EUVD-2026-71956
GHSA-vmh4-qv5g-wc55
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDiscover exposed sandbox TCP port
-
DeliveryOpen raw TCP connection (no auth)
-
ExploitSend bash command payload
-
ExecutionExecute as root in container
-
PersistRead/modify bind-mounted host workspace
-
ImpactPivot / full host-data compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only that the AutoAgent sandbox TCP command server (from docker_env.py/tcp_server.py) be running and its port reachable from the attacker - the server binds to all interfaces (0.0.0.0) and performs no authentication, so a plain TCP connection is sufficient to execute root bash commands. The primary limiting factor is network exposure: if the host running the sandbox is not reachable from the attacker's network (e.g., the port is firewalled or the host sits on an isolated segment), exploitation is blocked. Access to bind-mounted host directories additionally requires that such mounts are configured, which is the framework's default workspace pattern. |
| Impact | This is a genuine high-priority issue, not a paper CVSS score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, 9.3) aligns tightly with the description: network-reachable, no authentication, no user interaction, and full confidentiality/integrity/availability impact via root command execution - the metrics and the described behavior are internally consistent, which raises confidence. The mitigating factor is exposure scope: the port is only dangerous where the sandbox host is reachable from untrusted networks; a deployment that keeps the service bound to a trusted network or loopback-only reachable path is far less exposed, so real-world risk hinges on network placement rather than on any per-target configuration toggle. No EPSS score, KEV listing, or public PoC is present in the provided data, so there is no evidence of automated mass exploitation yet; however, the trivial exploitation path means any operator running AutoAgent with the port reachable should treat this as urgent and not wait for a KEV listing. The 'Authentication Bypass' tag is a loose fit - there is no auth to bypass; this is missing authentication (CWE-306). |
| Exploit ScenarioDerived | An attacker scans for the exposed AutoAgent sandbox TCP port on a reachable host, opens a raw TCP connection, and sends a bash command string; the server executes it as root inside the container and returns output. The attacker then reads or overwrites files in the bind-mounted host workspace and pivots further. No public PoC is confirmed, but the network-level, no-auth, low-complexity path makes exploitation straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 05, 2026
Unauthenticated remote code execution in HKUDS AutoAgent's sandbox environment allows any network-reachable attacker to run arbitrary bash commands as root. The framework's TCP command server binds to all interfaces (0.0.0.0) and executes received commands with no authentication, so attackers who reach the port gain root inside the agent container and can read or tamper with bind-mounted host workspace directories. Reported by VulnCheck with a public advisory; no public exploit code or active exploitation is confirmed at time of analysis.
RemediationAI
No vendor-released patch version is identified at time of analysis; the disclosure is tracked in GitHub issue #96 and the VulnCheck advisory. As specific compensating controls: rebind the sandbox TCP command server to loopback (127.0.0.1) instead of 0.0.0.0 so it is not reachable off-host - this is the highest-value fix and should not break local host-to-container orchestration; block or firewall the sandbox communication port at the host and network boundary to deny external connections (trade-off: multi-host or distributed agent setups relying on remote dispatch will break and need a proper authenticated channel); run the container as a non-root user and restrict or remove host workspace bind mounts to limit blast radius if the port is reached (trade-off: agents lose direct host-workspace access); and add authentication/authorization to the command channel before re-exposing it. Track https://github.com/HKUDS/AutoAgent/issues/96 and the VulnCheck advisory for an official fixed release and upgrade once published.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
AutoAgent is an LLM agent framework (HKUDS/AutoAgent) that executes agent-generated actions inside a Docker sandbox. The affected components are autoagent/environment/tcp_server.py and autoagent/environment/docker_env.py: a TCP server used for host-to-container command dispatch listens on all interfaces and passes inbound payloads straight to a bash shell running as the container root user. The root cause is CWE-306 (Missing Authentication for a Critical Function) - a privileged command channel that was intended for local/internal orchestration is exposed with no credential, token, or origin check. Because Docker bind mounts map host workspace directories into the container, code execution in the container also reaches those mounted host paths.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-reachable, no auth and no interaction (AV:N/AC:L/PR:N/UI:N); root exec plus reach into bind-mounted host workspace crosses the container boundary, justifying S:C with full C/I/A.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
AutoAgent contains an unauthenticated remote code execution vulnerability in the TCP server that binds to all interfaces and executes attacker-supplied commands as root. Attackers can connect to the exposed communication port and execute arbitrary bash commands within the container, gaining access to bind-mounted host workspace directories.
Executive ViewAI
HKUDS AutoAgent has a critical security gap that exposes systems to unauthenticated remote takeover with administrative access. Any organization with this software deployed on network-accessible infrastructure faces immediate risk of data compromise, system takeover, and operational disruption, with no vendor-released patch currently available to address the vulnerability.
No vendor-released patch identified at time of analysis. Implement network firewall rules restricting access to HKUDS AutoAgent's command server port to authorized networks only; air-gap or isolate AutoAgent instances from untrusted networks; establish continuous monitoring for vendor patch releases and plan an urgent upgrade cycle upon availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB