Cyber & AI intelligence
Wasteland.
Briefs indexed2438
Issues26
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-86124 2026-09-05

CVE-2026-86124: Unauthenticated Root RCE in HKUDS AutoAgent's Sandbox TCP Server

"A critical (CVSS 9.8) flaw in HKUDS AutoAgent exposes a TCP command server on all interfaces that runs attacker-supplied bash commands as root inside the agent container, with reach into bind-mounted host workspace…"

A critical (CVSS 9.8) flaw in HKUDS AutoAgent exposes a TCP command server on all interfaces that runs attacker-supplied bash commands as root inside the agent container, with reach into bind-mounted host workspace directories.

What Is It

AutoAgent's sandbox environment ships a TCP server that binds to all interfaces and accepts commands without any authentication check. Anyone able to reach the exposed communication port can send arbitrary bash commands, which execute as root within the container. Because the container bind-mounts host workspace directories, that execution also gives the attacker access to files on the host side of those mounts.

The issue is tracked as CWE-306 (Missing Authentication for Critical Function) and was disclosed by VulnCheck. It carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and a CVSS 4.0 score of 9.3; network attack vector, low complexity, no privileges, no user interaction, with high confidentiality, integrity, and availability impact.

Why It Matters

There is no exploitation barrier here: no credentials, no user interaction, no chained bug. A single TCP connection is the whole exploit chain, and the payload runs as root. The bind-mount detail matters; this is not contained to a throwaway container; attacker-controlled code touches the host workspace the operator mounted in.

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog in the supplied data, so there is no confirmation of active exploitation and no KEV-mandated remediation deadline at this time.

What's Vulnerable

No CPE entries are published for this record.

Patch Status

The supplied NVD record lists no fixed version, patch commit, or vendor advisory with remediation guidance; the vulnerability status is "Received" as of publication on 2026-09-05. Tracking is available via the upstream GitHub issue. Until a fix lands, the exposure to constrain is the network reachability of the AutoAgent communication port.

Sources