EUVD-2026-71956
GHSA-vmh4-qv5g-wc55
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, no auth and no interaction (AV:N/AC:L/PR:N/UI:N); root exec plus reach into bind-mounted host workspace crosses the container boundary, justifying S:C with full C/I/A.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
AutoAgent contains an unauthenticated remote code execution vulnerability in the TCP server that binds to all interfaces and executes attacker-supplied commands as root. Attackers can connect to the exposed communication port and execute arbitrary bash commands within the container, gaining access to bind-mounted host workspace directories.
AnalysisAI
Unauthenticated remote code execution in HKUDS AutoAgent's sandbox environment allows any network-reachable attacker to run arbitrary bash commands as root. The framework's TCP command server binds to all interfaces (0.0.0.0) and executes received commands with no authentication, so attackers who reach the port gain root inside the agent container and can read or tamper with bind-mounted host workspace directories. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only that the AutoAgent sandbox TCP command server (from docker_env.py/tcp_server.py) be running and its port reachable from the attacker - the server binds to all interfaces (0.0.0.0) and performs no authentication, so a plain TCP connection is sufficient to execute root bash commands. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue, not a paper CVSS score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified at time of analysis; the disclosure is tracked in GitHub issue #96 and the VulnCheck advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: immediately identify all HKUDS AutoAgent instances and determine their network exposure, particularly whether the TCP command server port is reachable from untrusted networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today