Which versions of Cursor Cloud Agent are affected by CVE-2026-61613?

Cursor Cloud Agent versions before March 2026 contain an authentication bypass vulnerability that allows unauthenticated attackers to execute code within sessions and exfiltrate GitHub tokens,…. A patch is available.

How to fix or mitigate CVE-2026-61613?

Within 24 hours: disable Cursor Cloud Agent's browser functionality or restrict browsing to a curated allowlist of approved URLs only, and audit session activity logs for suspicious activity. Within 7 days: verify all exposed sessions have been terminated, review GitHub API audit logs for unauthorized access or token usage patterns, and notify impacted development teams. Within 30 days: obtain patch availability and timeline from Cursor vendor, and prepare expedited deployment procedures for immediate rollout once the security update is released; consider keeping the agent disabled until the patch is confirmed and deployed.

Cursor Cloud Agent CVE-2026-61613

Q: What is the CVSS score of CVE-2026-61613?

CVE-2026-61613 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-44674 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-15 GitHub_M

Authentication Bypass RCE Cursor

7.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.3 HIGH

Unauthenticated endpoint gives PR:N; needing a browser-enabled session plus victim-loaded malicious content maps to AC:H and UI:R; pivot from web context into the container justifies S:C with full session compromise.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 15, 2026 - 17:48 EUVD

Analysis Generated

Jul 15, 2026 - 15:19 vuln.today

CVE Published

Jul 15, 2026 - 14:18 cve.org

HIGH 7.7

DescriptionCVE.org

Cursor is a code editor built for programming with AI. Prior to the Cloud Agent fix on 03/31/2026, browser-enabled Cursor Cloud Agent sessions allowed attacker-controlled web content to connect from inside the agent container to an unauthenticated local agent endpoint, enabling code execution within the affected Cloud Agent sandbox or session and access to files, repository contents, environment variables, credentials, and GitHub App access tokens available to that session. This issue was fixed on 03/31/2026 by requiring authentication for the relevant agent endpoint.

AnalysisAI

Server-side request forgery leading to code execution in Cursor's browser-enabled Cloud Agent lets attacker-controlled web content reach an unauthenticated local agent endpoint from inside the sandbox, compromising the session. Affecting Cursor Cloud Agent sessions prior to the 03/31/2026 fix, an attacker who gets a browsing agent to load malicious content can run code in the sandbox and read repository contents, environment variables, credentials, and GitHub App access tokens scoped to that session. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the flaw is a missing-authentication (CWE-306) authentication-bypass class issue with high confidentiality, integrity, and availability impact to the affected session.

Technical ContextAI

The vulnerability lives in Cursor's Cloud Agent - the cloud-hosted, containerized execution environment where the AI coding agent runs tasks, clones repositories, and (in browser-enabled sessions) fetches web content on the user's behalf. The root cause is CWE-306 (Missing Authentication for a Critical Function): a local agent control endpoint inside the agent container accepted connections without authentication. Because the same session can be steered to load attacker-controlled web pages, that web content could originate requests to the loopback/local endpoint (an SSRF-style pivot from the browser context to the internal control plane), which then executes actions in the sandbox. The single affected product per CPE is cpe:2.3:a:cursor:cursor:*:*:*:*:*:*:*:* - the Cursor product line, specifically the Cloud Agent service tier rather than the local desktop editor build.

RemediationAI

No user action is required for the primary fix: the vendor remediated the issue server-side on 03/31/2026 by requiring authentication for the previously unauthenticated agent endpoint, so all Cloud Agent sessions after that date are covered (Patch available per vendor advisory - see https://github.com/cursor/cursor/security/advisories/GHSA-whx2-4gvm-m3r3). Organizations that used browser-enabled Cloud Agent sessions before 03/31/2026 should treat any secrets exposed to those sessions as potentially compromised and rotate them - in particular GitHub App access tokens, repository deploy keys, and any environment-variable credentials - and review GitHub audit logs for anomalous token use. As a forward-looking compensating control, restrict or disable the browser/web-browsing capability of Cloud Agents for sensitive repositories so agents cannot be induced to load untrusted external content (trade-off: loss of agent web-research features), and scope session credentials to least privilege so a compromised session yields minimal blast radius.