CVE-2026-79403

Deferred Deferred - Pending Action

Arbitrary Code Execution in Kilo Code

Publication date: 2026-09-29

Last updated on: 2026-09-30

Assigner: MITRE

Description

An issue in Kilo Code before v7.4.1 allows a local attacker to execute arbitrary code via the permission/allow-everything endpoint

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-09-30

Generated

2026-10-19

AI Q&A

2026-09-30

EPSS Evaluated

2026-10-18

NVD

CVE-2026-79403

EUVD

EUVD-2026-89423

Affected Vendors & Products

Vendor	Product	Version / Range
kilo_org	kilo_code	to 7.4.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-280	The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.

Attack-Flow Graph

Executive Summary

CVE-2026-79403 is a vulnerability in Kilo Code versions before v7.4.1 where a local attacker can execute arbitrary code by exploiting a missing authentication check on the permission/allow-everything endpoint. When no server password is set, unauthenticated requests to this endpoint grant wildcard permissions, bypassing user approval for all agent commands.

Detection Guidance

Check if unauthenticated requests to the /permission/allow-everything endpoint succeed. Use curl to test localhost:4096/permission/allow-everything without credentials. If the request returns a success response, the system is vulnerable.

Impact Analysis

This vulnerability allows a local attacker to gain full control over the Kilo Code system by executing arbitrary commands without authentication. It can lead to unauthorized access, data manipulation, or system compromise if exploited. The impact is higher on standalone servers where global authentication is optional.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by allowing unauthorized local code execution through a missing authentication mechanism on a critical endpoint. Unauthenticated access to the permission/allow-everything endpoint could lead to unauthorized data access or modification, which conflicts with requirements for strict access controls and audit trails in these regulations.

Mitigation Strategies

Upgrade Kilo Code to version 7.4.1 or later. Ensure authentication is enabled and the server password is set. Restart the daemon to apply changes and invalidate any legacy fixed passwords.

Hi! I’m here to help you understand CVE-2026-79403. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70