CVE-2026-114108— HKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCE
Quick assessment
Affected
HKUDS Vibe-Trading
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
HKUDS Vibe-Trading 0.1.0 至 0.1.7（不含 0.1.7）版本存在身份验证缺失漏洞。由于在 未设置时 函数会提前返回，导致未经身份验证的攻击者能够访问 FastAPI 接口。攻击者可向 发送消息，通过 BashTool 触发 root 权限的 shell 命令；利用 接口上传 或 文件；读取会话历史记录；并获取部分 API 密钥。
Possible ATT&CK Techniques 3 AI
T1070 · Indicator Removal T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-114108
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
HKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCE
Source: CVE Program / CVE List V5
Vulnerability Description
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because require_auth() returns early when API_AUTH_KEY is unset. Attackers can post messages to /sessions/{id}/messages to trigger root shell commands via BashTool, upload .py or .sh files via /upload, read session histories, and obtain partial API keys.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| HKUDS | Vibe-Trading | 0.1.0 ~ 0.1.7 | - |
|
II. Public POCs for CVE-2026-114108
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-114108
请登录查看更多情报信息。
Other References for CVE-2026-114108 (2)
Same Patch Batch · HKUDS · 2026-10-21 · 3 CVEs total
| CVE-2026-114107 | 8.8 HIGH | HKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Injection RCE via BashTool and Backg |
| CVE-2026-114106 | 7.5 HIGH | HKUDS Vibe-Trading 0.1.0 before 0.1.7 Path Traversal via read_document and safe_user_path |
IV. Related Vulnerabilities
Same product: Vibe-Trading
-
CVE-2026-114107
HKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Inject -
CVE-2026-114106
HKUDS Vibe-Trading 0.1.0 before 0.1.7 Path Traversal via rea -
CVE-2026-58173
Vibe-Trading < 0.1.10 - Path Traversal via Persistent Memory -
CVE-2026-58171
Vibe-Trading < 0.1.10 - Path Traversal via Swarm Run Identif -
CVE-2026-58170
Vibe-Trading < 0.1.10 - Path Traversal in Proposal Identifie
Same vendor: HKUDS
-
CVE-2026-114106
HKUDS Vibe-Trading 0.1.0 before 0.1.7 Path Traversal via rea -
CVE-2026-114107
HKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Inject -
CVE-2026-102874
HKUDS AnyTool Execute Endpoint main.py subprocess.run os com -
CVE-2026-86062
LightRAG: Stored Cross-Site Scripting (XSS) in the LightRAG -
CVE-2026-85740
LightRAG: SSRF via IPv6-transition address bypass (NAT64, IP
Same weakness: CWE-306
-
CVE-2026-114092
Trigger.dev before 4.5.0 Missing Authentication in Dashboard -
CVE-2026-114090
Trigger.dev CLI 3.0.0 before 4.5.4 Missing Authentication in -
CVE-2026-114086
Trigger.dev before 4.5.5 Unauthenticated Realtime Stream Dat -
CVE-2026-114085
Trigger.dev through 4.7.6 Missing Authentication in Supervis -
CVE-2026-113648
ApostropheCMS: Missing Authentication in `cleanExport` Route
V. Comments for CVE-2026-114108
No comments yet