CVE-2026-86121

Katalog CVE

CVSS 9.8 · Critical EPSS 1,1%

Kerentanan Missing Authentication for Critical Function. Skor CVSS 3.1 9.8 (Critical) menurut vulncheck.com.

Deskripsi (NVD)

Cua computer-server versions before 0.3.42 skip authentication when the CONTAINER_NAME environment variable is unset and bind to all interfaces by default, allowing unauthenticated attackers to execute arbitrary commands. Attackers can reach TCP port 8000 to run shell commands via the run_command endpoint, read and write arbitrary files through file operation endpoints, and access interactive PTY shells without authentication.

Rincian

Terbit di NVD

5 September 2026

Terakhir diubah

24 September 2026

Status NVD

Deferred

CVSS 3.1

9.8 (Critical), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 65,2% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/trycua/cua
• https://github.com/trycua/cua/blob/10a2e71792db/libs/python/computer-server/computer_server/cli.py
• https://github.com/trycua/cua/blob/10a2e71792db/libs/python/computer-server/computer_server/main.py
• https://github.com/trycua/cua/commit/59cf25c0ec54
• https://github.com/trycua/cua/issues/1892
• https://www.vulncheck.com/advisories/cua-computer-server-before-0.3.42-unauthenticated-rce-via-desktop-control