Executive brief
AutoAgent is an LLM agent framework that exposes a TCP communication port. An unauthenticated attacker can connect to this exposed port from the network, execute arbitrary bash commands as the root user within the container, and access bind-mounted directories on the host system. This enables complete compromise of the container environment and potential host system access.
Technical details
AutoAgent contains an unauthenticated remote code execution vulnerability in its TCP server component that binds to all interfaces (0.0.0.0). The vulnerability exists because the server accepts and executes arbitrary bash commands without authentication or validation. An attacker on the network can connect to the exposed TCP port and inject malicious commands that execute with root privileges within the container. Since the container typically has bind-mounted host directories, an attacker gains read/write access to sensitive host filesystem locations. No authentication is required; the attack vector is purely network-based and requires only network connectivity to the exposed port.
Affected products
- HKUDS AutoAgent
Timeline
- 2026-09-05: disclosed