CVE-2026-86121 Details

A remote code execution vulnerability has been identified in Cua Computer-Server versions prior to 0.3.42. The issue arises because the server skips authentication when the CONTAINER_NAME environment variable is unset, and it binds to all interfaces by default. This allows unauthenticated attackers to execute arbitrary commands on the server. Exploitation is possible by sending requests to TCP port 8000, where the run_command endpoint can be used to execute shell commands. Additionally, attackers can read and write arbitrary files through the file operation endpoints and access interactive PTY shells without authentication.

Users can update to Cua Computer-Server version 0.3.42 or later, where this vulnerability has been addressed. In addition, the server can be configured to bind only to localhost by default, requiring an explicit opt-in to expose it to external connections.