CVE-2026-58169 Details

A vulnerability in Vibe-Trading versions prior to 0.1.10 allows for authentication bypass and remote code execution. The local API server incorrectly trusts TCP peer addresses from loopback clients, enabling bypass of the API_AUTH_KEY bearer-token check. This issue is compounded by the absence of Host header validation, while the server binds to 0.0.0.0 with credentialed CORS by default. Exploitation can be achieved through a DNS-rebinding web page that issues authenticated requests to the local API as a trusted loopback client. Loopback requests automatically enable shell tools, allowing an attacker to execute commands via the API process user. Additionally, the same authentication bypass can be exploited to manipulate settings and overwrite data-source configurations, potentially exfiltrating sensitive credentials.

Users can upgrade to Vibe-Trading version 0.1.10 or later, where this vulnerability has been addressed. After upgrading, ensure to set the API_AUTH_KEY and configure trusted CORS origins. For those using the Vibe-Trading Docker image, the updated version can be pulled and deployed using Docker Compose.