Read the docs
TI-2026-41887 Aliases CVE-2026-58169GHSA-q796-5g5h-cqcc

Origin validation error in HKUDS Vibe-Trading

Priority LOW 36CWE-346Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
High
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-346.

Summary

Vibe-Trading before 0.1.10 contains a DNS rebinding authentication bypass vulnerability that allows remote attackers to bypass bearer-token authentication by exploiting the server's trust of TCP peer addresses for loopback clients combined with missing Host header validation while binding to 0.0.0.0 with credentialed CORS. Attackers can craft a malicious DNS rebinding page to issue authenticated requests to the local API server, reach the shell execution endpoint with a bash-enabled preset, and achieve remote code execution as the API process user while also overwriting LLM and data-source settings to exfiltrate credentials.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00418 36th percentileScored 2026-11-07
Fix Fixed Vibe-Trading (HKUDS): 0.1.10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HKUDSVibe-Tradingbefore 0.1.100.1.10Patch availableCNA
  • Vibe-Trading VendorHKUDS Affected before 0.1.10 Fixed in 0.1.10 Patch available CNA

Remediation

  • Fix · CNA Vibe-Trading (HKUDS) Fixed in 0.1.10

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    HKUDS Vibe-Trading 0.1.10

    4 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-41888 Vibe-Trading < 0.1.10 - Path Traversal in Proposal Identifier Allows Forging Live Trading MandatesPriority HIGH 65
    • TI-2026-41891 Vibe-Trading < 0.1.10 - Path Traversal via Persistent Memory TypePriority MEDIUM 60
    • TI-2026-41889 Vibe-Trading < 0.1.10 - Path Traversal via Swarm Run IdentifierPriority LOW 12
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-58169
  2. 2026-10-03 Alias added: GHSA-q796-5g5h-cqcc

References

Patch 5

Other 1

  • TI-2026-44237 LightRAG: Missing Authentication for Critical API Functions in Default Configuration CVSS 3.1CRITICAL 9.8
  • TI-2026-78721 Missing authentication in HKUDS Vibe-Trading FastAPI server enables RCE CVSS 4.0CRITICAL 9.3
  • TI-2026-44184 Improper authentication in HKUDS LightRAG CVSS 4.0CRITICAL 9.3
  • TI-2026-26034 Zero-Click Indirect Prompt Injection and Authentication Bypass via Email Polling CVSS 4.0HIGH 8.9
  • TI-2026-62432 HKUDS nanobot before 0.3.0 Server-Side Request Forgery via WebFetchTool CVSS 4.0CRITICAL 9.2
  • TI-2026-25310 DeepCode 1.2.0 Path Traversal via SPA Catch-All Route in main.py CVSS 4.0HIGH 8.7
See all 47 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences