Repository navigation
Python: AG-UI: checkpoint ownership not validated on clean-checkpoint resume (fixed by #8011) #8053
Description
Summary
The AG-UI workflow checkpoint resume path validated request ownership only when the checkpoint carried pending request-info events. A checkpoint with an owner but no pending events skipped the check entirely, so a caller could resume another Snapshot Scope's clean checkpoint and have subsequent saves re-stamp ownership to that caller.
Where
python/packages/ag-ui/agent_framework_ag_ui/_workflow.py — the resume path used if checkpoint_pending_ids and checkpoint_owner != request_owner:. The empty-pending_ids case short-circuited the owner comparison. Combined with _OwnedWorkflowCheckpointStorage.save stamping ownership on every save, the clean-checkpoint path carried an owner that the resume check never read.
Class
Incorrect authorization / credential binding (CWE-287 / CWE-346) — a confused-deputy on cross-scope checkpoint resume.
Fix
Validate whenever the checkpoint carries an owner: if checkpoint_owner is not None and checkpoint_owner != request_owner:. Legacy ownerless checkpoints continue to resume; anonymous callers are handled. Resolved by #8011 (merged).
AI-assisted.
Metadata
Metadata
Assignees
Type
Projects
- Status
Activity
[-]AG-UI: checkpoint ownership not validated on clean-checkpoint resume (fixed by #8011)[/-][+]Python: AG-UI: checkpoint ownership not validated on clean-checkpoint resume (fixed by #8011)[/+]github-actions commentedon Sep 4, 2026
👋 Hi Choppa (@Choppaaahh) — thanks for the report!
Your issue correctly identifies the old
checkpoint_pending_idsguard as allowing foreign clean-checkpoint resumes. The current implementation validates every non-null checkpoint owner, and the exact regression tests now pass. PR #801, merged as3f0d802b515ade9f34ca63bad1df71ab533b8bb8, appears to have resolved the reported behavior.If this still reproduces after trying the above, please reopen and we'll take another look. 🙏
Choppaaahh commentedon Sep 5, 2026
Fixed by #8011 (merged 2026-09-04). Closing.
AI-assisted.