All vulnerabilities
CVE-2026-114108GHSA-v2f8-6655-7grj

HKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCE

HKUDS Vibe-TradingPyPILibraries & packages
Open in ThreatlineRecord JSON
CVSS
9.3Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.36%Chance of exploitation activity in the next 30 days, higher than 28% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0.1.7Fixed versionCVE List
Published21 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 0.1.7Vibe-TradingCVE List
  • 0.1.7vibe-trading-ai, PyPIOSVpip install "vibe-trading-ai>=0.1.7"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because require_auth() returns early when API_AUTH_KEY is unset. Attackers can post messages to /sessions/{id}/messages to trigger root shell commands via BashTool, upload .py or .sh files via /upload, read session histories, and obtain partial API keys.

Text from CVE List

Affected versions 10

  • Vibe-Tradingaffected: 0.1.0 before 0.1.7CVE List
  • Vibe-Tradingunaffected: 0.1.7CVE List
  • vibe-trading-ai, PyPIfrom 0.1.0, fixed in 0.1.7OSV
  • vibe-trading-ai, PyPI0.1.0OSV
  • vibe-trading-ai, PyPI0.1.1OSV
  • vibe-trading-ai, PyPI0.1.2OSV
  • vibe-trading-ai, PyPI0.1.3OSV
  • vibe-trading-ai, PyPI0.1.4OSV
  • vibe-trading-ai, PyPI0.1.5OSV
  • vibe-trading-ai, PyPI0.1.6OSV

References 2