Two AI Agent Control Servers Exposed Unauthenticated Command Execution

2026-09-16 AI Vulnerabilities & CVEs by al-ice.ai Editorial

Two critical CVEs published September 5 expose the same dangerous assumption in different agent stacks: a command service intended to connect an AI agent to its execution environment was treated as internal, then made reachable without authentication.

CVE-2026-86121 affects Cua’s cua-computer-server before 0.3.42. In its default local mode, the service listened on all interfaces and accepted command, file, desktop, and terminal operations without credentials. CVE-2026-86124 affects HKUDS AutoAgent through the repository’s current commit: its Docker sandbox publishes a raw TCP command server to the host network, runs it as root inside the container, and mounts the host workspace into that container.

Both records are classified as CWE-306, Missing Authentication for Critical Function. VulnCheck assigned each a 9.3 CVSS 4.0 score and a 9.8 CVSS 3.1 score. Those ratings describe a network-reachable, low-complexity path with no privileges or user interaction. Actual exposure still depends on routing: an attacker must be able to reach the relevant listener. Neither record establishes exploitation in the wild.

Cua turned “local development mode” into an allow-all policy

Cua’s computer server is not a narrow inference endpoint. It is the control plane through which an agent can execute shell commands, read and write files, capture the screen, drive keyboard and mouse input, and open an interactive pseudo-terminal. Before 0.3.42, both the command-line entry point and server constructor defaulted to 0.0.0.0 on TCP port 8000.

The corresponding authentication logic depended on the CONTAINER_NAME environment variable. If that variable was present, requests had to supply the expected container identity and API key. If it was absent—the project’s local or standalone mode—the server returned success from its authentication check and proceeded without a token. The result was not merely an authentication bypass on one helper: the same trust decision guarded shell execution, unrestricted file operations, WebSocket control, and PTY endpoints.

That combination made a developer convenience remotely consequential. A process bound to all interfaces can be reached from the same LAN, a peer container, a VM network, or a cloud security group that exposes the port. Commands then run with the computer-server process’s operating-system privileges. The CVE does not imply an automatic sandbox escape or host-root access; those consequences depend on where the service runs, its account, and which host paths or credentials are available.

Cua 0.3.42 reduces reachability rather than authenticating local mode

The patch referenced by the CVE changes the default listener in the CLI and server constructor from 0.0.0.0 to 127.0.0.1. Documentation now requires an explicit --host 0.0.0.0 when external clients need access. The fix landed in the repository on June 18, and the 0.3.42 package was uploaded to PyPI on June 24—well before the CVE record was published. The current PyPI release at publication is 0.3.46.

This is a meaningful safe-default repair: a remote client can no longer reach a standard installation merely because the host is routable. It is not equivalent to authenticated transport. Operators who deliberately expose the listener still need an independent authenticated tunnel or network policy and should not infer authorization from the loopback default. Loopback also does not make every browser- or local-process threat disappear.

Upgrade cua-computer-server to at least 0.3.42, preferably the current supported release. Then verify the effective bind address rather than only the package version. Search process arguments, container manifests, service units, and startup scripts for --host 0.0.0.0, published port 8000 mappings, or reverse proxies that make a loopback service externally reachable.

AutoAgent publishes the sandbox’s shell channel to the network

AutoAgent’s vulnerable path is more direct. Its tcp_server.py binds to 0.0.0.0, accepts bytes from a client, inserts the received text into a Bash command, and launches it with shell=True. There is no token, signature, peer identity, or command allowlist in the protocol.

The Docker launcher compounds that design. It starts the container as root, bind-mounts the local workspace, and uses a Docker publish argument of the form -p host-port:container-port without a host IP. Docker therefore exposes the port on the host’s interfaces rather than restricting it to loopback. The default communication port is 12347. A reachable client can execute commands as root inside the container and read or modify the host workspace through the bind mount.

Container root is not automatically host root. The immediate host impact documented by the record is the mounted workspace, not a demonstrated container escape. That boundary can still carry source code, environment files, SSH material copied into a project, generated artifacts, and CI configuration. Modifying those files also creates a delayed supply-chain path: a poisoned commit, build script, dependency manifest, or agent instruction can execute later under a more privileged developer or pipeline identity.

The public issue also identifies a separate unauthenticated FastAPI service that can expose tools and agents on port 8000 when started. That observation is part of the reporter’s broader analysis, not the narrow description in CVE-2026-86124, which covers the sandbox TCP command server.

AutoAgent has no published remediation floor

The AutoAgent case requires more caution than a routine “upgrade now” notice. Its repository’s default branch still ends at commit 16c12b052ef2330a198063c62a07a7f9723031e3, the upper bound named as affected in the CVE record. The repository has not advanced since October 16, 2025; the disclosure issue remains open; and the project has no GitHub releases. Inspection of the current files still shows the all-interface bind, unauthenticated command receive loop, root container user, host workspace mount, and unrestricted Docker port publication.

There is therefore no verified fixed AutoAgent release to recommend at publication. Stop affected deployments or isolate them until a reviewed repair exists. A defensible patch needs more than changing one bind address: publish the port only on loopback or a private Docker network, authenticate every connection with a high-entropy per-run credential, avoid shell interpolation, run as a non-root user, constrain mounts, and bind the command to a specific sandbox instance and lifetime. The unauthenticated FastAPI surface should be assessed separately.

What defenders should do now

Inventory listeners, not just packages. Look for cua-computer-server, AutoAgent, TCP ports 8000 and 12347, Docker port publications, and processes listening on 0.0.0.0. Confirm exposure from the network segments that matter.
Patch Cua and review overrides. Move to Cua computer-server 0.3.42 or later. Remove external bind flags unless required; if remote control is necessary, place it behind mutually authenticated transport and explicit source restrictions.
Quarantine AutoAgent’s command channel. Do not expose its published communication port. Existing deployments should be stopped or firewalled while the code is patched locally or replaced. Merely restricting the agent’s model permissions does not protect this non-model TCP path.
Rotate what the execution environment could read. Inspect mounted workspaces and the server account’s filesystem access for API keys, cloud credentials, package tokens, SSH keys, and environment files. Rotate exposed secrets based on reachability and logs, not on proof that a malicious command was captured.
Hunt for filesystem effects. Review shell histories where available, container logs, Docker events, network-flow records, new processes, changed workspace files, Git diffs, CI definitions, agent instruction files, and unexpected outbound connections during the exposure window.
Separate agent intent from executor authorization. The service receiving an agent action must authenticate the caller, authorize the operation, constrain paths and commands, and log the result. A private-sounding component name such as “sandbox” or “computer server” is not a security boundary.
Test the deployed topology. Validate the final bind address, container network, proxy, host firewall, and cloud ingress after changes. Secure source defaults can be undone by a compose file, Kubernetes Service, development tunnel, or explicit 0.0.0.0 override.

These CVEs are a reminder that agent security can fail below the model layer. Prompt-injection defenses, tool approvals, and model refusals do nothing when the executor itself accepts unauthenticated network commands. The same pattern appeared in the Ruflo MCP bridge’s unauthenticated shell and in an AWS MCP policy gate that could fail open: the control plane around an agent needs conventional authentication, least privilege, network isolation, and fail-closed behavior before any AI-specific safeguard matters.

Sources: