Live › vulnerability › CVE-2026-114108
Go to dashboardVibe-Trading versions 0.1.0 before 0.1.7 skip the API auth check when API_AUTH_KEY is unset, so anyone who can reach the FastAPI server can post session messages that trigger shell commands through BashTool. An attacker can also upload .py or .sh files, read session histories, and obtain partial API keys.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
0.1.70.1.7 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because require_auth() returns early when API_AUTH_KEY is unset. Attackers can post messages to /sessions/{id}/messages to trigger root shell commands via BashTool, upload .py or .sh files via /upload, read session histories, and obtain partial API keys.
This page as .md · .json · in your agent: get_signal("CVE-2026-114108")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.