5.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-45046

CVE-2026-45046: Gryph Agents Payload Filter Fails to Strip Tool Payload for Sensitive Content

Gryph provides a security layer for AI coding agents. Prior to 0.7.0, Gryph implements logging levels that determine what content is logged to a local sqlite database. The README incorrectly mentions that the default log level is minimal while it is standard. Source code review shows sensitive file-write content remains in the stored payload as ContentPreview, OldString, or NewString at the default standard logging level and at full. This leads to logging of potentially sensitive file content in the local sqlite database, violating Gryphs sensitive file filter and log level contracts. This vulnerability is fixed in 0.7.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-45046

CVE-2026-45046:

5.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/safedep/gryph	go	<= 0.6.0	0.7.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, described as 'Gryph Agents Payload Filter Fails to Strip Tool Payload for Sensitive Content', is caused by improper handling of sensitive data in the logging mechanism. The analysis of the patch between version v0.6.0 and v0.7.0 of safedep/gryph revealed the root cause.

The core of the vulnerability is in the agent.ApplyLoggingLevel function. In the vulnerable versions, this function would not strip sensitive information from event payloads if the logging level was set to standard (the default) or full. This meant that if an agent performed an operation on a file identified as sensitive (e.g., containing secrets), the content of that file could be logged to the local SQLite database. This violates the expectation that sensitive content is never logged.

The patch addresses this by modifying agent.ApplyLoggingLevel to first check if an event is marked as sensitive. If it is, it now unconditionally calls stripPayloadContent to remove any sensitive data from the payload before any further processing, regardless of the configured logging level. This ensures that sensitive data is never persisted.

The cli.runHook function is identified as a key runtime indicator because it is the function that orchestrates the parsing of agent events and calls agent.ApplyLoggingLevel. Therefore, during the exploitation of this vulnerability, cli.runHook would be on the call stack leading to the vulnerable logic.

Vulnerable functions

agent.ApplyLoggingLevel

agent/filter.go

The vulnerability lies in the `ApplyLoggingLevel` function, which, prior to the patch, failed to strip sensitive content from event payloads when the logging level was `standard` or `full`. The function's logic did not call `stripPayloadContent` for events marked as sensitive (`event.IsSensitive`), causing sensitive data such as file content previews (`ContentPreview`, `OldString`, `NewString`) to be logged. The patch corrects this by adding an initial check for `event.IsSensitive` and unconditionally calling `stripPayloadContent` for such events, regardless of the logging level.

cli.runHook

cli/hook.go

The `runHook` function is the caller of the vulnerable `agent.ApplyLoggingLevel` function. An attacker could trigger this function to exploit the vulnerability. The patch adds a call to `agent.RedactEvent` before `agent.ApplyLoggingLevel` as a defense-in-depth measure, but the primary vulnerability is within `ApplyLoggingLevel` itself. The `runHook` function would appear in a runtime profile or stack trace during exploitation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.