CVE-2026-10044: ai-goofish-monitor Unauthenticated Arbitrary File Read via GET /api/prompts/

Synopsis

An unauthenticated arbitrary file read vulnerability affects Usagi-org ai-goofish-monitor on Windows deployments. The flaw is reachable over the network without any credentials, by sending a crafted GET request to the /api/prompts/ endpoint with an absolute Windows path or backslash traversal sequence that bypasses the application's incomplete path sanitization. Successful exploitation lets an attacker read any file accessible to the application process, including sensitive configuration files, credentials, and secrets stored on the host. A patched-image rebuild at commit f85d140b6b45029d9a0925feb96dad733b41396d is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so the attacker must be able to send HTTP requests to the application service.

• AuthenticationNot required

  No credentials or session token of any kind are needed; the /api/prompts/ endpoint accepts unauthenticated requests.

• Victim interactionNot required

  The attacker sends a single crafted GET request and receives the file contents directly, with no user action required.

• Attack complexityDetail

  Base exploit conditions are straightforward and reliable, though the attack-target prerequisite (AT:P) indicates that specific configuration or deployment conditions (Windows host with accessible sensitive files) must be present for maximum impact.

Blast Radius

• An attacker reads any file accessible to the application process on the Windows host, including configuration files containing database credentials, API keys, and secrets.
• Environment variable files, .env configs, and any flat-file credential stores co-located with the application are directly exposed.
• Operating system files readable by the process account, such as Windows SAM or system configuration files, can be retrieved if the process runs with sufficient privilege.