Exposed now
AutoAgent’s sandbox hands a shell to anyone who can reach the port, and there is no patch
AutoAgent binds its command server to every network interface, with no authentication step anywhere in the file. What arrives on the socket is passed into a bash call. CVE-2026-86124 scores it 9.3 against a maximum of 10 on the version 4 scale. On the older version 3.1 scale it scores 9.8 against that same maximum, under CWE-306, missing authentication for a critical function.
The flaw is present at the current tip of the repository.
AutoAgent has no tagged releases at all, so there is no fixed version to move to and no version range to check yourself against: the project ships from main, and the commit the CVE names as vulnerable is the commit main points at today. The vendor has published no advisory and no mitigation. The mechanism is two files, autoagent/environment/tcp_server.py and a near-identical copy at autoagent/tcp_server.py, where line 17 binds the listener and the received bytes are substituted into a shell string a few lines below.
One widely-repeated detail does not hold up. A threat-intelligence aggregator reported this as added to CISA’s Known Exploited Vulnerabilities catalogue on 5 September, which would mean CISA had evidence of exploitation in the wild. We searched the catalogue’s own feed, all 1,695 entries of it, and matched none against this CVE. No exposure count exists in any verifiable form either, so treat the severity as the severity of the bug and not as evidence anyone has used it.
What it changes If you are running AutoAgent, bind the command port to localhost or firewall it now, and unmount any host directory you passed into the container. There is nothing to upgrade to.
Whether the shell runs as root is corroborated by the CVE’s impact metrics and by typical container defaults, but is not proven by the source file itself. No evidence of exploitation was found.
Primary source read