CVE-2026-4308 - Vulnerability Details

- frdel/agent0ai agent-zero document_query.py handle_pdf_document server-side request forgery

Description

A weakness has been identified in frdel/agent0ai agent-zero 0.9.7. This affects the function handle_pdf_document of the file python/helpers/document_query.py. This manipulation causes server-side request forgery. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Published: 2026-03-17

Score: 5.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a server‑side request forgery (SSRF) that originates in the handle_pdf_document function of frdel/agent0ai agent‑zero 0.9.7. By manipulating the pdf document parsing logic, an attacker can force the agent to send HTTP requests to arbitrary URLs. The impact can include unauthorized reading of internal resources, traversal of network boundaries, and potential escalation of an existing compromise. The weakness is a classic SSRF flaw (CWE‑918).

Affected Systems

The affected product is agent‑zero from both agent0ai and frdel, version 0.9.7. The Common Platform Enumeration string for this product is cpe:2.3:a:agent-zero:agent-zero:*:*:*:*:*:*:*:*. No other versions are listed as affected in the current advisory.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity. EPSS data is not available and the vulnerability is not listed in the KEV catalog, but a public exploit is available on GitHub and other platforms, indicating that attackers can deliver the SSRF payload remotely. Because the flaw allows the server to initiate requests to any URL, an adversary could probe internal services or exfiltrate data, making the risk higher in environments with open outbound connections.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

frdel

agent-zero

affected

Version	Status	Constraints
`0.9.7`	affected	—

agent0ai

agent-zero

affected

Version	Status	Constraints
`0.9.7`	affected	—

No data.

Vendor Product Confidence Versions

Agent-zero

80%

Version	Status	Scheme	Platform
`0.9.7`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest vendor patch for agent‑zero, if one has been released for version 0.9.7 or later.
If no patch is available, restrict the document_query endpoint to trusted sources or temporarily disable it.
Add outbound firewall rules to block the agent from accessing internal IP ranges (e.g., 10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12) unless explicitly required.

Generated by OpenCVE AI on March 17, 2026 at 05:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.0004.

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://gist.github.com/YLChen-007/c99c44aa019266a72636757308d43989
https://gist.github.com/YLChen-007/c99c44aa019266a72636757308d43989#poc
https://vuldb.com/?ctiid.351338
https://vuldb.com/?id.351338
https://vuldb.com/?submit.773950

History

Tue, 17 Mar 2026 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 17 Mar 2026 04:15:00 +0000

Type	Values Removed	Values Added
Description		A weakness has been identified in frdel/agent0ai agent-zero 0.9.7. This affects the function handle_pdf_document of the file python/helpers/document_query.py. This manipulation causes server-side request forgery. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title		frdel/agent0ai agent-zero document_query.py handle_pdf_document server-side request forgery
First Time appeared		Agent-zero Agent-zero agent-zero
Weaknesses		CWE-918
CPEs		cpe:2.3:a:agent-zero:agent-zero::::::::
Vendors & Products		Agent-zero Agent-zero agent-zero
References		https://gist.github.com/YLChen-007/c99c44aa019266a72636757308d43989 https://gist.github.com/YLChen-007/c99c44aa019266a72636757308d43989#poc https://vuldb.com/?ctiid.351338 https://vuldb.com/?id.351338 https://vuldb.com/?submit.773950
Metrics		cvssV2_0 `{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}` cvssV3_0 `{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}` cvssV3_1 `{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Agent-zero Agent-zero

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-03-17T04:02:07.980Z

Updated: 2026-03-17T13:22:56.803Z

Reserved: 2026-03-16T21:31:55.971Z

Link: CVE-2026-4308

Vulnrichment

Updated: 2026-03-17T13:22:53.422Z

NVD

Status : Awaiting Analysis

Published: 2026-03-17T04:16:24.207

Modified: 2026-03-17T14:20:01.670

Link: CVE-2026-4308

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-03-24T10:49:34Z

Weaknesses

CWE-918

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Exploitation poc

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object