critical9.8
CVE-2026-114108
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface …
Impact
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because require_auth() returns early when API_AUTH_KEY is unset. Attackers can post messages to /sessions/{id}/messages to trigger root shell commands via BashTool, upload .py or .sh files via /upload, read session histories, and obtain partial API keys.
Affected products
| Product | Affected versions |
|---|---|
| HKUDS Vibe-Trading From 0.1.0 | before 0.1.7 |
Versions were read from the advisory text. No structured product data has been published for this record yet.