Cua computer-server before 0.3.42 Unauthenticated RCE via Desktop Control
Cua computer-server versions before 0.3.42 skip authentication when the CONTAINER_NAME environment variable is unset and bind to all interfaces by default, allowing unauthenticated attackers to execute arbitrary commands. Attackers can reach TCP port 8000 to run shell commands via the run_command endpoint, read and write arbitrary files through file operation endpoints, and access interactive PTY shells without authentication.
CVE-2026-86121
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-86121
cua-computer-server
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/trycua/cua",
"vendor": "trycua",
"product": "cua-computer-server",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "0.3.42",
"versionType": "semver"
}
],
"packageURL": "pkg:pypi/cua-computer-server",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-86121
Source reference:
/cveMetadata/cveId
Publisher severity
critical
Source reference: /containers/cna/metrics
- Event
- #1582 · Revision 1
- Added to Heist Feed
- Publisher date