CVE-2026-114108 Details
Description
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because require_auth() returns early when API_AUTH_KEY is unset. Attackers can post messages to /sessions/{id}/messages to trigger root shell commands via BashTool, upload .py or .sh files via /upload, read session histories, and obtain partial API keys.
A missing authentication vulnerability has been identified in HKUDS Vibe-Trading versions 0.1.0 prior to 0.1.7. This vulnerability allows unauthenticated attackers to access the FastAPI API surface. The issue arises because the authentication requirement is bypassed when the API_AUTH_KEY is not set, enabling attackers to exploit several endpoints. Exploitation can lead to unauthorized access to session histories, partial API key disclosure, and the ability to upload executable files or execute root shell commands via a command injection vulnerability.
To address this vulnerability, the application should be updated to version 0.1.7 or later. In addition, the authentication requirement should be enforced properly on all API endpoints, and the file upload functionality should be restricted to only allow safe file types.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/HKUDS/Vibe-Trading/security/advisories/GHSA-v2f8-6655-7grj | CISA-ADP | AdvisoryBundleExploitRemedyVendor |
| https://github.com/HKUDS/Vibe-Trading/security/advisories/GHSA-v2f8-6655-7grj | [email protected] | AdvisoryBundleExploitRemedyVendor |
| https://www.vulncheck.com/advisories/hkuds-vibe-trading-before-0.1.7-missing-authentication-in-fastapi-server-enabling-rce | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| HKUDS Vibe-Trading | >= 0.1.0, < 0.1.7 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 27, 2026 | CVE Modified | CISA-ADP |
| Oct 21, 2026 | New CVE Received | [email protected] |