Read the docs
TI-2026-78721 Aliases CVE-2026-114108

Missing authentication in HKUDS Vibe-Trading FastAPI server enables RCE

Priority HIGH 81CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains missing authentication (CWE-306) that lets unauthenticated attackers reach its FastAPI surface when API_AUTH_KEY is unset, because require_auth() returns early. Attackers can post messages to session endpoints to run root shell commands through BashTool, upload Python or shell scripts, read session histories, and obtain partial API keys. The CVSS 4.0 vector rates the impact as high for confidentiality, integrity and availability, and CISA's SSVC data marks exploitation as proof-of-concept.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because require_auth() returns early when API_AUTH_KEY is unset. Attackers can post messages to /sessions/{id}/messages to trigger root shell commands via BashTool, upload .py or .sh files via /upload, read session histories, and obtain partial API keys.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00528 44th percentileScored 2026-11-07
Fix Fixed Vibe-Trading (HKUDS): 0.1.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HKUDSVibe-Trading0.1.0 to before 0.1.70.1.7Patch availableCNA
  • Vibe-Trading VendorHKUDS Affected 0.1.0 to before 0.1.7 Fixed in 0.1.7 Patch available CNA

Remediation

Upgrade HKUDS Vibe-Trading to version 0.1.7 or later, which is the first fixed version. The sources list no advisory identifier for this fix.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Vibe-Trading (HKUDS) Fixed in 0.1.7

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    HKUDS Vibe-Trading 0.1.7

    3 records Highest priority Priority HIGH 1 HIGH, 2 MEDIUM

    Other records, highest priority first

    • TI-2026-78719 HKUDS Vibe-Trading Path Traversal Exposes Server FilesPriority MEDIUM 44
    • TI-2026-78720 Indirect prompt injection in HKUDS Vibe-Trading allows remote command executionPriority MEDIUM 40
    Show all 3 records →

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-114108
  2. 2026-10-27 CISA SSVC decision points changed
  3. 2026-10-27 Priority changed: MEDIUM → HIGH

References

Advisory 1

  • TI-2026-44237 LightRAG: Missing Authentication for Critical API Functions in Default Configuration CVSS 3.1CRITICAL 9.8
  • TI-2026-44184 Improper authentication in HKUDS LightRAG CVSS 4.0CRITICAL 9.3
  • TI-2026-26034 Zero-Click Indirect Prompt Injection and Authentication Bypass via Email Polling CVSS 4.0HIGH 8.9
  • TI-2026-62432 HKUDS nanobot before 0.3.0 Server-Side Request Forgery via WebFetchTool CVSS 4.0CRITICAL 9.2
  • TI-2026-25310 DeepCode 1.2.0 Path Traversal via SPA Catch-All Route in main.py CVSS 4.0HIGH 8.7
  • TI-2026-27692 nanobot: Cross-Site WebSocket Hijacking in WhatsApp Bridge (CVE-2026-2577 Fix Update) CVSS 3.1CRITICAL 9.3
See all 47 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences