VulnSocial

CVE-2026-86121Disclosure

LOWCVSS 9.3 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Cua computer-server versions before 0.3.42 skip authentication when the CONTAINER_NAME environment variable is unset and bind to all interfaces by default, allowing unauthenticated attackers to execute arbitrary commands. Attackers can reach TCP port 8000 to run shell commands via the run_command endpoint, read and write arbitrary files through file operation endpoints, and access interactive PTY shells without authentication.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-306

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 4 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • Peaked 2d ago at 2 mentions (2026-09-05); latest day: 1
  • 4 total mentions across 3 days

Deep dive

Activity timeline4 mentions / 3d
01122Mentions · 2026-09-05: 2Mentions · 2026-09-06: 1Mentions · 2026-09-07: 1Patch / Workaround · 2026-09-05: 1Technical Details · 2026-09-05: 2Technical Details · 2026-09-06: 1Technical Details · 2026-09-07: 109-0509-0609-07
Signal classification3 categories
Disclosure
250.0%
Patch
125.0%
General
125.0%
Referenced assets6 URLs
Classification over time
DateTotalLabels
2026-09-052
Disclosure1Patch1
2026-09-061
General1
2026-09-071
Disclosure1
Full discourse4 posts
  • CVE@CVEnew
    Disclosure

    CVE-2026-86121 Cua computer-server versions before 0.3.42 skip authentication when the CONTAINER_NAME environment variable is unset and bind to all interfaces by default, allowing u… https://www.cve.org/CVERecord?id=CVE-2026-86121

    Post summary

    The excerpt notes that Cua computer-server versions prior to 0.3.42 have an authentication bypass and default interface binding issue, but provides no PoC, exploit, patch, or evidence of active exploitation.

    200001.2K
    58.1K followersView on X
  • Severity Daily@severitydaily
    Patch

    Cua and AutoAgent take 9.8s for unauthenticated command execution, and Cua's named fix version changed a bind default, not the authentication https://severitydaily.com/cua-autoagent-cve-2026-86121-86124-fix-version-bind-default-not-auth/

    Post summary

    The article notes unauthenticated command execution vulnerabilities in Cua and AutoAgent and reports that a fixed version has been released, but provides no PoC, exploit code, or evidence of live attacks.

    1000042
    23 followersView on X
  • Christopher Elliott@Chris_L_Elliott
    Disclosure

    Two agent-sandbox 9.8s same morning: Cua CVE-2026-86121 + AutoAgent CVE-2026-86124. Bind 0.0.0.0, auth off in "local mode," root + writable mount. Local mode isn't a security boundary. Cua 0.3.42 → loopback default. AutoAgent still open (#96). If the README listens on every interface, that is the bug. https://dev.to/kielltampubolon/2-cvss-98-agent-sandbox-cves-landed-the-same-day-2bng

    Post summary

    The post announces two high‑severity agent‑sandbox vulnerabilities (CVE‑2026‑86121 and CVE‑2026‑86124) and outlines malicious misconfigurations that allow unauthenticated local mode access and network exposure.

    0000056
    41 followersView on X
  • ThreatLoom@ThreatLoom
    General

    THREATLOOM // RESEARCH CVE-2026-86121 in Cua computer-server is worth reading past the CVSS. The original bug combined two things: • no auth when CONTAINER_NAME is unset • default bind to 0.0.0.0 Current Cua CLI now defaults to 127.0.0.1 — good exposure reduction. But current source still does: if not self.container_name: return True That means the authentication assumption itself still matters if anyone deliberately re-exposes port 8000. Defensive takeaway: don’t treat “localhost by default” as equivalent to “authentication fixed.” Audit launch flags, container/network policy and any deployment rebinding the service externally. Primary issue: https://github.com/trycua/cua/issues/1892 Current auth logic: https://github.com/trycua/cua/blob/main/libs/python/computer-server/computer_server/main.py Current CLI binding: https://github.com/trycua/cua/blob/main/libs/python/computer-server/computer_server/cli.py

    Post summary

    The post analyzes a CVE in Cua’s CLI, describing an authentication bypass when the container name is unset and a default binding to all interfaces, but it provides no PoC, exploit code, or evidence of active exploitation.

    0000037
    8 followersView on X

Explore more

Back to dashboard