[IT-SecNots] [Security-news] AI Agents - Moderately critical - Information disclosure, Access bypass - SA-CONTRIB-2026-057

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2026-057

Project: AI Agents [1]
Date: 2026-June-24
Security risk: *Moderately critical* 13 ∕ 25
AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2]
Vulnerability: Information disclosure, Access bypass

Affected versions: <1.1.4 || >=1.2.0 <1.2.5 || >=1.3.0 <1.3.1
CVE IDs: CVE-2026-13237
Description: 
This module provides the entity type and runtime for Drupal AI Agents,
enabling agents to use tools.

Under certain circumstances, the agent inherits deterministic parameters when
invoking the same tool in one request, which can lead to information
disclosure.

Solution: 
Install the latest version:

 * If you use the AI Agents module 1.1.3, upgrade to AI Agents 1.1.4 [3]
 * If you use the AI Agents module 1.2.4 upgrade to AI Agents 1.2.5 [4]
 * If you use the AI Agents module 1.3.0 upgrade to AI Agents 1.3.1 [5]

Reported By: 
 * Andrew Belcher (andrewbelcher) [6]
 * Rob Edwards (rob_e) [7]

Fixed By: 
 * Andrew Belcher (andrewbelcher) [8]
 * Marcus Johansson (marcus_johansson) [9]
 * Rob Edwards (rob_e) [10]

Coordinated By: 
 * Bram Driesen (bramdriesen) [11] of the Drupal Security Team
 * Greg Knaddison (greggles) [12] of the Drupal Security Team
 * Drew Webber (mcdruid) [13] of the Drupal Security Team
 * Juraj Nemec (poker10) [14] of the Drupal Security Team

Security
issue: 
https://git.drupalcode.org/security/185010-ai_agents-security/-/work_items/1
[15]
------------------------------------------------------------------------------
Contribution record [16]

[1] https://www.drupal.org/project/ai_agents
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/ai_agents/releases/1.1.4
[4] https://www.drupal.org/project/ai_agents/releases/1.2.5
[5] https://www.drupal.org/project/ai_agents/releases/1.3.1
[6] https://www.drupal.org/u/andrewbelcher
[7] https://www.drupal.org/u/rob_e
[8] https://www.drupal.org/u/andrewbelcher
[9] https://www.drupal.org/u/marcus_johansson
[10] https://www.drupal.org/u/rob_e
[11] https://www.drupal.org/u/bramdriesen
[12] https://www.drupal.org/u/greggles
[13] https://www.drupal.org/u/mcdruid
[14] https://www.drupal.org/u/poker10
[15]  
https://git.drupalcode.org/security/185010-ai_agents-security/-/work_items/1
[16]  
https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3605528

_______________________________________________
Security-news mailing list -- security-news AT drupal.org
To unsubscribe send an email to security-news-leave AT drupal.org
Unsubscribe at