CVE-2026-58169

{
  "id": "CVE-2026-58169",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-30T17:16:23.907",
  "lastModified": "2026-10-25T21:10:00.770",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vibe-Trading before 0.1.10 contains a DNS rebinding authentication bypass vulnerability that allows remote attackers to bypass bearer-token authentication by exploiting the server's trust of TCP peer addresses for loopback clients combined with missing Host header validation while binding to 0.0.0.0 with credentialed CORS. Attackers can craft a malicious DNS rebinding page to issue authenticated requests to the local API server, reach the shell execution endpoint with a bash-enabled preset, and achieve remote code execution as the API process user while also overwriting LLM and data-source settings to exfiltrate credentials."
    },
    {
      "lang": "es",
      "value": "Vibe-Trading anterior a la versión 0.1.10 contiene una vulnerabilidad de omisión de autenticación por DNS rebinding que permite a atacantes remotos omitir la autenticación de token de portador al explotar la confianza del servidor en las direcciones de pares TCP para clientes de bucle invertido, combinado con la falta de validación del encabezado Host mientras se enlaza a 0.0.0.0 con CORS con credenciales. Los atacantes pueden crear una página maliciosa de DNS rebinding para emitir solicitudes autenticadas al servidor API local, alcanzar el punto final de ejecución de shell con un preajuste habilitado para bash, y lograr ejecución remota de código como el usuario del proceso de la API mientras también sobrescriben la configuración de LLM y de la fuente de datos para exfiltrar credenciales."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "HKUDS",
          "product": "Vibe-Trading",
          "defaultStatus": "unaffected",
          "repo": "https://github.com/HKUDS/Vibe-Trading",
          "packageURL": "pkg:github/HKUDS/Vibe-Trading",
          "versions": [
            {
              "version": "0",
              "lessThan": "0.1.10",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 7.7,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "PASSIVE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-01T14:35:29.884475Z",
          "id": "CVE-2026-58169",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-346"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/HKUDS/Vibe-Trading/pull/241",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/HKUDS/Vibe-Trading/pull/242",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/HKUDS/Vibe-Trading/pull/243",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/HKUDS/Vibe-Trading/pull/245",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/HKUDS/Vibe-Trading/pull/293",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/HKUDS/Vibe-Trading/releases/tag/v0.1.10",
      "source": "[email protected]"
    },
    {
      "url": "https://www.vulncheck.com/advisories/vibe-trading-loopback-trust-and-missing-host-validation-enable-dns-rebinding-authentication-bypass-and-remote-code-execution",
      "source": "[email protected]"
    }
  ]
}