Vulnerability Description
Cua computer-server versions before 0.3.42 skip authentication when the CONTAINER_NAME environment variable is unset and bind to all interfaces by default, allowing unauthenticated attackers to execute arbitrary commands. Attackers can reach TCP port 8000 to run shell commands via the run_command endpoint, read and write arbitrary files through file operation endpoints, and access interactive PTY shells without authentication.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/trycua/cua
- https://github.com/trycua/cua/blob/10a2e71792db/libs/python/computer-server/comp
- https://github.com/trycua/cua/blob/10a2e71792db/libs/python/computer-server/comp
- https://github.com/trycua/cua/commit/59cf25c0ec54
- https://github.com/trycua/cua/issues/1892
- https://www.vulncheck.com/advisories/cua-computer-server-before-0.3.42-unauthent
- https://github.com/trycua/cua/issues/1892
FAQ
What is CVE-2026-86121?
CVE-2026-86121 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Cua computer-server versions before 0.3.42 skip authentication when the CONTAINER_NAME environment variable is unset and bind to all interfaces by default, allowing unauthenticated attackers to execut...
How severe is CVE-2026-86121?
CVE-2026-86121 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-86121?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.