Vulnerability Description
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because require_auth() returns early when API_AUTH_KEY is unset. Attackers can post messages to /sessions/{id}/messages to trigger root shell commands via BashTool, upload .py or .sh files via /upload, read session histories, and obtain partial API keys.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/HKUDS/Vibe-Trading/security/advisories/GHSA-v2f8-6655-7grj
- https://www.vulncheck.com/advisories/hkuds-vibe-trading-before-0.1.7-missing-aut
- https://github.com/HKUDS/Vibe-Trading/security/advisories/GHSA-v2f8-6655-7grj
FAQ
What is CVE-2026-114108?
CVE-2026-114108 is a vulnerability with a CVSS score of 9.8 (CRITICAL). HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because require_auth() returns early when...
How severe is CVE-2026-114108?
CVE-2026-114108 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-114108?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.