Callstack published an advisory on November 13, 2026 for agent-device, its open-source device layer for AI coding agents. The researcher naroSEC reported that a caller holding a valid bearer token for the daemon’s /rpc endpoint could read files on the host. VulnCheck assigned CVE-2026-129130 the same day.
Quick Take
- What: agent-device 0.21.36 let authenticated remote callers read plaintext files from the host machine via file:// URLs
- Who is affected: Installations with the daemon exposed through authorized remote configuration, the managed web backend installed, and a caller holding a valid bearer token for /rpc
- What to do: Upgrade to agent-device 0.21.37; review which plaintext files the daemon’s account could read on hosts that ran 0.21.36 with remote access enabled
- Fixed in: Version 0.21.37
- CVE: CVE-2026-129130
In plain English
A security flaw in agent-device, a tool that lets AI coding assistants control a web browser, allowed someone with the right access token to read any text file on the computer running the tool. The attacker would send a special web address starting with file:// to open a local file, then ask for a snapshot to get the file’s contents. This only worked if the tool was set up to accept remote connections and the attacker had a valid access token. Callstack fixed the problem in version 0.21.37.
What you should do: If you use agent-device only on your own computer without remote access, you were not at risk. If you run agent-device as a server, update to 0.21.37 and check what files the tool could have accessed.
What happened
Callstack published an advisory on November 13, 2026 for agent-device, its open-source device layer for AI coding agents. The researcher naroSEC reported that a caller holding a valid bearer token for the daemon’s /rpc endpoint could read files on the host. VulnCheck assigned CVE-2026-129130 the same day.
The daemon’s web commands accept a file:// target. An open command points the managed browser backend at a local path, and a following snapshot command returns the page text, which for a plaintext file is the file’s contents. GitHub classifies the flaw as CWE-73, external control of file name or path. The caller needs no direct filesystem access of its own.
Version 0.21.36 is affected and 0.21.37 carries the fix. Reaching the flaw needs the daemon exposed through an authorized remote configuration, the managed web backend installed with agent-device web setup, and a caller holding a valid bearer token for /rpc. Any plaintext file the daemon’s account can read is in scope.
What you should do
Upgrade agent-device to 0.21.37, which Callstack gives as the only remedy. The advisory lists no workaround. On hosts that ran 0.21.36 with remote access enabled, review which plaintext files the daemon’s account could read.
Exposure requires more than installing agent-device. Callstack’s advisory says the vulnerable path needs the daemon published through an authorized remote configuration, the managed web backend installed with agent-device web setup, and a caller holding a valid bearer token for the /rpc endpoint. Operators who never enabled remote access have no remote caller able to send the open and snapshot pair.
What it means
Two official sources scored CVE-2026-129130 separately. VulnCheck, the CNA that assigned the identifier, published 7.1 under CVSS 4.0 and 6.5 under CVSS 3.1. Callstack’s own GitHub advisory published 7.7 under CVSS 3.1 and rates the flaw High, using a changed scope.
The release also bundles broader hardening that Callstack describes as coming from its November audit, covering the daemon, the remote transport, replay, capture and providers.
