EUVD-2026-71953
GHSA-pccw-h89v-h9cj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable API with authentication skipped by default and no user interaction yields PR:N/UI:N/AC:L; arbitrary command execution gives full C:H/I:H/A:H.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
4DescriptionCVE.org
Cua computer-server versions before 0.3.42 skip authentication when the CONTAINER_NAME environment variable is unset and bind to all interfaces by default, allowing unauthenticated attackers to execute arbitrary commands. Attackers can reach TCP port 8000 to run shell commands via the run_command endpoint, read and write arbitrary files through file operation endpoints, and access interactive PTY shells without authentication.
AnalysisAI
Unauthenticated remote code execution in Cua computer-server before 0.3.42 lets network attackers run arbitrary shell commands, read and write arbitrary files, and open interactive PTY shells on the host. The server skips authentication entirely when the CONTAINER_NAME environment variable is unset and, in vulnerable versions, binds to all interfaces (0.0.0.0) by default, so its control endpoints on TCP port 8000 are exposed to any reachable attacker. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two prerequisites, both met by the vulnerable default posture: (1) the CONTAINER_NAME environment variable is UNSET, which disables the server's authentication check, and (2) the server is reachable on TCP port 8000 - trivially true in versions before 0.3.42 because the default host bind was 0.0.0.0 (all interfaces). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3) is consistent with the description: network-reachable, no authentication, no user interaction, and full confidentiality/integrity/availability impact via arbitrary command execution. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Cua computer-server 0.3.42 or later, which changes the default bind address from 0.0.0.0 to 127.0.0.1 (fix commit 59cf25c0ec54). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Cua computer-server deployments and identify their versions; immediately restrict firewall inbound access to TCP port 8000 to only authorized administrative networks; set the CONTAINER_NAME environment variable on each instance to re-enable authentication requirements. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today