Which agent-device version fixes CVE-2026-129130?

Version 0.21.37 fixes CVE-2026-129130, and Callstack's advisory lists no workaround, so upgrading is the only remedy the vendor gives. The release also bundles broader hardening that Callstack describes as coming from its November audit, covering the daemon, the remote transport, replay, capture and providers. Version 0.21.36 is the affected release.

Why do the published CVSS scores for CVE-2026-129130 differ?

Two official sources scored CVE-2026-129130 separately. VulnCheck, the CNA that assigned the identifier, published 7.1 under CVSS 4.0 and 6.5 under CVSS 3.1. Callstack's own GitHub advisory published 7.7 under CVSS 3.1 and rates the flaw High, using a changed scope. Defenders comparing the numbers should note the different versions and scope choices behind them.

MEDVulnerability

agent-device: a file:// URL lets a remote caller read host files

agent-device 0.21.36 let a remote caller with a valid token read plaintext files from the machine running the agent's device daemon.

November 13, 2026 · Callstack · Research by naroSEC

CVE-2026-129130

MEDVulnerability

agent-device, Callstack's device layer for AI coding agents, let an authenticated remote caller open a local file:// URL and read the file back through a snapshot. Callstack rates it High and fixed it in 0.21.37. Found by naroSEC.

01What happened

Callstack published an advisory on November 13, 2026 for agent-device, its open-source device layer for AI coding agents. The researcher naroSEC reported that a caller holding a valid bearer token for the daemon's /rpc endpoint could read files on the host. VulnCheck assigned CVE-2026-129130 the same day.

02How it works

The daemon's web commands accept a file:// target. An open command points the managed browser backend at a local path, and a following snapshot command returns the page text, which for a plaintext file is the file's contents. GitHub classifies the flaw as CWE-73, external control of file name or path. The caller needs no direct filesystem access of its own.

03Who is affected

Version 0.21.36 is affected and 0.21.37 carries the fix. Reaching the flaw needs the daemon exposed through an authorized remote configuration, the managed web backend installed with agent-device web setup, and a caller holding a valid bearer token for /rpc. Any plaintext file the daemon's account can read is in scope.

04What to do

Upgrade agent-device to 0.21.37, which Callstack gives as the only remedy; the advisory lists no workaround. On hosts that ran 0.21.36 with remote access enabled, review which plaintext files the daemon's account could read.

Questions people ask

Am I affected if I only run agent-device locally?: Exposure requires more than installing agent-device. Callstack's advisory says the vulnerable path needs the daemon published through an authorized remote configuration, the managed web backend installed with agent-device web setup, and a caller holding a valid bearer token for the /rpc endpoint. Operators who never enabled remote access have no remote caller able to send the open and snapshot pair.
Which agent-device version fixes CVE-2026-129130?: Version 0.21.37 fixes CVE-2026-129130, and Callstack's advisory lists no workaround, so upgrading is the only remedy the vendor gives. The release also bundles broader hardening that Callstack describes as coming from its November audit, covering the daemon, the remote transport, replay, capture and providers. Version 0.21.36 is the affected release.
Why do the published CVSS scores for CVE-2026-129130 differ?: Two official sources scored CVE-2026-129130 separately. VulnCheck, the CNA that assigned the identifier, published 7.1 under CVSS 4.0 and 6.5 under CVSS 3.1. Callstack's own GitHub advisory published 7.7 under CVSS 3.1 and rates the flaw High, using a changed scope. Defenders comparing the numbers should note the different versions and scope choices behind them.

Sources 4 links, all fetched

1github.comCallstack Advisory
2github.comGitHub Advisory
3github.comRelease v0.21.37
4github.comagent-device Repo