TEN Framework CVE-2026-85688

Exploitation requires network reachability to the TMAN Designer file-content API of TEN Framework 0.11.71 at /api/designer/v1/file-content, which accepts POST (read) and PUT (write) requests with no authentication, no user interaction, and against the default configuration (CWE-306, CVSS PR:N/UI:N/AC:L). The primary limiting factor is exposure: the attacker must be able to route to the Designer HTTP listener, so deployments that bind it to localhost or restrict it behind an authenticating proxy/firewall are not remotely exploitable. RCE further depends on the ability to write to an actionable target such as authorized_keys, a cron file, or an executable graph file that the system will later load or execute.

This is a genuine high-priority issue rather than an inflated CVSS number: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3) aligns cleanly with the description - a network-reachable, unauthenticated, single-request read/write primitive that chains to code execution, so all three impact metrics being High is justified. No EPSS score, KEV listing, or explicit proof-of-concept is present in the provided data, so exploitation is not yet confirmed in the wild, but the trivial exploitation profile (a single crafted HTTP request against a default configuration) means weaponization would be straightforward; any team running an internet- or LAN-exposed TMAN Designer instance should treat this as urgent. The main mitigating factor is deployment footprint - TEN Framework is an emerging AI-agent framework, so real-world exposure is limited compared with mainstream web software, and the practical risk depends heavily on whether the Designer service is network-reachable versus bound to localhost.

An attacker who can reach the TMAN Designer HTTP service sends an unauthenticated PUT to /api/designer/v1/file-content writing their own SSH public key into ~/.ssh/authorized_keys (or a payload into a cron file / executable graph file), then connects over SSH or waits for the scheduled job to run, gaining code execution as the service or user account. The matching POST read endpoint can first be used to exfiltrate secrets and confirm reachable paths. No proof-of-concept is published in the provided sources, but the single-request design makes exploitation trivial.