Issues

• HTTP MCP build/run fails before transport in the recommended CPU image

  OpenBMB/UltraRAG#537 · Filter by author playb0t opened on Oct 12, 2026

• Add a You.com web search backend (works with no key)

  OpenBMB/UltraRAG#534 · Filter by author brainsparker opened on Oct 8, 2026

• 【Security Vulnerability Report】CWE-22 /file endpoint unauthenticated arbitrary file read (CVSS 7.5)

  OpenBMB/UltraRAG#526 · Filter by author Jiecub3 opened on Sep 28, 2026

• Proposal: optional per-server authentication for remote MCP pipelines

  OpenBMB/UltraRAG#522 · Filter by author ct-jaryn opened on Sep 23, 2026

• [SECURITY] Arbitrary file read via absolute path in MCP prompt check_passages (CWE-22, CVSS 7.5)

  OpenBMB/UltraRAG#521 · Filter by author Jiecub3 opened on Sep 22, 2026

• [SECURITY] Arbitrary file read via absolute path in MCP prompt qa_rag_boxed_multiple_choice (CWE-22, CVSS 7.5)

  OpenBMB/UltraRAG#520 · Filter by author Jiecub3 opened on Sep 22, 2026

• Bug: CitationRegistry global state causes cross-request citation contamination

  OpenBMB/UltraRAG#394 · Filter by author CrepuscularIRIS opened on Apr 12, 2026

• Security: SSRF via user-controlled baseUrl in AI proxy endpoints

  OpenBMB/UltraRAG#393 · Filter by author CrepuscularIRIS opened on Apr 12, 2026