CVE-2026-86121

Name of the Vulnerable Software and Affected Versions Cua computer-server versions prior to 0.3.42

Description Authentication is bypassed when the CONTAINER NAME environment variable is unset, as the server binds to all interfaces by default. This allows unauthenticated attackers to execute arbitrary commands via the 'run command' endpoint, perform read and write operations on arbitrary files through file operation endpoints, and access interactive PTY shells.

Recommendations Update Cua computer-server to version 0.3.42 or later. Ensure the CONTAINER NAME environment variable is properly set to enable authentication.