CVE-2026-85688: TEN Framework just handed out root, no login needed. TEN Framework builds real time multimodal conversational agents. Version 0.11.71's TMAN Designer ships a file-content API with no auth check on it. CVSS 9.8. Here's the chain, and it's almost boring how short it is: 1. Attacker sends an unauthenticated POST or PUT to /api/designer/v1/file-content. 2. That endpoint writes arbitrary content to arbitrary paths on the server. No session, no token, nothing. 3. Attacker writes their SSH key into authorized_keys. Or drops a cron job. Or overwrites one of TEN's own executable graph files, the config files that define how the agent pipeline runs. 4. Server executes it. Full remote code execution (RCE). Why does this land so clean? Because "file-content" endpoints on designer tools are built for a developer sitting at localhost, dragging nodes around, saving their work. Nobody threatens-model them as internet-facing write primitives. But agent builder UIs get exposed on shared boxes, cloud sandboxes, demo servers, way more than people admit. An arbitrary file write endpoint with zero auth in front of it isn't a bug in the traditional sense, it's a missing perimeter. The finder (George Chen) didn't even need a clever payload, just an HTTP client and a known SSH path. What does this mean if you're building agent infra, not just using it? Any tool you ship that lets a "trusted local user" write files or graphs through an API needs auth on that API by default, not auth added later when someone remembers. If your agent framework has a designer, admin panel, or debug console with file write capability, ask yourself right now: does it check who's calling, or does it just check what they're calling? Patch to a version past 0.11.71 if you're running TMAN Designer, and don't expose it past localhost in the meantime. Where else in your stack does a "dev tool" endpoint assume nobody but you can reach it? #AISecurity #CVE #RCE
Post summary
The article discloses a high‑severity RCE flaw in TEN Framework’s designer API, explains how to exploit it, and provides a patch recommendation.
