Unauthenticated Remote Command Execution in Cua Computer-Server

Executive Summary

CVE-2026-86121 is a critical vulnerability in cua-computer-server versions before 0.3.42. When the CONTAINER_NAME environment variable is unset, the server skips authentication and binds to all network interfaces by default. This allows unauthenticated attackers to connect to TCP port 8000 and execute arbitrary shell commands via the run_command endpoint, read or write arbitrary files, and access interactive PTY shells without authentication.

Useful 0 Not Useful 0

Detection Guidance

• Check if the cua computer-server is running on TCP port 8000 by using commands like 'netstat -tulnp | grep 8000' or 'ss -tulnp | grep 8000'.
• Verify if the server is bound to all interfaces (0.0.0.0) instead of localhost (127.0.0.1) using 'curl -I http://<server-ip>:8000' or 'curl -I http://localhost:8000'.
• Inspect environment variables on the system to see if CONTAINER_NAME is unset using 'env | grep CONTAINER_NAME'.
• Check server logs for unauthenticated requests or suspicious activity, such as 'journalctl -u cua-computer-server' or examining application-specific logs.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated remote attackers to execute arbitrary commands on your system, read or modify sensitive files, and gain full control via an interactive shell. Attackers can access the system through TCP port 8000 if the vulnerable server is running and the CONTAINER_NAME variable is unset.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA due to unauthorized access to sensitive data and systems. It enables data breaches, unauthorized command execution, and potential exposure of personal or health information, leading to regulatory penalties and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade the cua computer-server to version 0.3.42 or later to address the default binding and authentication issues.
• Bind the server to localhost (127.0.0.1) instead of all interfaces (0.0.0.0) to restrict access to local users only.
• Ensure the CONTAINER_NAME environment variable is set to enforce authentication checks.
• Disable or restrict access to the run_command endpoint and file operation endpoints if not required.
• Implement network-level controls such as firewalls to block unauthorized access to port 8000 from external networks.

Useful 0 Not Useful 0