HKUDS Vibe-Trading Missing Authentication (CVE-2026-114108)

HKUDS Vibe-Trading versions 0.1.0 through 0.1.6 are susceptible to a missing authentication vulnerability (CVE-2026-114108). The vulnerability exists within the application's authentication logic; specifically, the require_auth() function returns early if the API_AUTH_KEY environment variable is not explicitly set. This failure results in the entire FastAPI surface being exposed to unauthenticated remote attackers.

An attacker can leverage this flaw to interact with administrative endpoints, resulting in full application compromise. Reported impacts include unauthorized access to session histories, retrieval of partial API keys, arbitrary file uploads via the /upload endpoint, and remote code execution through the BashTool utility reachable via the /sessions/{id}/messages endpoint. Defenders should prioritize updating to version 0.1.7 or ensuring that the API_AUTH_KEY environment variable is configured correctly.

Impact

Successful exploitation allows unauthenticated remote attackers to gain full control over the Vibe-Trading instance. This includes the ability to execute arbitrary shell commands with the privileges of the application process, exfiltrate sensitive session data and API keys, and upload malicious scripts. This poses a significant risk to the integrity and confidentiality of the host environment and any integrated services.

Recommendation

• Upgrade Vibe-Trading to version 0.1.7 or later immediately to patch CVE-2026-114108.
• If immediate patching is not possible, ensure the API_AUTH_KEY environment variable is set to a strong, non-default value to force the require_auth() function to validate requests.
• Audit logs for unauthorized HTTP POST requests to /upload or /sessions/*/messages endpoints originating from untrusted IPs.
• Restrict access to the Vibe-Trading FastAPI interface to authorized network segments only.