CVE-2026-114108

Summary

The FastAPI surface of HKUDS Vibe-Trading (0.1.0–0.1.6) lacks authentication enforcement when API_AUTH_KEY is unset, allowing unauthenticated remote attackers to interact with the API and trigger arbitrary command execution via BashTool, upload malicious files, read session histories, and obtain partial API keys.

Exploitability

Exploitation is trivial for any remote attacker since no authentication is required and the vulnerable endpoint is publicly accessible over HTTP.

Blast radius

Successful exploitation grants attackers full remote code execution as root, access to sensitive session data, and potential leakage of partial API credentials, enabling full system compromise and lateral movement.

Detection

Look for unauthenticated POST requests to /sessions/{id}/messages or /upload endpoints from external IPs, especially with payloads containing shell metacharacters or file extensions like .sh/.py; also monitor for unexpected process spawns of bash or python interpreters from the FastAPI service context.

Prioritized remediation

Upgrade to Vibe-Trading version 0.1.7 or later, which fixes the early-return behavior in require_auth() when API_AUTH_KEY is unset.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.