{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/vibe-trading-0.1.0-0.1.6/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:hkuds:vibe-trading:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-114108"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Vibe-Trading (0.1.0-0.1.6)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["HKUDS"],"content_html":"\u003cp\u003eHKUDS Vibe-Trading versions 0.1.0 through 0.1.6 are susceptible to a missing authentication vulnerability (CVE-2026-114108). The vulnerability exists within the application's authentication logic; specifically, the require_auth() function returns early if the API_AUTH_KEY environment variable is not explicitly set. This failure results in the entire FastAPI surface being exposed to unauthenticated remote attackers.\u003c/p\u003e\n\u003cp\u003eAn attacker can leverage this flaw to interact with administrative endpoints, resulting in full application compromise. Reported impacts include unauthorized access to session histories, retrieval of partial API keys, arbitrary file uploads via the /upload endpoint, and remote code execution through the BashTool utility reachable via the /sessions/{id}/messages endpoint. Defenders should prioritize updating to version 0.1.7 or ensuring that the API_AUTH_KEY environment variable is configured correctly.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated remote attackers to gain full control over the Vibe-Trading instance. This includes the ability to execute arbitrary shell commands with the privileges of the application process, exfiltrate sensitive session data and API keys, and upload malicious scripts. This poses a significant risk to the integrity and confidentiality of the host environment and any integrated services.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Vibe-Trading to version 0.1.7 or later immediately to patch CVE-2026-114108.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, ensure the API_AUTH_KEY environment variable is set to a strong, non-default value to force the require_auth() function to validate requests.\u003c/li\u003e\n\u003cli\u003eAudit logs for unauthorized HTTP POST requests to /upload or /sessions/*/messages endpoints originating from untrusted IPs.\u003c/li\u003e\n\u003cli\u003eRestrict access to the Vibe-Trading FastAPI interface to authorized network segments only.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-21T02:15:15Z","date_published":"2026-10-21T02:15:15Z","id":"https://feed.craftedsignal.io/briefs/2026-10-114108/","summary":"HKUDS Vibe-Trading versions 0.1.0 through 0.1.6 contain a missing authentication vulnerability allowing unauthenticated attackers to execute arbitrary shell commands, upload files, and access sensitive data.","title":"HKUDS Vibe-Trading Missing Authentication (CVE-2026-114108)","url":"https://feed.craftedsignal.io/briefs/2026-10-114108/"}],"language":"en","title":"CraftedSignal Threat Feed - Vibe-Trading (0.1.0-0.1.6)","version":"https://jsonfeed.org/version/1.1"}