Description
A security vulnerability has been detected in TinyAGI 0.0.20. Impacted is the function processMessage of the file packages/main/src/index.ts of the component Message API Endpoint. Such manipulation leads to missing authorization. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-08-06
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An attacker can invoke the processMessage function within TinyAGI's Message API Endpoint without passing proper authorization, because the endpoint lacks enforcement of required access controls. The weakness is identified as missing authorization and missing access control (CWE‑862/CWE‑863). When successful, the attacker can submit arbitrary messages to the service, potentially leading to unauthorized data manipulation or exposure.

Affected Systems

The vulnerability is present in TinyAGI version 0.0.20, the only version explicitly referenced in the advisory. No other affected releases are listed.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate impact, with the exploit classified as remote. EPSS data are not available and the issue is not listed in the CISA KEV catalog. The description notes missing authorization. Based on the description, it is inferred that an attacker can trigger the endpoint from any network reachability to the system, provided the service is exposed externally. Public reports confirm that an exploit exists has been disclosed.

Generated by OpenCVE AI on August 6, 2026 at 08:55 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Review the TinyAGI repository and repository tags for a patched release that addresses the missing authorization check in the processMessage endpoint.
  • If a newer, patched version is not yet available, limit external network traffic to the TinyAGI service by applying firewall rules or configuring the reverse proxy to accept connections only from trusted IP ranges.
  • Implement an additional authentication layer in front of the TinyAGI service—such as an API gateway or basic HTTP authentication—to enforce access control before requests reach the vulnerable endpoint.

Generated by OpenCVE AI on August 6, 2026 at 08:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 06 Aug 2026 07:30:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in TinyAGI 0.0.20. Impacted is the function processMessage of the file packages/main/src/index.ts of the component Message API Endpoint. Such manipulation leads to missing authorization. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Title TinyAGI Message API Endpoint index.ts processMessage authorization
First Time appeared Tinyagi
Tinyagi tinyagi
Weaknesses CWE-862
CWE-863
CPEs cpe:2.3:a:tinyagi:tinyagi:*:*:*:*:*:*:*:*
Vendors & Products Tinyagi
Tinyagi tinyagi
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Tinyagi Tinyagi
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-06T07:00:10.542Z

Reserved: 2026-08-05T20:19:56.747Z

Link: CVE-2026-19010

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-06T09:00:11Z

Weaknesses