Vibe-Trading CVE-2026-114108

Exploitable against a default/clean install: agent/.env.example ships API_AUTH_KEY commented out and require_auth() returns None immediately when the key is unset, so every endpoint under Depends(require_auth) is unauthenticated unless the operator explicitly sets API_AUTH_KEY. The attacker needs network reachability to the FastAPI listener, which docker-compose exposes on 0.0.0.0:8899 with no network restriction. The container runs as root (no USER directive in the Dockerfile), so successful command execution via /sessions/{id}/messages → BashTool yields root. LIMITING FACTORS: the full chained RCE demonstration additionally requires a working LLM API key configured by the operator so the agent tool-call loop can complete (a normal functional setup step, not a security opt-in); the unauthenticated surface itself, /upload file write, history read, and partial key disclosure do not require the LLM key. Setting API_AUTH_KEY, restricting the 8899 bind, or upgrading to 0.1.7 removes exposure.

All available signals converge on genuine high priority. The input CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, VC/VI/VA:H, score 9.3) describes remote, low-complexity, unauthenticated exploitation with full confidentiality/integrity/availability impact, consistent with the GHSA Finding 1 CVSS v3.1 rating of 9.8. The decisive aggravator is configuration-by-default: agent/.env.example ships API_AUTH_KEY commented out, and require_auth() returns early (if not api_key: return) when it is unset, so a clean install exposes every endpoint unauthenticated - this is not an edge-case misconfiguration. Impact is amplified because the shipped Dockerfile has no USER directive (process runs as uid=0 root) and docker-compose binds 0.0.0.0:8899 with no network restriction. A detailed public reproducer with curl commands exists in the GHSA advisory (publicly available exploit code exists), but the CVE is NOT listed in CISA KEV and NO EPSS score was provided in the input, so there is no evidence of active or widespread exploitation yet. The main counterweight to raw severity is low real-world prevalence: this is a niche open-source AI trading-agent project, so realistic risk is confined to the relatively small population that has actually deployed it and exposed port 8899. Net: a credible, easily-exploitable unauthenticated RCE that should be patched immediately where deployed, but likely targeted/opportunistic rather than mass-exploited given footprint; KEV and EPSS data are absent, so exploitation-likelihood signals are incomplete.

An attacker who can reach the Vibe-Trading FastAPI service on 0.0.0.0:8899 (exposed by default via docker-compose) sends an unauthenticated POST to /sessions/{id}/messages, because require_auth() returns early when the default-unset API_AUTH_KEY leaves all endpoints open. The crafted message drives the agent's BashTool to run shell commands as root inside the container, and the attacker can also upload .py/.sh files via /upload, read session histories, and recover partial API keys. A step-by-step public reproducer with curl commands is published in the GHSA advisory, so no exploit development is required.