08T00:00:00.000Z", "lang": "en", "value": "Countermeasure disclosed"}, {"time": "2026-09-28T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-09-28T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-09-28T04:58:57.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "meraklbz (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/vuln/410975", "name": "VDB-410975 | ag-ui-protocol ag-ui Middleware filter-tool-calls.ts FilterToolCallsMiddleware cleanup", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/410975/cti", "name": "VDB-410975 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-101100", "name": "CVE-2026-101100 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/934980", "name": "Submit #934980 | ag-ui-protocol ag-ui v1.0 CWE-459", "tags": ["third-party-advisory"]}, {"url": "https://github.com/ag-ui-protocol/ag-ui/issues/2443", "tags": ["issue-tracking"]}, {"url": "https://github.com/ag-ui-protocol/ag-ui/pull/2494", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/ag-ui-protocol/ag-ui/commit/c346119fe870b70f5c19738ee5119f3e1456e59d", "tags": ["patch"]}, {"url": "https://github.com/ag-ui-protocol/ag-ui/releases/tag/release/2026-09-08", "tags": ["patch"]}, {"url": "https://github.com/ag-ui-protocol/ag-ui/", "tags": ["product"]}], "tags": ["x_open-source"], "x_generator": ["VulDB PVTS v202609"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-28T17:47:46.613540Z", "id": "CVE-2026-101100", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-28T17:47:55.078Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-101100", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-28T17:47:46.613540Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-28T17:47:50.315Z"}}], "cna": {"tags": ["x_open-source"], "title": "ag-ui-protocol ag-ui Middleware filter-tool-calls.ts FilterToolCallsMiddleware cleanup", "credits": [{"lang": "en", "type": "reporter", "value": "meraklbz (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5.5, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P/E:ND/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:ag-ui-protocol:ag-ui:*:*:*:*:*:*:*:*"], "vendor": "ag-ui-protocol", "modules": ["Middleware"], "product": "ag-ui", "versions": [{"status": "affected", "version": "2026-09-07"}, {"status": "unaffected", "version": "2026-09-08"}]}], "timeline": [{"lang": "en", "time": "2026-09-08T00:00:00.000Z", "value": "Countermeasure disclosed"}, {"lang": "en", "time": "2026-09-28T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-09-28T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-09-28T04:58:57.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/410975", "name": "VDB-410975 | ag-ui-protocol ag-ui Middleware filter-tool-calls.ts FilterToolCallsMiddleware cleanup", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/410975/cti", "name": "VDB-410975 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-101100", "name": "CVE-2026-101100 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/934980", "name": "Submit #934980 | ag-ui-protocol ag-ui v1.0 CWE-459", "tags": ["third-party-advisory"]}, {"url": "https://github.com/ag-ui-protocol/ag-ui/issues/2443", "tags": ["issue-tracking"]}, {"url": "https://github.com/ag-ui-protocol/ag-ui/pull/2494", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/ag-ui-protocol/ag-ui/commit/c346119fe870b70f5c19738ee5119f3e1456e59d", "tags": ["patch"]}, {"url": "https://github.com/ag-ui-protocol/ag-ui/releases/tag/release/2026-09-08", "tags": ["patch"]}, {"url": "https://github.com/ag-ui-protocol/ag-ui/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202609"], "descriptions": [{"lang": "en", "value": "A flaw has been found in ag-ui-protocol ag-ui up to 2026-09-07. This vulnerability affects the function FilterToolCallsMiddleware of the file sdks/typescript/packages/client/src/middleware/filter-tool-calls.ts of the component Middleware. Executing a manipulation can lead to incomplete cleanup. The attack may be launched remotely. Upgrading to version 2026-09-08 is able to resolve this issue. This patch is called c346119fe870b70f5c19738ee5119f3e1456e59d. It is suggested to upgrade the affected component."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-459", "description": "Incomplete Cleanup"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-09-28T17:30:15.988Z"}}}, "cveMetadata": {"cveId": "CVE-2026-101100", "state": "PUBLISHED", "dateUpdated": "2026-09-28T17:47:55.078Z", "dateReserved": "2026-09-28T02:53:37.761Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-09-28T17:30:15.988Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ag-ui-protocol:ag-ui:*:*:*:*:*:*:*:*"], "modules": ["Middleware"], "product": "ag-ui", "vendor": "ag-ui-protocol", "versions": [{"status": "affected", "version": "2026-09-07"}, {"status": "unaffected", "version": "2026-09-08"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw has been found in ag-ui-protocol ag-ui up to 2026-09-07. This vulnerability affects the function FilterToolCallsMiddleware of the file sdks/typescript/packages/client/src/middleware/filter-tool-calls.ts of the component Middleware. Executing a manipulation can lead to incomplete cleanup. The attack may be launched remotely. Upgrading to version 2026-09-08 is able to resolve this issue. This patch is called c346119fe870b70f5c19738ee5119f3e1456e59d. It is suggested to upgrade the affected component."