CVE-2025-59956 AgentAPI exposed user chat history via a DNS rebinding attack
Attackers can exfiltrate sensitive local chat history and secrets from AgentAPI via DNS rebinding when hosted on plain HTTP localhost.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-59956?
CVE-2025-59956 is a medium-severity server-side request forgery vulnerability in coder agentapi, published on 29 Sep 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
AgentAPI is an HTTP API for Claude Code, Goose, Aider, Gemini, Amp, and Codex. Versions 0.3.3 and below are susceptible to a client-side DNS rebinding attack when hosted over plain HTTP on localhost. An attacker can gain access to the /messages endpoint served by the Agent API. This allows for the unauthorized exfiltration of sensitive user data, specifically local message history, which can include secret keys, file system contents, and intellectual property the user was working on locally. This issue is fixed in version 0.4.0.
Which versions are affected by CVE-2025-59956?
3 open source packages ship an affected version, including github.com/coder/agentapi. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/coder/agentapi Go | All versions | 0.4.0 |
github.com/coder/agentapi Go | All versions | 0.4.0 |
github.com/coder/agentapi Go | All versions | 0.4.0 |
Products include Coder Agentapi.
How do I fix CVE-2025-59956?
Upgrade github.com/coder/agentapi to 0.4.0 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2025-59956 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-59956 exists.
Sources
Also known as GHSA-w64r-2g3w-w8w4, GO-2025-3991.