Vibe-Trading CVE-2026-114106

Requires network reachability to the Vibe-Trading FastAPI service (default port 8899), which accepts anonymous TCP clients, so no authentication or user interaction is needed against the shipped configuration. The impact is amplified specifically by the default container: the Dockerfile has no USER directive (runtime stage python:3.11-slim), so the process runs as uid=0(root) and can read root-owned secrets. Two concrete defects enable it: read_document() performs no sandbox/safe_path check at all (reads any file the process can access, e.g. /etc/shadow, /proc/self/environ), and safe_user_path() accepts any path under Path.home() or Path.cwd(), which resolve to /root and /app in the container (exposing /root/.ssh/id_rsa, /root/.aws/credentials, /root/.kube/config, /app/agent/.env). Limiting factors: only versions 0.1.0 through 0.1.6 are affected; exploitation requires the service to be network-exposed; and real-world risk is bounded by the product's very small deployment base. Secrets are only leaked to the extent they exist and are readable by the running process.

Signals are largely consistent and point to a genuine, high-severity confidentiality exposure. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) describes remote, low-complexity, unauthenticated exploitation with high confidentiality impact and no integrity/availability effect, and the GHSA advisory corroborates this: the file-read tools are reachable by any anonymous TCP client to port 8899, and the shipped container has no USER directive so the FastAPI process runs as uid=0(root), maximizing what can be read (/etc/shadow, /root/.ssh/id_rsa, /root/.aws/credentials, /app/agent/.env). No EPSS score, KEV listing, or explicit POC flag was supplied in the structured input; however, the referenced GHSA advisory embeds concrete curl-based reproducer steps, which functions as publicly available exploit code. KEV status is NOT present, so this should be treated as a disclosed-with-reproducer issue rather than confirmed active exploitation. Net assessment: a real priority for anyone actually running Vibe-Trading exposed to a network, tempered by the product's small real-world footprint - the severity is high but the population of affected deployments is likely tiny. Note one nuance to verify: exploitation is also described via prompt-injection in documents the agent processes, a path the CVSS AV:N/PR:N vector does not fully capture.

A remote attacker with network reach to the Vibe-Trading service on port 8899 sends an anonymous request that prompts the LLM agent to call read_document (which performs no sandbox check) or a safe_user_path-gated tool. The agent returns the raw contents of /etc/shadow, /proc/self/environ (leaking API keys), or /root credential files because the process runs as root in the shipped container. Reproducer curl steps are published in the GHSA advisory, lowering the effort required.