PT-2026-53920 · Unknown · Vibe-Trading

Published 2026-06-30 · Updated 2026-06-30 · CVE-2026-58169

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vibe-Trading versions prior to 0.1.10

Description The local API server trusts the TCP peer address to bypass the API AUTH KEY bearer-token check for loopback clients and lacks Host header validation while binding to 0.0.0.0 with credentialed CORS by default. This allows a DNS-rebinding web page to issue authenticated requests to the local API as a trusted loopback client. Since loopback requests auto-enable shell tools, an attacker can access the 'POST /swarm/runs' endpoint using a built-in preset that permits the bash tool to achieve remote code execution as the API process user. Additionally, this bypass enables starting the live runner and overwriting LLM and data-source settings to redirect provider traffic and exfiltrate credentials.

Recommendations Update Vibe-Trading to version 0.1.10 or later.

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

CVE-2026-58169

Affected Products

Vibe-Trading

References · 8

• https://github.com/HKUDS/Vibe-Trading/pull/243 · Patch
• https://github.com/HKUDS/Vibe-Trading/pull/293 · Patch
• https://github.com/HKUDS/Vibe-Trading/pull/245 · Patch
• https://github.com/HKUDS/Vibe-Trading/pull/242 · Patch
• https://github.com/HKUDS/Vibe-Trading/pull/241 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-58169 · Security Note
• https://github.com/HKUDS/Vibe-Trading/releases/tag/v0.1.10 · Note
• https://vulncheck.com/advisories/vibe-trading-loopback-trust-and-missing-host-validation-enable-dns-rebinding-authentication-bypass-and-remote-code-execution · Note