Critical Path Traversal Flaw in AI Codebase Analysis Tool
A high-severity path traversal vulnerability tracked as CVE-2026-77604 has been disclosed in Code Graph RAG, an AI-powered knowledge graph and retrieval system for querying and editing multi-language codebases. The flaw allows unauthenticated attackers to read arbitrary files from the server filesystem when the Model Context Protocol (MCP) server is exposed over HTTP.
Vulnerability Details
The vulnerability exists in the `MCPToolsRegistry.read_file` implementation in `codebase_rag/mcp/tools.py`. When the `offset` or `limit` parameters are supplied to the read_file MCP tool, the code takes a paginated branch that constructs a file path using `Path(self.project_root) / file_path` without subsequently validating that the resolved path remains within the configured project root.
According to the security advisory GHSA-vvr2-h2jp-838m, Python’s pathlib silently discards the left-hand component when the right-hand argument is an absolute path. This allows an attacker to read any UTF-8-readable file on the server by passing an absolute path such as `/etc/passwd`.
The vulnerable code is located at lines 556-565 of `codebase_rag/mcp/tools.py`:
“`python
if offset is not None or limit is not None:
full_path = Path(self.project_root) / file_path
start = offset if offset is not None else 0
with open(full_path, encoding=cs.ENCODING_UTF8) as f:
“`
The non-paginated branch is protected by the `@validate_project_path` decorator which performs `.resolve().relative_to(project_root)` validation, but this decorator is never invoked in the paginated branch.
Attack Vector and Impact
The vulnerability is exploitable when the MCP server is configured with HTTP transport. The default configuration in `codebase_rag/config.py` sets the HTTP MCP host to `0.0.0.0`, making it network-accessible.
An unauthenticated attacker can craft a request to read arbitrary files:
“`python
result = await session.call_tool(
“read_file”,
{“file_path”: “/etc/passwd”, “offset”: 0, “limit: 10}
)
“`
The advisory notes that an attacker can exfiltrate sensitive files including credentials, configuration files, and other UTF-8-readable content available to the server process. The vulnerability requires no authentication and no user interaction beyond the attacker sending a crafted HTTP request.
Affected Versions and Patch
The vulnerability affects Code Graph RAG version 0.0.343 and earlier. Version 0.0.345, released on July 14, 2026, contains a patch that addresses the issue.
The fix, implemented in commit 6541e920a27961fa8f3ff49ef38c0e0bd09cd626, adds path validation to the paginated branch:
“`python
project_root = Path(self.project_root).resolve()
try:
full_path = (project_root / file_path).resolve()
full_path.relative_to(project_root)
except (ValueError, RuntimeError):
return te.ERROR_WRAPPER.format(
message=lg.FILE_OUTSIDE_ROOT.format(action=access)
)
“`
The patch resolves both the project root and the constructed path, then verifies the resolved path remains within the project root using `relative_to()`. If the path escapes the boundary, a `ValueError` or `RuntimeError` is caught and an error message is returned.
Proof of Concept
The security advisory includes a Docker-based proof of concept that demonstrates the vulnerability. The PoC creates a fake JWT token (signature not verified by the vulnerable code), instantiates the `MCPToolsRegistry`, and calls `read_file(/etc/hosts, offset=0, limit=5)` to retrieve content from outside the project root.
The PoC confirms that pathlib discards the project root when the file path is absolute, allowing complete boundary bypass.
CVSS Score and Severity
The National Vulnerability Database assigned CVE-2026-77604 a CVSS v3 base score of 7.5 (High severity). The attack vector is network-based with low attack complexity, requires no privileges, and needs no user interaction. The primary impact is to confidentiality, as the vulnerability allows unauthorized information disclosure.
Recommendations
Users running the Code Graph RAG MCP server should immediately upgrade to version 0.0.345 or later. Organizations that have deployed the MCP server with HTTP transport exposed to untrusted networks face the highest risk and should prioritize patching.
The release notes for version 0.0.345 state: Upgrade is recommended for users of `cgr mcp-server`” and highlight the security fix as a critical component of the release.
Administrators unable to upgrade immediately should restrict network access to the MCP HTTP endpoint or disable HTTP transport in favor of stdio transport, though the advisory notes the vulnerability is present in both transports—only the network accessibility differs.
