Which versions of Vibe Trading are affected by CVE-2026-58169?

HKUDS Vibe-Trading prior to version 0.1.10 allows remote code execution and credential theft through a DNS-rebinding vulnerability triggered when users visit compromised websites.. A patch is available.

How to fix or mitigate CVE-2026-58169?

Within 24 hours: Audit environment to identify all HKUDS Vibe-Trading instances and document current versions. Within 7 days: Apply vendor-released patch version 0.1.10 to all Vibe-Trading deployments and verify successful upgrades. Within 30 days: Rotate API credentials for all connected LLM providers and data sources; review API logs for suspicious POST requests to /swarm/runs endpoints created prior to patching.

Vibe Trading CVE-2026-58169

Q: What is the CVSS score of CVE-2026-58169?

CVE-2026-58169 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-40350 HIGH

Origin Validation Error (CWE-346)

2026-06-30 VulnCheck

GHSA-q796-5g5h-cqcc

RCE Vibe Trading Hkuds

7.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 30, 2026 - 17:39 vuln.today

Analysis Updated

Jun 30, 2026 - 17:39 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 17:38 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 30, 2026 - 17:22 vuln.today

cvss_changed

CVSS changed

Jun 30, 2026 - 17:22 NVD

7.5 (HIGH) 7.7 (HIGH)

Analysis Generated

Jun 30, 2026 - 17:17 vuln.today

DescriptionCVE.org

Vibe-Trading before 0.1.10's local API server trusts the TCP peer address to bypass the API_AUTH_KEY bearer-token check for loopback clients and performs no Host header validation, while binding to 0.0.0.0 with credentialed CORS by default. A DNS-rebinding web page can therefore issue authenticated requests to the local API as a trusted loopback client. Because loopback requests also auto-enable shell tools, an attacker can reach POST /swarm/runs with a built-in preset that permits the bash tool and achieve remote code execution as the API process user; the same bypass allows starting the live runner and overwriting LLM and data-source settings to redirect provider traffic and exfiltrate credentials.

AnalysisAI

Remote code execution in HKUDS Vibe-Trading before 0.1.10 is reachable via a DNS-rebinding attack against its local API server, which trusts the TCP peer address to waive the API_AUTH_KEY bearer-token check for loopback clients, performs no Host-header validation, and binds to 0.0.0.0 with credentialed CORS by default. Because loopback requests also auto-enable shell tools, a malicious web page visited by the victim can issue authenticated POST /swarm/runs calls with a built-in preset that permits the bash tool, executing arbitrary commands as the API process user and also overwriting LLM and data-source settings to redirect provider traffic and exfiltrate credentials. No CISA KEV listing or EPSS score was provided and no public exploit identified at time of analysis, though the issue was reported by VulnCheck.