TEN Framework TMAN Designer Unauthenticated Arbitrary File Read/Write RCE

Technical Analysis

The vulnerability arises from missing authentication and path validation on the TMAN Designer's file-content API, allowing unauthenticated POST and PUT requests to read or overwrite arbitrary files on the host filesystem. Exploitation paths include appending attacker-controlled SSH keys to ~/.ssh/authorized_keys for persistent remote access, writing malicious cron entries for scheduled code execution, or injecting malicious content into TEN Framework's executable graph configuration files to achieve execution within the framework's runtime. Given a CVSS score of 9.8, this is trivially exploitable over the network without credentials and grants full system compromise. TEN Framework is used to build real-time multimodal conversational AI agents, meaning compromised hosts directly expose agent orchestration logic, connected model API keys, and any tool/RAG integrations configured within the framework. Organizations running TEN Framework-based agent pipelines should treat this as a direct path to full agent infrastructure takeover, including exfiltration of LLM provider credentials and manipulation of agent behavior via graph file tampering.

Affected Systems

TEN Framework version 0.11.71 (and potentially earlier versions using the same TMAN Designer file-content API implementation); deployments exposing the TMAN Designer web interface/API to untrusted networks.

Indicators of Compromise

• POST/PUT requests to /api/designer/v1/file-content
• Unexpected modifications to ~/.ssh/authorized_keys
• Unauthorized cron entries in /etc/cron.d/ or user crontabs
• Modified or newly created .graph/.json executable graph files within TEN Framework project directories
• Unusual outbound connections from hosts running TMAN Designer

Remediation Steps

1. 1

   Upgrade TEN Framework

   Apply the vendor patch or upgrade to a fixed version of TEN Framework beyond 0.11.71 as soon as it is released; monitor vendor advisories for patch availability.

2. 2

   Restrict network exposure

   Immediately restrict access to the TMAN Designer API endpoints to trusted internal networks only via firewall rules, VPN, or network segmentation; do not expose the designer interface to the public internet.

3. 3

   Implement authentication and input validation

   If running a self-hosted or forked version, add authentication middleware and strict path sanitization to the file-content API endpoints to prevent path traversal and unauthorized access.

4. 4

   Audit for compromise indicators

   Check authorized_keys files, cron jobs, and TEN Framework graph configuration files for unauthorized modifications on any host that has run the vulnerable version.

5. 5

   Rotate credentials

   Rotate any API keys, LLM provider credentials, and secrets accessible to or stored on hosts running the affected TEN Framework instances, given the risk of arbitrary file read exposing secrets.

6. 6

   Monitor and log API access

   Enable detailed logging and monitoring of requests to /api/designer/v1/file-content and alert on anomalous read/write patterns.