CVE-2026-86121: Cua Computer-Server Auth Bypass Vulnerability

CVE-2026-86121 Overview

Cua computer-server versions before 0.3.42 skip authentication when the CONTAINER_NAME environment variable is unset and bind to all network interfaces by default. This configuration exposes TCP port 8000 to unauthenticated network attackers. Remote attackers can invoke the run_command endpoint to execute arbitrary shell commands, read and write arbitrary files through file operation endpoints, and open interactive PTY shells. The flaw is classified as CWE-306: Missing Authentication for Critical Function and affects deployments of the Cua desktop control server used for computer-use agents.

Critical Impact

Unauthenticated remote attackers gain full remote code execution and arbitrary file read/write on any host running a vulnerable Cua computer-server reachable on the network.

Affected Products

• Cua computer-server versions prior to 0.3.42
• Deployments where the CONTAINER_NAME environment variable is unset
• Instances bound to the default host 0.0.0.0 on TCP port 8000

Discovery Timeline

• 2026-09-05 - CVE-2026-86121 published to the National Vulnerability Database
• 2026-09-08 - Last updated in NVD

Technical Details for CVE-2026-86121

Vulnerability Analysis

The Cua computer-server provides an HTTP API used by AI agents to control a host machine, including running shell commands, manipulating files, and driving interactive terminals. The server exposes these capabilities on TCP port 8000 through endpoints such as run_command, file operation routes, and PTY shell routes.

Authentication in the server is conditional. When the CONTAINER_NAME environment variable is not set, the authentication layer is skipped entirely. Combined with a default bind address of 0.0.0.0, any network-reachable host can invoke sensitive endpoints without credentials. The result is a direct path from unauthenticated network access to arbitrary command execution under the privileges of the server process.

Root Cause

Two defaults combine to produce the flaw. The authentication middleware treats an unset CONTAINER_NAME as a signal to disable authentication, and the server constructor and CLI both defaulted host to 0.0.0.0. Neither default fails safely, and there is no separate flag enforcing authentication on network-exposed listeners [CWE-306].

Attack Vector

An attacker with network access to port 8000 sends HTTP requests to the run_command endpoint to execute arbitrary shell commands, calls file operation endpoints to read or overwrite files on disk, or opens an interactive PTY session. No credentials, tokens, or user interaction are required. Exploitation succeeds against any vulnerable instance reachable across the network, including cloud VMs and developer workstations exposed to a LAN.

The upstream fix changes the default bind address from 0.0.0.0 to 127.0.0.1 in both the CLI and the server class:

         help="Auto-detect and log the actual screen resolution at startup",
     )
     parser.add_argument(
-        "--host", default="0.0.0.0", help="Host to bind the server to (default: 0.0.0.0)"
+        "--host",
+        default="127.0.0.1",
+        help="Host to bind the server to (default: 127.0.0.1; use 0.0.0.0 for external access)",
     )
     parser.add_argument(
         "--port", type=int, default=8000, help="Port to bind the server to (default: 8000)"

Source: GitHub commit 59cf25c0ec54 - cli.py

     def __init__(
         self,
-        host: str = "0.0.0.0",
+        host: str = "127.0.0.1",
         port: int = 8000,
         log_level: str = "info",
         ssl_keyfile: Optional[str] = None,

Source: GitHub commit 59cf25c0ec54 - server.py

Detection Methods for CVE-2026-86121

Indicators of Compromise

• Inbound TCP connections to port 8000 on hosts running Cua computer-server from unexpected source addresses.
• HTTP requests to paths associated with run_command, file read/write, or PTY endpoints originating from non-agent clients.
• Shell processes spawned by the computer-server Python process with command lines not initiated by an authorized agent.
• New or modified files under agent-controlled directories with timestamps that do not match legitimate agent activity.

Detection Strategies

• Inventory hosts running Cua computer-server and identify processes listening on 0.0.0.0:8000.
• Alert on any invocation of run_command or PTY endpoints from source IPs outside the approved agent network.
• Correlate child processes of the computer-server Python interpreter with HTTP request logs to identify command execution driven by unauthenticated callers.

Monitoring Recommendations

• Enable process-creation and network telemetry on hosts running the server and forward the events to a centralized analytics store.
• Monitor egress from computer-server hosts for reverse shell patterns, unusual outbound connections, or cloud metadata service access.
• Track the presence and value of the CONTAINER_NAME environment variable on server startup to catch misconfigured deployments.

How to Mitigate CVE-2026-86121

Immediate Actions Required

• Upgrade Cua computer-server to version 0.3.42 or later on every affected host.
• Restrict inbound access to TCP port 8000 at host firewalls and network ACLs so only trusted agent clients can connect.
• Set the CONTAINER_NAME environment variable in all deployments to ensure authentication is enforced.
• Audit running processes for evidence of unauthorized command execution during the exposure window.

Patch Information

The fix is included in Cua computer-server0.3.42. The patch changes the default host value in the CLI and the Server class from 0.0.0.0 to 127.0.0.1, preventing the server from listening on external interfaces unless an operator explicitly opts in. Details are available in the VulnCheck advisory, the upstream commit, and GitHub issue #1892.

Workarounds

• Explicitly start the server with --host 127.0.0.1 and reach it only through localhost or an authenticated tunnel.
• Set the CONTAINER_NAME environment variable before starting the server so the authentication layer is active.
• Place the server behind an authenticated reverse proxy or VPN and block direct external access to port 8000.

# Bind to loopback and enforce authentication via CONTAINER_NAME
export CONTAINER_NAME="cua-agent-01"
computer-server --host 127.0.0.1 --port 8000