CVE-2026-114108 is a critical (CVSS 3.1: 9.8) missing authentication flaw in HKUDS Vibe-Trading 0.1.0 up to but not including 0.1.7. If API_AUTH_KEY is unset, unauthenticated attackers can reach the FastAPI server and run shell commands as root.
What Is It
The flaw is in the application's FastAPI server and is classified as CWE-306 (Missing Authentication for Critical Function). The require_auth() check returns early when the API_AUTH_KEY setting is unset, so the API runs with no authentication at all.
According to the NVD description, an unauthenticated attacker can:
- Post messages to
/sessions/{id}/messagesto trigger root shell commands through the BashTool component - Upload
.pyor.shfiles through the/uploadendpoint - Read session histories
- Obtain partial API keys
Why It Matters
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The attack works over the network, has low complexity, and needs no privileges or user interaction. Confidentiality, integrity and availability impacts are all rated High. VulnCheck also gave it a CVSS 4.0 score of 9.3 (Critical).
The main risk is command execution with root privileges, which can lead to full compromise of the host. Exposed session histories and partial API keys could also leak sensitive data and credentials for connected services.
This CVE has no CISA KEV entry, and the supplied sources do not confirm active exploitation. The NVD record has the status "Received."
What's Vulnerable
- Vendor: HKUDS
- Product: Vibe-Trading
- Package:
pkg:pypi/vibe-trading-ai - Affected versions: 0.1.0 up to but not including 0.1.7
- Unaffected: 0.1.7
A deployment is exposed when API_AUTH_KEY is not set, because that is when the authentication check is skipped.
Patch Status
Version 0.1.7 is listed as unaffected. Administrators running Vibe-Trading 0.1.0 through 0.1.6 should upgrade the vibe-trading-ai package to 0.1.7 or later. CISA has not issued a required action, since the CVE is not in the KEV catalog. See the vendor's GitHub security advisory and the VulnCheck advisory below for remediation details.