Key points
- CVE-2026-114108 is rated Critical with a CVSS score of 9.3 by the NVD.
- The vulnerability affects HKUDS Vibe-Trading versions 0.1.0 through 0.1.6.
- Attackers can bypass authentication if the API_AUTH_KEY configuration variable is unset.
Unauthenticated attackers can gain root shell access in HKUDS Vibe-Trading installations running versions prior to 0.1.7, according to the National Vulnerability Database. The flaw exists in the application's authentication logic, which fails to enforce access controls when a specific configuration key is missing.
The vulnerability, tracked as CVE-2026-114108, carries a CVSS score of 9.3, classified as Critical. The issue stems from the `require_auth()` function returning early when the `API_AUTH_KEY` environment variable is unset. This behavior exposes the FastAPI surface to anyone who can reach the service, allowing unauthenticated interaction with core features.
Technical details of the flaw
The National Vulnerability Database lists the weakness as CWE-306, indicating missing authentication for a critical function. When the authentication key is not configured, the application skips verification steps entirely. This design choice allows external actors to interact with the API without providing valid credentials or tokens.
Attackers can exploit this gap to post messages to specific session endpoints. These interactions trigger the execution of root shell commands via the BashTool component. The unauthenticated access also permits file uploads and data exfiltration, creating a high-risk scenario for any exposed instance.
Scope of affected systems
HKUDS Vibe-Trading versions 0.1.0 through 0.1.6 are affected by this missing authentication vulnerability. Any deployment using these versions that does not have the `API_AUTH_KEY` explicitly set is vulnerable to unauthenticated access. The flaw affects the entire FastAPI surface, not just isolated endpoints.
Administrators should verify their current version and configuration status immediately. The source material identifies versions before 0.1.7 as affected, but does not confirm that version 0.1.7 contains a fix or that upgrading resolves the issue.
Next steps
Administrators should audit their HKUDS Vibe-Trading deployments to confirm the installed version. If the version is below 0.1.7, teams must check whether the `API_AUTH_KEY` is configured. If the key is unset, the system is currently exposed to unauthenticated access.
No patch or fix has been confirmed yet by the vendor. Restricting network access to the application's API endpoints can reduce exposure. Monitoring logs for unauthorized activity is essential during this period.
Signals worth monitoring
Teams usually check web server access logs for requests to authentication endpoints that lack valid tokens. Look for unusual POST requests to session message endpoints or file upload paths from unknown IP addresses. Alert on any execution of shell commands or script uploads that originate from unauthenticated sessions. Check whether the application logs show successful operations without prior login events. Review firewall logs for unexpected outbound connections that might indicate data exfiltration or command-and-control activity.
What to do and how to stay safe: HKUDS Vibe-Trading
- Verify the installed version of HKUDS Vibe-Trading and check if it is before 0.1.7.
- Ensure the API_AUTH_KEY environment variable is set and contains a strong, unique value.
- Restrict network access to the application's API endpoints to trusted IP ranges only.
- Monitor application logs for unauthenticated requests to sensitive endpoints like /upload or /sessions.
Step-by-step guide: Emergency Patching Checklist for Critical System Fixes
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of HKUDS Vibe-Trading are vulnerable to CVE-2026-114108?
Versions 0.1.0 through 0.1.6 are affected by this missing authentication vulnerability.
What is the CVSS score for this vulnerability?
The National Vulnerability Database rates CVE-2026-114108 with a CVSS score of 9.3.
How can attackers exploit this flaw?
Attackers can bypass authentication if the API_AUTH_KEY is unset, allowing root shell access and file uploads.
