CVE-2026-114108

Deferred Deferred - Pending Action

Unauthenticated Command Execution in HKUDS Vibe-Trading

Publication date: 2026-10-21

Last updated on: 2026-10-27

Assigner: VulnCheck

Description

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because require_auth() returns early when API_AUTH_KEY is unset. Attackers can post messages to /sessions/{id}/messages to trigger root shell commands via BashTool, upload .py or .sh files via /upload, read session histories, and obtain partial API keys.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-27

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-114108

EUVD

EUVD-2026-106911

Affected Vendors & Products

Vendor	Product	Version / Range
HKUDS	Vibe-Trading	0.1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability is a missing authentication flaw in HKUDS Vibe-Trading versions 0.1.0 to 0.1.6. When the API_AUTH_KEY environment variable is not set, the require_auth() function fails to enforce authentication, allowing unauthenticated attackers to access the FastAPI server. This enables attackers to execute root shell commands, upload malicious files, read session histories, and obtain partial API keys.

Detection Guidance

Check if HKUDS Vibe-Trading versions 0.1.0 to 0.1.6 are installed by inspecting package managers or Docker images. Verify if the API_AUTH_KEY environment variable is unset, which disables authentication. Test unauthenticated access to endpoints like /sessions/{id}/messages, /upload, or read session histories.

Impact Analysis

If you use HKUDS Vibe-Trading versions 0.1.0 to 0.1.6, attackers could gain full control over your server by executing arbitrary commands, uploading malicious files, or accessing sensitive data. This could lead to data breaches, system compromise, or unauthorized access to other systems.

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA due to unauthorized access to sensitive data, potential data breaches, and lack of proper authentication controls. Organizations using affected versions may face regulatory penalties and reputational damage.

Mitigation Strategies

Upgrade to version 0.1.7 or later to patch the vulnerability. Ensure API_AUTH_KEY is set to enforce authentication. Disable or restrict access to unauthenticated endpoints. Review and tighten CORS settings to prevent cross-origin attacks. Run the FastAPI server as a non-root user in Docker.

Hi! I’m here to help you understand CVE-2026-114108. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...