CVE-2026-61613: Cursor Cloud Agent RCE Vulnerability

CVE-2026-61613 Overview

Cursor is a code editor built for programming with AI. CVE-2026-61613 affects browser-enabled Cursor Cloud Agent sessions prior to the 03/31/2026 fix. Attacker-controlled web content loaded inside the agent container can connect to an unauthenticated local agent endpoint. This missing authentication flaw [CWE-306] allows code execution inside the Cloud Agent sandbox. Attackers can access repository files, environment variables, credentials, and GitHub App access tokens tied to the session.

Critical Impact
Attacker-controlled browser content can pivot to a local unauthenticated endpoint inside the Cloud Agent, achieving code execution and exfiltration of source code, credentials, and GitHub App tokens.

Affected Products

Cursor Cloud Agent (browser-enabled sessions)
Cursor Cloud Agent sessions prior to the 03/31/2026 fix
Sessions with GitHub App access tokens available to the agent container

Discovery Timeline

03/31/2026 - Cursor releases fix requiring authentication on the affected agent endpoint
2026-07-15 - CVE-2026-61613 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-61613

Vulnerability Analysis

The vulnerability resides in the Cursor Cloud Agent architecture, which runs coding agents inside isolated containers. Browser-enabled sessions permit the agent to load external web content as part of its workflow. That web content executes inside the same container network namespace where a local agent endpoint listens without authentication.

The missing authentication check [CWE-306] on the local agent endpoint is the core defect. Any process or script capable of issuing HTTP requests to the loopback interface inside the container can invoke agent operations. Because the endpoint drives the coding agent itself, invocation translates directly into code execution in the sandbox.

The blast radius covers repository contents cloned into the session, environment variables holding secrets, and the GitHub App access tokens the agent uses to interact with source control. Refer to the GitHub Security Advisory for vendor detail.

Root Cause

The local agent endpoint accepted requests without verifying caller identity or origin. Trust was implicitly extended to any code running inside the container, ignoring that browser-enabled sessions render attacker-influenced web content in that same trust boundary.

Attack Vector

An attacker lures a Cursor Cloud Agent into loading a malicious page, or plants attacker-controlled content in a resource the agent visits. The page issues requests to the unauthenticated local endpoint. The endpoint executes attacker-directed operations, allowing exfiltration of files, secrets, and GitHub App tokens available to the session.

No verified exploit code is public. See the GitHub Security Advisory for technical detail.

Detection Methods for CVE-2026-61613

Indicators of Compromise

Unexpected outbound network connections from Cloud Agent containers to attacker-controlled domains
Anomalous requests to the loopback interface originating from browser processes inside the agent container
Unexplained GitHub App token usage or repository access outside normal agent workflows
Environment variable or credential access patterns that deviate from baseline agent behavior

Detection Strategies

Audit Cursor Cloud Agent session logs for browser-enabled sessions active before 03/31/2026
Review GitHub App audit logs for token usage that does not correlate with legitimate agent tasks
Correlate agent container network telemetry with expected coding-task destinations

Monitoring Recommendations

Enable verbose logging on Cloud Agent endpoints and forward events to a central data lake
Alert on any local HTTP calls to agent management endpoints from non-agent processes
Monitor GitHub repository events for unusual clones, pulls, or secret access tied to agent identities

How to Mitigate CVE-2026-61613

Immediate Actions Required

Confirm Cursor Cloud Agent instances are running builds released on or after 03/31/2026
Rotate GitHub App access tokens, repository secrets, and environment variables exposed to affected sessions
Review recent Cloud Agent sessions with browser features enabled for signs of misuse
Restrict which repositories and secrets are made available to Cloud Agent sessions

Patch Information

Cursor fixed the vulnerability on 03/31/2026 by requiring authentication on the affected agent endpoint. No user configuration change is required once the updated Cloud Agent is in use. Details are published in the GitHub Security Advisory GHSA-whx2-4gvm-m3r3.

Workarounds

Disable browser-enabled features in Cursor Cloud Agent sessions until the fix is confirmed deployed
Limit Cloud Agent access to repositories that do not contain production credentials or high-value secrets
Scope GitHub App installations to the minimum repositories and permissions required by the agent

bash

# Example: rotate a GitHub App installation token after suspected exposure
gh api -X POST /app/installations/<INSTALLATION_ID>/access_tokens