Executive brief
Cua computer-server is a remote control and execution service that allows operators to run commands and access files on machines. Versions before 0.3.42 disable authentication when a specific environment variable is unset, and the service listens on all network interfaces by default. Attackers can run arbitrary commands, read and write files, and obtain shell access without any credentials.
Technical details
The vulnerability is an authentication bypass in Cua computer-server caused by conditional authentication logic that depends on the CONTAINER_NAME environment variable. When this variable is unset, authentication is skipped entirely. The service binds to all interfaces (0.0.0.0) on TCP port 8000 by default, making it network-accessible. An unauthenticated attacker can exploit the run_command endpoint to execute arbitrary shell commands, use file operation endpoints to read and write files on the system, and access interactive PTY shells. No authentication credentials or user interaction is required; the attack vector is purely network-based. A patch is available in version 0.3.42 and later.
Affected products
- Cua computer-server before 0.3.42
Timeline
- 2026-09-05: disclosed