Skip to content
CVE PROGRAM SOURCE RECORD9.3 Critical

CVE-2026-114108

HKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCE

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because require_auth() returns early when API_AUTH_KEY is unset. Attackers can post messages to /sessions/{id}/messages to trigger root shell commands via BashTool, upload .py or .sh files via /upload, read session histories, and obtain partial API keys.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

HKUDS Vibe-Trading

Default version status: unaffected

  • 0.1.0 to < 0.1.7affected
  • 0.1.7unaffected
pkg:pypi/vibe-trading-ai

References