View online: https://www.drupal.org/sa-contrib-2026-057 Project: AI Agents [1] Date: 2026-June-24 Security risk: *Moderately critical* 13 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Information disclosure, Access bypass Affected versions: <1.1.4 || >=1.2.0 <1.2.5 || >=1.3.0 <1.3.1 CVE IDs: CVE-2026-13237 Description: This module provides the entity type and runtime for Drupal AI Agents, enabling agents to use tools. Under certain circumstances, the agent inherits deterministic parameters when invoking the same tool in one request, which can lead to information disclosure. Solution: Install the latest version: * If you use the AI Agents module 1.1.3, upgrade to AI Agents 1.1.4 [3] * If you use the AI Agents module 1.2.4 upgrade to AI Agents 1.2.5 [4] * If you use the AI Agents module 1.3.0 upgrade to AI Agents 1.3.1 [5] Reported By: * Andrew Belcher (andrewbelcher) [6] * Rob Edwards (rob_e) [7] Fixed By: * Andrew Belcher (andrewbelcher) [8] * Marcus Johansson (marcus_johansson) [9] * Rob Edwards (rob_e) [10] Coordinated By: * Bram Driesen (bramdriesen) [11] of the Drupal Security Team * Greg Knaddison (greggles) [12] of the Drupal Security Team * Drew Webber (mcdruid) [13] of the Drupal Security Team * Juraj Nemec (poker10) [14] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185010-ai_agents-security/-/work_items/1 [15] ------------------------------------------------------------------------------ Contribution record [16] [1] https://www.drupal.org/project/ai_agents [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/ai_agents/releases/1.1.4 [4] https://www.drupal.org/project/ai_agents/releases/1.2.5 [5] https://www.drupal.org/project/ai_agents/releases/1.3.1 [6] https://www.drupal.org/u/andrewbelcher [7] https://www.drupal.org/u/rob_e [8] https://www.drupal.org/u/andrewbelcher [9] https://www.drupal.org/u/marcus_johansson [10] https://www.drupal.org/u/rob_e [11] https://www.drupal.org/u/bramdriesen [12] https://www.drupal.org/u/greggles [13] https://www.drupal.org/u/mcdruid [14] https://www.drupal.org/u/poker10 [15] https://git.drupalcode.org/security/185010-ai_agents-security/-/work_items/1 [16] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....