CVE-2026-58169: Vibe-Trading Auth Bypass Vulnerability

CVE-2026-58169 Overview

CVE-2026-58169 is a DNS rebinding authentication bypass vulnerability in Vibe-Trading versions before 0.1.10. The API server trusts TCP peer addresses for loopback clients and fails to validate the HTTP Host header while binding to 0.0.0.0 with credentialed CORS. Remote attackers can host a malicious page that rebinds a DNS record to the target's loopback address, then issue authenticated requests that bypass bearer-token authentication. The exploit chain reaches a shell execution endpoint with a bash-enabled preset, resulting in remote code execution as the API process user. Attackers can also overwrite LLM and data-source settings to exfiltrate credentials. This weakness is tracked under [CWE-346: Origin Validation Error].

Critical Impact
Unauthenticated remote code execution and credential exfiltration through a browser-driven DNS rebinding attack targeting the local Vibe-Trading API.

Affected Products

Vibe-Trading versions prior to 0.1.10
Deployments binding the API server to 0.0.0.0 with credentialed CORS enabled
Local development and self-hosted instances reachable by a user's browser

Discovery Timeline

2026-06-30 - CVE-2026-58169 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-58169

Vulnerability Analysis

The vulnerability chains three weaknesses in the Vibe-Trading API server. The server treats any connection whose TCP peer address is loopback as trusted, waiving bearer-token authentication. It also binds to 0.0.0.0, making the service reachable on all interfaces rather than only 127.0.0.1. Credentialed Cross-Origin Resource Sharing (CORS) is enabled, and the server never validates the incoming Host header. These conditions allow a browser controlled by an attacker to interact with the local API as if the request originated locally.

Root Cause

The root cause is improper origin validation [CWE-346]. Trust decisions are made on the TCP peer address rather than on cryptographic authentication of the caller. The server assumes loopback equals local user, but a browser resolving an attacker-controlled hostname to 127.0.0.1 also produces loopback traffic while carrying attacker-supplied payloads.

Attack Vector

An attacker registers a domain whose DNS record initially resolves to an attacker-controlled server, then rebinds to 127.0.0.1 after the victim loads the page. The victim's browser continues to treat the origin as same-origin under the rebound host. Malicious JavaScript then issues authenticated fetch calls to the Vibe-Trading API on the victim's loopback interface. The attacker reaches the shell execution endpoint using a bash-enabled preset to execute arbitrary commands. The attacker also overwrites LLM provider and data-source settings, redirecting API keys and secrets to attacker infrastructure.

No verified proof-of-concept code is published. Technical details are described in the VulnCheck Security Advisory and in the vendor fix pull requests.

Detection Methods for CVE-2026-58169

Indicators of Compromise

Unexpected child processes spawned by the Vibe-Trading API process, particularly bash, sh, curl, or wget.
HTTP requests to the Vibe-Trading API containing a Host header that does not match localhost or 127.0.0.1.
Outbound network connections from the API host to unfamiliar domains shortly after browser activity.
LLM provider or data-source configuration changes not initiated by an administrator.

Detection Strategies

Inspect API access logs for requests where the Host header contains an external domain but the peer address is loopback.
Alert on any invocation of the shell execution endpoint with the bash preset from browser-originated sessions.
Correlate configuration-change events for LLM and data-source settings with subsequent outbound traffic to new destinations.

Monitoring Recommendations

Enable process-lineage telemetry on hosts running Vibe-Trading and monitor for shell interpreters spawned by the API runtime.
Capture full HTTP request headers, including Host and Origin, in application logs for forensic review.
Monitor DNS resolutions from developer workstations for domains whose records TTL-flip between public and RFC1918 or loopback addresses.

How to Mitigate CVE-2026-58169

Immediate Actions Required

Upgrade Vibe-Trading to version 0.1.10 or later without delay.
Rotate any API keys, LLM provider tokens, and data-source credentials configured in vulnerable instances.
Restrict the API listener to 127.0.0.1 where remote access is not required.
Review recent shell execution endpoint activity and configuration changes for signs of exploitation.

Patch Information

The fix is delivered in Vibe-Trading v0.1.10. Relevant changes are tracked in Pull Request #241, Pull Request #242, Pull Request #243, Pull Request #245, and Pull Request #293. These patches add Host header validation, remove implicit loopback trust for authentication, and tighten CORS handling.

Workarounds

Bind the API server exclusively to 127.0.0.1 instead of 0.0.0.0 until upgrade is possible.
Place the service behind a reverse proxy that enforces strict Host header allowlisting.
Disable credentialed CORS or restrict allowed origins to an explicit allowlist rather than reflecting arbitrary origins.
Block outbound DNS resolutions to public domains that return loopback or private addresses using a filtering resolver.

bash

# Configuration example: bind API to loopback only
vibe-trading serve --host 127.0.0.1 --port 8000

# Reverse proxy Host header enforcement (nginx)
server {
    listen 127.0.0.1:8080;
    server_name localhost 127.0.0.1;

    if ($host !~* ^(localhost|127\.0\.0\.1)$) {
        return 421;
    }

    location / {
        proxy_pass http://127.0.0.1:8000;
        proxy_set_header Host $host;
    }
}