Cursor Cloud Agent EUVD-2026-44674

Exploitation requires a Cursor Cloud Agent session running in browser-enabled mode (the web-browsing capability must be active) and the agent must load attacker-controlled web content, which then connects from inside the agent container to the unauthenticated local agent endpoint. No authentication is needed at that endpoint (PR:N, CWE-306), but exploitation is limited by several factors: the target must be using the browser-enabled Cloud Agent feature (a specific, non-universal deployment mode), passive user interaction is required to bring the malicious content into the session (UI:P), and there is an attack requirement (AT:P) beyond a plain single request. Impact is confined to the resources of that one session/sandbox - its files, repository contents, environment variables, credentials, and GitHub App tokens - with only low subsequent-system impact. Sessions created after the 03/31/2026 server-side fix are not exploitable.

The CVSS 4.0 base score is 7.7 (High) with vector AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L: network reachable and unauthenticated (PR:N) with full high impact to the vulnerable session, but tempered by an attack requirement (AT:P) and passive user interaction (UI:P) - the victim must be running a browser-enabled agent session that loads the attacker's content, so this is not a fire-and-forget internet-wide exploit. No EPSS score, KEV entry, or POC was supplied in the intelligence, so real-world exploitation probability cannot be quantified from the data; the RCE and Authentication Bypass tags describe capability, not observed activity. Net: a genuinely serious issue for anyone who used browser-enabled Cloud Agent sessions (credential and token theft is high-value), but the required non-default browsing context and user-driven session setup make opportunistic mass exploitation unlikely versus targeted abuse. Because the fix was deployed server-side by the vendor on 03/31/2026, residual risk to current users is low; the primary concern is retrospective compromise of sessions active before that date.

An attacker plants malicious content on a web page (or a page the agent is likely to be pointed at) and a developer runs a browser-enabled Cursor Cloud Agent task that loads it; the page's content connects to the unauthenticated local agent endpoint inside the container and executes commands. The attacker then reads the cloned repository, environment variables, and the session's GitHub App access token and exfiltrates them. No public POC was provided, and the passive user-interaction requirement (UI:P) means the victim must be running such a session for the chain to fire.