CVE-2026-86124

{
  "etk_id": "ETK-2026-498",
  "cve_id": "CVE-2026-86124",
  "display_id": "CVE-2026-86124",
  "ghsa_id": "GHSA-vmh4-qv5g-wc55",
  "euvd_id": "EUVD-2026-71956",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated command execution in AutoAgent TCP server",
  "summary": "AutoAgent's TCP server accepts commands without authentication when it is reachable over the network. An attacker able to connect to the exposed communication port can run commands as the container's root user and may reach bind-mounted workspace data.",
  "mitigation": "Block untrusted access to AutoAgent's TCP communication port and do not expose the service on publicly reachable interfaces. Run the container with reduced privileges and remove or restrict host workspace bind mounts while awaiting an upstream fix.",
  "vendor": "HKUDS",
  "product": "AutoAgent",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 16c12b052ef2330a198063c62a07a7f9723031e3"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "AutoAgent",
      "purl": null
    }
  ],
  "cwes": [
    306
  ],
  "cvss_score": 9.8,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0098,
  "epss_percentile": 0.6174,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 48.59584115,
  "t0_at": "2026-09-05T09:59:12.062000+00:00",
  "signals": {
    "kev": {
      "at": "2026-09-18T00:00:00+00:00",
      "days": 13,
      "is_lower_bound": false,
      "measured_at": "2026-09-05T09:59:12.062000+00:00",
      "precision": "day",
      "url": "https://vulncheck.com/cve/CVE-2026-86124"
    },
    "trigger_signal": {
      "at": "2026-09-18T00:00:00+00:00",
      "days": 12.583888171296296,
      "is_lower_bound": false,
      "measured_at": "2026-09-05T09:59:12.062000+00:00",
      "url": "https://vulncheck.com/cve/CVE-2026-86124"
    }
  }
}