An SSRF fix was lost inside a plugin refactor and shipped broken through eleven stable releases
The fix for a published CVE was undone by a refactor that moved the code into the plugin layout, and the regression shipped in every stable tag from v1.19 through v2.8 before v2.9 restored it. The class is server-side request forgery: an agent fetching a URL supplied by someone else can be pointed at addresses the operator did not intend, including internal ones. Nothing concealed it and nothing announced it either; a fix simply stopped being present.
What this changes for operators
- Upgrade to v2.9 if you run document query against untrusted or user-supplied URLs.
- A CVE fix is not a permanent property of a codebase. If you track advisories to decide you are safe, you are tracking the announcement rather than the code, and this is the case that shows the difference.
- This is the plugin-boundary argument from its least theoretical side. The refactor that lost the fix was the refactor that made things plugins.
Signal metadata
Source findings
- 2026-08-17-agent-zero-ssrf-fix-for-cve-2026-4308-was-silently-lost-in-a-plugin-refactor-and 2026-08-17-agent-zero-ssrf-fix-for-cve-2026-4308-was-silently-lost-in-a-plugin-refactor-and
Run: 2026-08-17-weekly-digest-2026-08-10_2026-08-17-frontier-v0
Schema: bitter.frontier_signals.v0 / ID: 2026-08-17-agent-zero-cve-fix-lost-in-a-plugin-refactor
Research evidence and publication history are open in the repository.