Critical severity9.8NVD Advisory· Published Oct 21, 2026

CVE-2026-114108

Description

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because require_auth() returns early when API_AUTH_KEY is unset. Attackers can post messages to /sessions/{id}/messages to trigger root shell commands via BashTool, upload .py or .sh files via /upload, read session histories, and obtain partial API keys.

Affected products

Hkuds/Vibe-Tradingllm-fuzzy
Range: <0.1.7

Patches

Vulnerability mechanics

References

github.com/HKUDS/Vibe-Trading/security/advisories/GHSA-v2f8-6655-7grjnvd
www.vulncheck.com/advisories/hkuds-vibe-trading-before-0.1.7-missing-authentication-in-fastapi-server-enabling-rcenvd

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000