CVE-2026-86121CWE-306

CVE-2026-86121

Critical · published September 5, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
65.8
In the wild
Unconfirmed
What it is

Cua computer-server versions before 0.3.42 skip authentication when the CONTAINER_NAME environment variable is unset and bind to all interfaces by default, allowing unauthenticated attackers to execute arbitrary commands. Attackers can reach TCP port 8000 to run shell commands via the run_command endpoint, read and write arbitrary files through file operation endpoints, and access interactive PTY shells without authentication.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.01116 · 65.8th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-09-05T14:16Z
References (7)
https://github.com/trycua/cua · [email protected]https://github.com/trycua/cua/blob/10a2e71792db/libs/python/computer-server/computer_server/cli.py · [email protected]https://github.com/trycua/cua/blob/10a2e71792db/libs/python/computer-server/computer_server/main.py · [email protected]https://github.com/trycua/cua/commit/59cf25c0ec54 · [email protected]https://github.com/trycua/cua/issues/1892 · [email protected]https://www.vulncheck.com/advisories/cua-computer-server-before-0.3.42-unauthenticated-rce-via-desktop-control · [email protected]https://github.com/trycua/cua/issues/1892 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 07 SEP 03:36Z
    EPSS moved — → 1%
    epss
  • 05 SEP 09:59Z
    Cua computer-server before 0.3.42 Unauthenticated RCE via Desktop Control
    cvelistv5