CVE-2026-86124

AutoAgent ships a TCP communication server that performs actions without any authentication (CWE-306), binding to all interfaces and executing attacker-supplied input as commands. Any attacker who can reach the exposed port over the network can connect directly and submit arbitrary bash commands, which the server runs as root inside the deployment container. Because the container runs as root, the attacker gains full control of the AutoAgent environment and can read and modify host workspace directories that are bind-mounted into the container. Anyone running AutoAgent with its communication port reachable from untrusted networks — particularly internet-exposed deployments — is affected. Exploitation has not yet been reported: the flaw carries a critical CVSS 4.0 score of 9.3, but EPSS is only 0.5%, it is not in CISA KEV, and no public proof-of-concept is known.

What to do: Restrict exposure of the AutoAgent TCP communication port — bind it to localhost or firewall it to trusted hosts only, since no authentication is required to run commands as root. Check the project's repository for a patched release and upgrade as soon as a fixed version is published. Audit bind-mounted host workspace directories for unexpected changes, since successful exploitation grants root-level read/write access to them from inside the container.