EUVD-2026-71953
GHSA-pccw-h89v-h9cj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDiscover exposed port 8000
-
DeliverySend unauthenticated request to run_command endpoint
-
ExploitExecute arbitrary shell commands
-
ExecutionRead/write files or open PTY shell
-
ImpactFull host compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Two prerequisites, both met by the vulnerable default posture: (1) the CONTAINER_NAME environment variable is UNSET, which disables the server's authentication check, and (2) the server is reachable on TCP port 8000 - trivially true in versions before 0.3.42 because the default host bind was 0.0.0.0 (all interfaces). Exploitation is limited/blocked when CONTAINER_NAME is set (auth enforced), when the server binds to 127.0.0.1 only (the 0.3.42 default), or when a firewall restricts port 8000; no authentication, user interaction, or special platform is otherwise required. |
| Impact | The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3) is consistent with the description: network-reachable, no authentication, no user interaction, and full confidentiality/integrity/availability impact via arbitrary command execution. The technical impact is total (code execution as the server process) and the attack is trivially automatable against exposed instances, which under an SSVC lens argues for prompt remediation. Tempering factors: no EPSS score, KEV status, or POC were provided, so widespread active exploitation is not established - this is a high-severity, plausibly-automatable flaw whose real-world exposure depends on how many instances run with CONTAINER_NAME unset and reachable on port 8000. The two conditions (unset env var AND network reachability) are both true in the default/local-dev posture the vendor shipped, so the CVSS 9.3 is credible rather than inflated. |
| Exploit ScenarioDerived | An attacker scans for hosts exposing TCP port 8000 running a pre-0.3.42 computer-server that was started without CONTAINER_NAME set. They send an unauthenticated request to the run_command endpoint to execute shell commands, then use the file endpoints or an interactive PTY to install persistence or pivot. No credentials, user interaction, or POC are required - the control API answers directly; no public exploit is identified at time of analysis, but the API surface is documented in the vendor advisory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 05, 2026
Unauthenticated remote code execution in Cua computer-server before 0.3.42 lets network attackers run arbitrary shell commands, read and write arbitrary files, and open interactive PTY shells on the host. The server skips authentication entirely when the CONTAINER_NAME environment variable is unset and, in vulnerable versions, binds to all interfaces (0.0.0.0) by default, so its control endpoints on TCP port 8000 are exposed to any reachable attacker. There is no public exploit identified at time of analysis, but the vendor commit and VulnCheck advisory confirm the root cause and fix; EPSS/KEV data were not provided.
RemediationAI
Upgrade to Cua computer-server 0.3.42 or later, which changes the default bind address from 0.0.0.0 to 127.0.0.1 (fix commit 59cf25c0ec54). If immediate upgrade is not possible, do not run the server bound to a public or LAN-reachable interface: start it with an explicit loopback bind (--host 127.0.0.1) and reach it only via localhost or an SSH tunnel, accepting that remote agents will lose direct access. Set the CONTAINER_NAME environment variable so the authentication path is not skipped, and firewall/block inbound TCP 8000 from untrusted networks; the trade-off of these controls is that legitimate remote clients and multi-host deployments must be reconfigured to use an authenticated, tunneled, or ACL-restricted path. See the vendor advisory (VulnCheck) and issue #1892 for details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Cua computer-server is the Python control daemon of the trycua/cua computer-use agent stack; it exposes a WebSocket/HTTP API (default TCP 8000) that lets an AI agent drive a desktop - running commands, manipulating files, and controlling keyboard/mouse/PTY. The root cause is CWE-306 (Missing Authentication for a Critical Function): the authentication layer is conditionally enabled based on the CONTAINER_NAME environment variable, and when that variable is unset the server accepts requests with no credential check. This is compounded by an insecure default in server.py/cli.py where host defaulted to 0.0.0.0, binding the daemon to every network interface rather than loopback. The fix commit (59cf25c0ec54) changes the default bind to 127.0.0.1 and documents that operators must pass --host 0.0.0.0 explicitly for external access; a changelog dated 2026-05-18 records the bind-default hardening. No CPE strings were supplied in the input.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-reachable API with authentication skipped by default and no user interaction yields PR:N/UI:N/AC:L; arbitrary command execution gives full C:H/I:H/A:H.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
Cua computer-server versions before 0.3.42 skip authentication when the CONTAINER_NAME environment variable is unset and bind to all interfaces by default, allowing unauthenticated attackers to execute arbitrary commands. Attackers can reach TCP port 8000 to run shell commands via the run_command endpoint, read and write arbitrary files through file operation endpoints, and access interactive PTY shells without authentication.
Executive ViewAI
Cua computer-server prior to version 0.3.42 contains an unauthenticated remote code execution vulnerability that permits any network-accessible attacker to execute arbitrary commands, read and write files, and obtain interactive system access without credentials. The defect is exposed by default due to the service binding to all interfaces on TCP port 8000, creating immediate risk of complete system compromise for any organization running this product. Leadership should treat this as an emergency requiring isolation or mitigation within 24 hours.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce CONTAINER_NAME environment variable on all instances to restore authentication; implement strict firewall rules limiting TCP port 8000 access to only trusted administrative subnets; place Cua systems on a segregated network segment isolated from general user networks; deploy network intrusion detection focused on port 8000 for scanning and payload patterns; maintain detailed audit logs of all port 8000 connections; consider temporary service discontinuation if patch timeline extends beyond organizational risk tolerance.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB