CVE-2026-114108: HKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCE
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because requireauth() returns early when APIAUTHKEY is unset. Attackers can post messages to /sessions/{id}/messages to trigger root shell commands via BashTool, upload .py or .sh files via /upload, read session histories, and obtain partial API keys.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HKUDS Vibe-Tradingto a version that resolves this vulnerability.Fixed in 0.1.7
Event History
Frequently Asked Questions
Which deployments are exposed?
HKUDS Vibe-Trading versions from 0.1.0 before 0.1.7 are affected when the FastAPI server is reachable and API_AUTH_KEY is unset. In that condition, require_auth() returns early and does not enforce authentication.
What can an unauthenticated attacker do?
An attacker can send messages to /sessions/{id}/messages to trigger root shell commands through BashTool. They can also upload .py or .sh files through /upload, read session histories, and obtain partial API keys.
How can I determine whether my instance is currently vulnerable?
Check whether the deployed Vibe-Trading version is earlier than 0.1.7 and whether API_AUTH_KEY is unset. Also review whether the FastAPI endpoints, including /sessions/{id}/messages and /upload, are accessible without authentication.
What mitigation is available if an upgrade cannot happen immediately?
Set API_AUTH_KEY so that require_auth() does not return early without enforcing authentication. Restrict access to the FastAPI surface while remediation is in progress.