CVE-2026-86121: Cua computer-server before 0.3.42 Unauthenticated RCE via Desktop Control

Published Sep 5, 2026
·
Updated

Cua computer-server versions before 0.3.42 skip authentication when the CONTAINERNAME environment variable is unset and bind to all interfaces by default, allowing unauthenticated attackers to execute arbitrary commands. Attackers can reach TCP port 8000 to run shell commands via the runcommand endpoint, read and write arbitrary files through file operation endpoints, and access interactive PTY shells without authentication.

Affected Software

1 affected component
computer-server<0.3.42

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade Cua computer-server to a version that resolves this vulnerability.

    Fixed in 0.3.42
  2. Configuration

    Set the CONTAINER_NAME environment variable so the application does not skip authentication when CONTAINER_NAME is unset.

    Cua computer-server CONTAINER_NAME environment variable = set
  3. Compensating control

    Restrict network access to TCP port 8000 (where the unauthenticated run_command endpoint and file operation endpoints are reachable) so that only trusted clients can connect.

Event History

Sep 5, 2026
CVE Published
via MITRE·09:59 AM
Data Sourced
via MITRE·09:59 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:16 AM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Which deployments are exposed?

Computer-server versions before 0.3.42 are exposed when the CONTAINER_NAME environment variable is unset. The service binds to all interfaces by default, so any host with TCP port 8000 reachable by an attacker is at risk.

2

What does an attacker need to exploit this issue?

An attacker needs network access to TCP port 8000. No authentication, privileges, or user interaction are required when the affected authentication condition is present.

3

What can an unauthenticated attacker do?

An attacker can execute shell commands through the run_command endpoint, read and write arbitrary files through file operation endpoints, and access interactive PTY shells.

4

What can be done if upgrading is not immediately possible?

Restrict access to TCP port 8000 so untrusted networks cannot reach the service, and ensure CONTAINER_NAME is set to avoid the described authentication bypass condition.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203