}], "id": "CVE-2026-101100", "lastModified": "2026-09-28T21:03:44.987", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 5.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "cna@vuldb.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-101100", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-28T17:47:46.613540Z", "version": "2.0.3"}}]}, "published": "2026-09-28T18:17:16.977", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/ag-ui-protocol/ag-ui/"}, {"source": "cna@vuldb.com", "url": "https://github.com/ag-ui-protocol/ag-ui/commit/c346119fe870b70f5c19738ee5119f3e1456e59d"}, {"source": "cna@vuldb.com", "url": "https://github.com/ag-ui-protocol/ag-ui/issues/2443"}, {"source": "cna@vuldb.com", "url": "https://github.com/ag-ui-protocol/ag-ui/pull/2494"}, {"source": "cna@vuldb.com", "url": "https://github.com/ag-ui-protocol/ag-ui/releases/tag/release/2026-09-08"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-101100"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/934980"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/410975"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/410975/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-459"}], "source": "cna@vuldb.com", "type": "Primary"}]}

{"bugzilla": {"description": "@ag-ui/client: ag-ui-protocol ag-ui Middleware filter-tool-calls.ts FilterToolCallsMiddleware cleanup", "id": "2542581", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542581"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "status": "draft"}, "cwe": "CWE-459", "details": ["A flaw has been found in ag-ui-protocol ag-ui up to 2026-09-07. This vulnerability affects the function FilterToolCallsMiddleware of the file sdks/typescript/packages/client/src/middleware/filter-tool-calls.ts of the component Middleware. Executing a manipulation can lead to incomplete cleanup. The attack may be launched remotely. Upgrading to version 2026-09-08 is able to resolve this issue. This patch is called c346119fe870b70f5c19738ee5119f3e1456e59d. It is suggested to upgrade the affected component.", "A flaw was found in ag-ui's `@ag-ui/client` npm package. When processing manipulated tool call inputs in `FilterToolCallsMiddleware` (`filter-tool-calls.ts`), the middleware fails to perform complete resource and state cleanup. A remote authenticated attacker can exploit this vulnerability by submitting crafted tool call payloads, leading to residual state corruption or resource leaks that degrade application integrity and availability."], "mitigation": {"lang": "en:us", "value": "Sanitize tool call payload parameters at the API gateway layer before passing requests to the client middleware. Alternatively, restrict privileges for authenticated users allowed to execute tool call filtering logic."}, "name": "CVE-2026-101100", "public_date": "2026-09-28T17:30:15Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-101100\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-101100\nhttps://github.com/ag-ui-protocol/ag-ui/\nhttps://github.com/ag-ui-protocol/ag-ui/commit/c346119fe870b70f5c19738ee5119f3e1456e59d\nhttps://github.com/ag-ui-protocol/ag-ui/issues/2443\nhttps://github.com/ag-ui-protocol/ag-ui/pull/2494\nhttps://github.com/ag-ui-protocol/ag-ui/releases/tag/release/2026-09-08\nhttps://vuldb.com/cve/CVE-2026-101100\nhttps://vuldb.com/submit/934980\nhttps://vuldb.com/vuln/410975\nhttps://vuldb.com/vuln/410975/cti"], "statement": "A flaw was found in ag-ui within the client middleware component (`filter-tool-calls.ts`). In `FilterToolCallsMiddleware`, processing manipulated tool call inputs leads to incomplete cleanup of internal resources or state. A remote authenticated attacker can exploit this issue to alter application state tracking or cause resource leaks, resulting in low integrity and availability degradation. Container isolation and standard process boundaries contain the impact within the application runtime.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2026-09-07"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "2026-09-08"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "ag-ui", "source": "cna", "vendor": "ag-ui-protocol"}, "product": "ag-ui", "vendor": "ag-ui-protocol"}], "created": "2026-09-28T18:30:04.704934+00:00", "title": "Incomplete cleanup in ag\u2011ui Middleware FilterToolCallsMiddleware", "updated": "2026-09-28T19:15:05.880862+00:00", "vendors": ["ag-ui-protocol", "ag-ui-protocol$PRODUCT$ag-ui"]}