CVE-2026-86121: Cua computer-server before 0.3.42 Unauthenticated RCE via Desktop Control
Cua computer-server versions before 0.3.42 skip authentication when the CONTAINERNAME environment variable is unset and bind to all interfaces by default, allowing unauthenticated attackers to execute arbitrary commands. Attackers can reach TCP port 8000 to run shell commands via the runcommand endpoint, read and write arbitrary files through file operation endpoints, and access interactive PTY shells without authentication.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cua computer-serverto a version that resolves this vulnerability.Fixed in 0.3.42 - Configuration
Set the CONTAINER_NAME environment variable so the application does not skip authentication when CONTAINER_NAME is unset.
Cua computer-server CONTAINER_NAME environment variable = set - Compensating control
Restrict network access to TCP port 8000 (where the unauthenticated run_command endpoint and file operation endpoints are reachable) so that only trusted clients can connect.
Event History
Frequently Asked Questions
Which deployments are exposed?
Computer-server versions before 0.3.42 are exposed when the CONTAINER_NAME environment variable is unset. The service binds to all interfaces by default, so any host with TCP port 8000 reachable by an attacker is at risk.
What does an attacker need to exploit this issue?
An attacker needs network access to TCP port 8000. No authentication, privileges, or user interaction are required when the affected authentication condition is present.
What can an unauthenticated attacker do?
An attacker can execute shell commands through the run_command endpoint, read and write arbitrary files through file operation endpoints, and access interactive PTY shells.
What can be done if upgrading is not immediately possible?
Restrict access to TCP port 8000 so untrusted networks cannot reach the service, and ensure CONTAINER_NAME is set to avoid the described authentication bypass condition.