External risk intelligence

HKUDS Vibe-Trading Missing Authentication Allows Command Execution

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-114108

The vulnerability affects a FastAPI-based application that exposes web API endpoints, including message posting and file upload functions. As an internet-facing web service or API, such applications are commonly deployed in environments where they are reachable from the public internet.

Missing Authentication

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in HKUDS Vibe-Trading software that allows unauthenticated attackers to execute commands, upload files, and access sensitive information through its web interface. This issue arises from a failure to properly authenticate requests when a specific configuration key is not set. At a high level, this could enable unauthorized access and control over systems running this software.

Attackers can run commands remotely.
Leadership should know about remote command execution risks.
Confirm if this software is in use.

Attack Path

How an attacker could exploit the issue

An attacker can reach the vulnerable HKUDS Vibe-Trading application over the network and trigger a critical vulnerability due to a missing authentication check. This occurs when the API_AUTH_KEY is not set, allowing unauthenticated access to sensitive API functions. Once inside, attackers can execute commands, upload malicious scripts, and access sensitive information.

Entry condition: Network access, no authentication needed.
Trigger point: Posting to /sessions/{id}/messages endpoint.
Resulting risk: Root shell commands, file uploads, key exposure.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in HKUDS Vibe-Trading could allow unauthenticated attackers to execute root shell commands, upload arbitrary files, and access sensitive information like partial API keys when the API_AUTH_KEY is unset. The FastAPI surface is exposed, potentially impacting system integrity and confidentiality.

System commands and arbitrary files at risk.
Unauthenticated access to FastAPI endpoints.
Potential for unauthorized system control.

Operational Fix

Recommended remediation, mitigation, and detection steps

The HKUDS Vibe-Trading application, specifically versions before 0.1.7, presents a critical risk due to missing authentication. This vulnerability allows unauthenticated attackers to remotely execute commands, upload files, and access sensitive session data. Application owners and infrastructure teams should prioritize identifying all deployments of this software, confirming their exposure and business criticality, and then coordinate remediation efforts.

Application owners should manage the fix.
Verify external reachability and data exposure.
Plan remediation, considering vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is HKUDS Vibe-Trading?

HKUDS Vibe-Trading is a software application designed for trading-related tasks. It utilizes the FastAPI framework to provide web-based API endpoints, which enable core functions such as managing user sessions, processing messages, and handling file uploads. The software is designed to interact with backend tools, including scripts that can execute system-level commands, making it a functional environment for automated trading operations.

What does CVE-2026-114108 mean by missing authentication?

This vulnerability is classified as CWE-306, which refers to a failure to verify the identity of a user or system before granting access to protected functions. In this specific case, the software's authentication logic contains a flaw where it prematurely grants access if a specific configuration key is unset. Consequently, the application bypasses security checks, allowing any external actor to interact with administrative API endpoints as if they were a trusted, logged-in user.

How do attackers trigger this vulnerability?

An attacker triggers this flaw by interacting with the application's API without providing valid credentials. The primary precondition is that the software is running with the API_AUTH_KEY configuration missing or unset. If this key is missing, simply sending requests to sensitive endpoints—such as the message posting interface—is sufficient to exploit the bug. The vulnerability is not triggered if the authentication key is properly configured and enabled, as the security check would then function as intended.

Is my deployment vulnerable according to Halo Surface Signal?

Halo Surface Signal indicates that because this software uses a FastAPI interface for web communications, it is often deployed in ways that are reachable from the public internet. If your instance of HKUDS Vibe-Trading is configured to be internet-facing, it is significantly more likely to be reachable by unauthorized actors. Organizations should evaluate whether their specific deployment is exposed to external networks or if access is restricted to internal, authenticated environments.

How should I respond to this vulnerability?

The most urgent step is to verify if you are running a version of HKUDS Vibe-Trading earlier than 0.1.7. If your environment uses an affected version, the immediate priority is to update the software to version 0.1.7 or later, which addresses the authentication bypass. While planning the upgrade, ensure the API_AUTH_KEY is correctly set in your configuration to enforce authentication, and audit your network perimeter to ensure the application is not unnecessarily exposed.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.