Bitter Frontier What coding agents just made possible, where the bottleneck moved, and what deserves attention.

Evidence record / agent-zero

A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.

2026-10-13-agent-zero-file-browser-advisories-require-authentication-and-mount-decisions

File-browser advisories require authentication and mount decisions. Two additional file-browser CVEs were published in this window: 51852 describes writes outside the intended workspace, and 51853 access to process-readable files. The advisory version/path combination does not map reliably to current tags. Tagged code independently roots the WebUI file browser at / and compares resolved directories against /; filename sanitization and normalization exist but do not confine directories. In Docker this is the container filesystem and mounts, subject to process permissions. Login is bypassed when no credentials hash exists; AUTH_LOGIN enables the login configuration. No scope restriction addressing this behavior was found through v2.14. The ledger’s UID 0 result belongs to its named test container. Repository advisories remain empty; these two external records have no package mapping. An older MCP-configuration command-execution advisory already existed before the window, so these are not the first third-party CVEs.

Channel: docs-only. Half: defect. Date: 2026-09-30.

Operator consequence: Set AUTH_LOGIN and AUTH_PASSWORD before exposing the port outside a controlled network, and keep mounts narrow. Login limits who enters; authenticated users retain the file-browser scope. A version bump alone does not create workspace confinement. Do not promise a future Dependabot alert from records that presently lack package mappings, or infer maintainer intent from the root scope.

Receipt

Finding metadata

Confidence
high

Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0

Finding ID: 2026-10-13-agent-zero-file-browser-advisories-require-authentication-and-mount-decisions

Profile citations

Source links

Primary links, including exact changelog lines when available.

  1. Agent Zero
    official docs2026-10-13-agent-zero-file-browser-advisories-require-authentication-and-mount-decisionsnvd.nist.gov/vuln/detail/CVE-2026-51852official docs2026-10-13-agent-zero-file-browser-advisories-require-authentication-and-mount-decisionsnvd.nist.gov/vuln/detail/CVE-2026-51853official docs2026-10-13-agent-zero-file-browser-advisories-require-authentication-and-mount-decisionsgithub.com/advisories/GHSA-h2gv-ghr5-8mhjofficial docs2026-10-13-agent-zero-file-browser-advisories-require-authentication-and-mount-decisionsgithub.com/advisories/GHSA-j6rq-qhh6-gpf5official docs2026-10-13-agent-zero-file-browser-advisories-require-authentication-and-mount-decisionsgithub.com/advisories/GHSA-rppc-c4xv-v29htagged commit file2026-10-13-agent-zero-file-browser-advisories-require-authentication-and-mount-decisionsagent0ai/agent-zero / helpers/file_browser.py#L83-L106tagged commit file2026-10-13-agent-zero-file-browser-advisories-require-authentication-and-mount-decisionsagent0ai/agent-zero / helpers/login.py#L5-L15tagged commit file2026-10-13-agent-zero-file-browser-advisories-require-authentication-and-mount-decisionsagent0ai/agent-zero / helpers/api.py#L175-L185tagged commit file2026-10-13-agent-zero-file-browser-advisories-require-authentication-and-mount-decisionsagent0ai/agent-zero / docs/setup/installation.md#L71-L79

Versioned source: run artifact