HKUDS Vibe-Trading <0.1.7 Flaw Lets Attackers Execute Root Commands Without Credentials

Security operations teams should note that unauthenticated attackers can gain root shell access in HKUDS Vibe-Trading installations running versions prior to 0.1.7. According to the National Vulnerability Database, this critical flaw stems from a missing authentication check that bypasses security controls when the API_AUTH_KEY configuration variable is left empty.

In plain English

The vulnerability allows anyone on the network to interact with the application’s backend without proving their identity. Because the system fails to verify credentials when the authentication key is missing, attackers can send messages to specific session endpoints. These messages trigger the execution of root-level shell commands through the BashTool component.

The background

The issue exists in HKUDS Vibe-Trading from version 0.1.0 up to, but not including, version 0.1.7. The National Vulnerability Database assigns CVE-2026-114108 to this flaw and rates it as critical with a CVSS score of 9.3. The weakness is classified under CWE-306, which covers missing authentication for critical functions.

What changes now

Attackers exploiting this gap can post messages to the /sessions/{id}/messages endpoint to run arbitrary commands. They can also upload Python or shell script files via the /upload endpoint. Furthermore, threat actors can read session histories and extract partial API keys from the compromised system.

What made it possible

Teams usually encounter this class of issue when developers implement early-exit logic that skips validation steps under specific configuration states. In intrusion scenarios, this weakness serves the initial access stage by allowing adversaries to bypass identity checks entirely. Check whether your deployment relies on optional configuration variables for security enforcement. Ensure that critical functions remain protected even when optional settings are absent or unset.

What to do and how to stay safe: HKUDS Vibe-Trading

• Verify if your organization uses HKUDS Vibe-Trading and check the installed version against the affected range
• Confirm that the API_AUTH_KEY configuration variable is set and not empty in your deployment
• Monitor logs for unauthorized access attempts to the FastAPI surface or unusual file uploads
• Restrict network access to the application endpoints until a confirmed fix is available

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of HKUDS Vibe-Trading are affected by CVE-2026-114108?

Versions from 0.1.0 before 0.1.7 are affected by this missing authentication vulnerability.

What can an attacker do with this vulnerability?

Attackers can execute root shell commands, upload files, read session histories, and obtain partial API keys.

Is there a patch available for this issue?

The source material indicates that versions before 0.1.7 are affected, implying that 0.1.7 and later are not vulnerable, but no explicit patch release details are provided.