CVE-2026-58169

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-58169
Vibe-Trading before 0.1.10 contains a DNS rebinding authentication bypass vulnerability that allows remote attackers to bypass bearer-token authentication by exploiting the server's trust of TCP peer addresses for loopback clients combined with missing Host header validation while binding to 0.0.0.0 with credentialed CORS. Attackers can craft a malicious DNS rebinding page to issue authenticated requests to the local API server, reach the shell execution endpoint with a bash-enabled preset, and achieve remote code execution as the API process user while also overwriting LLM and data-source settings to exfiltrate credentials.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/HKUDS/Vibe-Trading/pull/241
https://github.com/HKUDS/Vibe-Trading/pull/242
https://github.com/HKUDS/Vibe-Trading/pull/243
https://github.com/HKUDS/Vibe-Trading/pull/245
https://github.com/HKUDS/Vibe-Trading/pull/293
https://github.com/HKUDS/Vibe-Trading/releases/tag/v0.1.10
https://www.vulncheck.com/advisories/vibe-trading-loopback-trust-and-missing-host-validation-enable-dns-rebinding-authentication-bypass-and-remote-code-execution
Configurations

No configuration.

History

30 Jun 2026, 18:16

Type Values Removed Values Added
Summary (en) Vibe-Trading before 0.1.10's local API server trusts the TCP peer address to bypass the API_AUTH_KEY bearer-token check for loopback clients and performs no Host header validation, while binding to 0.0.0.0 with credentialed CORS by default. A DNS-rebinding web page can therefore issue authenticated requests to the local API as a trusted loopback client. Because loopback requests also auto-enable shell tools, an attacker can reach POST /swarm/runs with a built-in preset that permits the bash tool and achieve remote code execution as the API process user; the same bypass allows starting the live runner and overwriting LLM and data-source settings to redirect provider traffic and exfiltrate credentials. (en) Vibe-Trading before 0.1.10 contains a DNS rebinding authentication bypass vulnerability that allows remote attackers to bypass bearer-token authentication by exploiting the server's trust of TCP peer addresses for loopback clients combined with missing Host header validation while binding to 0.0.0.0 with credentialed CORS. Attackers can craft a malicious DNS rebinding page to issue authenticated requests to the local API server, reach the shell execution endpoint with a bash-enabled preset, and achieve remote code execution as the API process user while also overwriting LLM and data-source settings to exfiltrate credentials.

30 Jun 2026, 17:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-06-30 17:16

Updated : 2026-07-14 22:17

NVD link : CVE-2026-58169

Mitre link : CVE-2026-58169

CVE.ORG link : CVE-2026-58169

JSON object : View

Products Affected

No product.

CWE
CWE-346

Origin Validation Error