Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
OpenCode is an open source AI coding agent. Prior to 1.0.216, OpenCode automatically starts an unauthenticated HTTP server that allows any local process (or any website via permissive CORS) to execute arbitrary shell commands with the user's privileges. This vulnerability is fixed in 1.0.216.
Priority
MEDIUM
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-01-30 | 1 | Patch1 |
| 2026-01-31 | 1 | Exploit1 |
| 2026-02-01 | 1 | Patch1 |
| 2026-02-02 | 1 | General1 |
| 2026-02-03 | 1 | Disclosure1 |
| 2026-03-21 | 2 | Exploit1PoC1 |
| 2026-03-30 | 1 | Disclosure1 |
| 2026-04-01 | 1 | Disclosure1 |
| 2026-04-04 | 1 | Disclosure1 |
| 2026-07-23 | 1 | Disclosure1 |
| 2026-07-30 | 1 | Patch1 |
| 2026-08-15 | 1 | Disclosure1 |
CVE-2026-22812: OpenCode v1.0.216 - Unauthenticated RCE #BugBounty #CyberSecurity https://t.co/FIS3vz82wI
Post summary
The tweet announces CVE-2026-22812, an unauthenticated remote code execution flaw in OpenCode v1.0.216, with no exploit code, active exploitation, or patch details provided.
If you're using OpenCode (AI coding agent), update to v1.0.216 NOW (CVE-2026-22812) 🚨. Unauth RCE via POST /session/{id}/shell. No login, no tokens, just direct command execution. eg: /etc/passwd and ...etc #BugBounty #OpenCode #bugbountytips #ethicalhacking https://t.co/3EFJb4IQF5
Post summary
The tweet alerts OpenCode users to CVE‑2026‑22812, an unauthenticated remote code execution flaw in the /session/{id}/shell endpoint, and urges an upgrade to v1.0.216 to mitigate the vulnerability.
If you're using OpenCode (AI coding agent), update to v1.0.216 NOW (CVE-2026-22812) Unauth RCE via POST /session/{id}/shell. No login, no tokens, just direct command execution. eg: /etc/passwd and ...etc #BugBounty #CyberSecurity #Clawdbot #opencode https://t.co/RmxmStbh7m
Post summary
CVE-2026-22812 allows unauthenticated remote code execution in OpenCode via a specific POST endpoint, and users are advised to update to v1.0.216 immediately to mitigate the risk.
[8.8] CVE-2026-22812: OpenCode RCE Unauthenticated HTTP server exposes /session/:id/shell, /pty, /file/content. Permissive CORS allows arbitrary command execution. Dark Exploit found it. Fix: Update to v1.0.216+ 🔗 http://miggo.io --- 🔗 http://t.me/luckyhacker42 https://t.co/6aAXwHpMdY
Post summary
The post provides technical details of an RCE vulnerability and highlights a patch, without indicating active exploitation or a PoC.
[8.8] CVE-2026-22812: OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution 🔥 🔗 https://www.miggo.io/vulnerability-database/cve/CVE-2026-22812 🔗 JOIN TEAM 👉https://t.me/luckyhacker42 https://t.co/6UfvxqTXv7
Post summary
The tweet announces CVE-2026‑22812, noting that OpenCode’s unauthenticated HTTP server permits arbitrary command execution, but offers no PoC, exploit, patch, or active exploitation details.
CVE-2026–22812: How I Got RCE on a 71k-Star AI Coding Tool With Zero Authentication https://medium.com/@dhxrxx/cve-2026-22812-how-i-got-rce-on-a-71k-star-ai-coding-tool-with-zero-authentication-7524fbc3317f?source=rss------bug_bounty-5 #bugbounty #bugbountytips #bugbountytip
Post summary
The Medium post outlines a successful RCE on the targeted AI coding tool, including exploit details and likely code, but offers no evidence of ongoing active attacks or official patches.
@thdxr joky joke, referring to this https://www.cve.org/CVERecord?id=CVE-2026-22812
⚠️AIエージェント利用のエンジニア必見！ CVE-2026-22813(CVSS 9.6)はNW露出不要。npmパッケージ1つでローカル端末が乗っ取られる脆弱性です。 Shodanに映らない潜在脅威と「5層防御モデル」を徹底解説👇 https://www.capy-tech-log.tech/ai-coding-agent-root-access-cve-2026-22812-22813-defense-architecture/ #AIセキュリティ #ゼロトラスト
Post summary
The post announces CVE‑2026‑22813 as a high‑score vulnerability that can be exploited locally via a single npm package, without network exposure; no PoC, exploit, or patch is mentioned.
【オープンコード…お前もか？】 GitHub 161k starsの最人気OSS coding agentに「今すぐ使うのをやめろ」と叫ぶ男が現れた。 CVE-2026-22812 / bashフィルタ全バイパス / プロンプトキャッシュ全滅戦争 note: https://note.com/famous_prawn2009/n/n2f60c4d45366 #AI #セキュリティ #OpenCode
Post summary
The post announces CVE-2026-22812 affecting a popular OSS coding agent, noting a full bypass of bash filters and destructive impact on prompt cache, but offers no exploit code, patch, or evidence of active exploitation.
🚨 CVE-2026-22812 - high 🚨 OpenCode < 1.0.216 - Unauthenticated Remote Code Execution > OpenCode versions prior to 1.0.216 contain an unauthenticated remote code execution v... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-22812 @pdnuclei #NucleiTemplates #cve
Post summary
CVE-2026-22812 is a high‑severity unauthenticated remote code execution vulnerability affecting OpenCode versions prior to 1.0.216; the post does not provide any PoC, exploit code, patch, or evidence of active exploitation.
Top 5 Trending CVEs: 1 - CVE-2026-21509 2 - CVE-2026-22812 3 - CVE-2026-0755 4 - CVE-2025-43529 5 - CVE-2026-1281 #cve #cvetrends #cveshield #cybersecurity https://www.cveshield.com/dashboard
Post summary
The post merely lists five CVE identifiers without providing any additional technical or contextual information.
220,000 AI coding agent instances are publicly exposed with zero authentication. CVE-2026-22812. CVSS 8.8. Unauthenticated remote code execution. The number only counts servers. It doesn't count the Mac Minis.
Post summary
A newly disclosed CVE‑2026‑22812 with CVSS 8.8 exposes around 220,000 AI coding agent instances to unauthenticated remote code execution, yet no patches or active exploitation reports are mentioned.
"CVE-2026–22812: How I Got RCE on a 71k-Star AI Coding Tool With Zero Authentication" by Dharanis #BugBounty #Cybersecurity #Hacking #InfoSec https://medium.com/@dhxrxx/cve-2026-22812-how-i-got-rce-on-a-71k-star-ai-coding-tool-with-zero-authentication-7524fbc3317f
Post summary
A Medium article claims the author achieved remote code execution on an AI coding tool via CVE‑2026‑22812 without authentication, implying a PoC exists but no patch or active exploitation is reported.
https://github.com/rohmatariow/CVE-2026-22812-exploit Todo el mundo explotando cosas😃los labs es el modo pve el verdadero juego es meterle amor a cosas chinas rotas🙂
Post summary
A GitHub repository linked in the text provides exploit code for CVE‑2026‑22812, indicating a functional exploit is available, but no evidence of active wild exploitation or mitigation is provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | anoma | opencode | - | - | - |