A vulnerability in the Research Export component of HKUDS AI‑Trader allows attackers to manipulate the /api/research/agents.csv endpoint and retrieve sensitive agent data. The flaw exposes confidential information and is exploitable from a remote location. The compromise can occur without any authentic credential because the endpoint did not properly enforce authentication prior to the fix. The vulnerability is catalogued as Information Disclosure (CWE‑200) and Improper Access Control (CWE‑284).

Systems running HKUDS AI‑Trader versions prior to the patch commit 91a31aac1b0f4dbc6b8bef9f6eff0b7912e0bc65 are affected. The product follows a rolling‑release model, so any release that includes commits after 74caf996f78dcc0c657df8365c8544678a16e215 but before the fixed commit may still be vulnerable. Administrators should check the current revision against the patch and apply the recent commit or release that incorporates it.

The CVSS base score of 6.9 indicates moderate severity. Although EPSS data is not available, the vulnerability has a publicly available exploit and can be performed over the network by sending crafted requests to the exposed endpoint. The vulnerability is not listed in the CISA KEV catalogue, but its public availability and ease of exploitation raise the risk. Immediate action to stop unauthenticated access and apply the fix is strongly recommended.