CVE-2026-86124

AutoAgent contains an unauthenticated remote code execution vulnerability in the TCP server that binds to all interfaces and executes attacker-supplied commands as root. Attackers can connect to the exposed communication port and execute arbitrary bash commands within the container, gaining access to bind-mounted host workspace directories.

  • Published Sep 5, 2026
  • CVSS 9.3 critical
  • 1.0% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-86124 at the National Vulnerability Database