CVE-2026-86124: AutoAgent Unauthenticated RCE Vulnerability

CVE-2026-86124 Overview

AutoAgent, an open-source AI agent framework from HKUDS, contains an unauthenticated remote code execution vulnerability in its sandbox TCP command server. The server binds to all network interfaces and executes attacker-supplied bash commands as root inside the container. Attackers with network reachability to the exposed port can run arbitrary commands and reach bind-mounted host workspace directories. The issue is tracked under CWE-306: Missing Authentication for a Critical Function and is documented in the VulnCheck Advisory for AutoAgent.

Critical Impact

Unauthenticated attackers can execute arbitrary commands as root inside the AutoAgent container and access bind-mounted host directories.

Affected Products

• HKUDS AutoAgent framework (see GitHub AutoAgent Project)
• AutoAgent Docker environment component (docker_env.py)
• AutoAgent sandbox TCP command server (tcp_server.py)

Discovery Timeline

• 2026-09-05 - CVE-2026-86124 published to NVD
• 2026-09-05 - Last updated in NVD database

Technical Details for CVE-2026-86124

Vulnerability Analysis

AutoAgent ships a sandbox container that exposes a TCP command server used by the agent runtime to execute shell commands. The server listens on all interfaces (0.0.0.0) and processes incoming command strings without authentication, authorization, or origin checks. Any client that can reach the port receives a shell inside the container running as root. Because AutoAgent bind-mounts host workspace directories into the container, attackers can read, modify, and stage files on the host through the compromised container. Refer to the VulnCheck Advisory for AutoAgent and GitHub Issue #96 for the maintainer discussion.

Root Cause

The sandbox TCP server implements a critical command-execution function without any authentication layer, which maps to [CWE-306]. The container is launched with a permissive bind configuration and the command handler passes received payloads directly to a shell executor. Combined, these design decisions eliminate the trust boundary between the AutoAgent host and any network-adjacent client.

Attack Vector

Exploitation requires only network access to the port bound by the AutoAgent sandbox container. An attacker opens a TCP socket to the exposed service, sends a bash command string, and receives command output. Because execution occurs as root within the container and host directories are bind-mounted, an attacker can pivot to host file contents, exfiltrate secrets from the workspace, poison agent inputs and outputs, or plant persistence artifacts.

No proof-of-concept exploit code is being reproduced here. Consult the GitHub TCP Server Script and the GitHub Docker Environment Script for the vulnerable code paths.

Detection Methods for CVE-2026-86124

Indicators of Compromise

• Unexpected inbound TCP connections to the AutoAgent sandbox command port from non-loopback source addresses.
• Root-owned processes spawned inside the AutoAgent container that were not initiated by the agent runtime.
• New or modified files in bind-mounted workspace directories that do not correlate to a legitimate agent task.
• Outbound network connections initiated from inside the AutoAgent container to unknown hosts.

Detection Strategies

• Inspect running AutoAgent containers for listening sockets bound to 0.0.0.0 on the sandbox command port.
• Correlate shell process creation events inside the container with the parent AutoAgent process to flag out-of-band commands.
• Alert on any external client establishing a session with the sandbox TCP port; only loopback traffic should be expected.

Monitoring Recommendations

• Enable container runtime logging and forward process, network, and file-system events to a central analytics tier for review.
• Monitor host firewall counters and connection tables for traffic to the AutoAgent sandbox port from outside the host.
• Baseline the workspace directory contents and alert on writes performed by container UID 0 outside expected agent workflows.

How to Mitigate CVE-2026-86124

Immediate Actions Required

• Restrict the AutoAgent sandbox TCP port to 127.0.0.1 using Docker port mapping or host firewall rules so it is not reachable from other hosts.
• Isolate any AutoAgent deployment from untrusted networks until an upstream fix is available.
• Remove or minimize host bind mounts into the AutoAgent container to limit blast radius if the sandbox is compromised.
• Rotate credentials, tokens, and API keys that were accessible from mounted workspace directories.

Patch Information

At the time of publication, no fixed release is referenced in the NVD entry. Track upstream progress in GitHub Issue #96 and the GitHub AutoAgent Project for a maintainer-issued patch. Review the VulnCheck Advisory for AutoAgent for the latest status.

Workarounds

• Bind the sandbox listener to loopback only by modifying the container run configuration to publish the port as 127.0.0.1:<port>:<port>.
• Place the container on an internal Docker network with no external port publishing and require agent traffic to originate from the same host.
• Add a host firewall rule that drops inbound traffic to the sandbox port from all sources other than the local host.
• Run AutoAgent on a dedicated host with no sensitive data mounted and treat the container as untrusted.

# Configuration example: publish the sandbox port to loopback only
docker run --rm \
  -p 127.0.0.1:<sandbox_port>:<sandbox_port> \
  -v /path/to/isolated/workspace:/workspace \
  autoagent:latest

# Host firewall example (iptables): block non-local access to the sandbox port
iptables -A INPUT -p tcp --dport <sandbox_port> ! -s 127.0.0.1 -j DROP