Cua Computer-Server Unauthenticated Remote Command Execution

Technical Analysis

The vulnerability stems from insecure default behavior in computer-server: when CONTAINER_NAME is not explicitly set, the authentication check is silently skipped and the server binds to 0.0.0.0 rather than a restricted interface. Attackers with network access to TCP port 8000 can invoke the run_command endpoint to execute arbitrary OS commands, use file operation endpoints for arbitrary file read/write, and spawn interactive PTY sessions—effectively equivalent to unauthenticated root-level shell access. The 9.8 CVSS score reflects the trivial exploitability (no authentication, no user interaction) combined with complete compromise of confidentiality, integrity, and availability. Cua's computer-server component is specifically designed as a backend for AI computer-use agents that control virtual desktops/containers, meaning organizations running autonomous AI agents via Cua are directly exposed to full takeover of the agent's execution environment, including any credentials, API keys, or tool-access tokens present on that host, making this a severe and directly agent-relevant threat.

Affected Systems

Cua computer-server versions prior to 0.3.42; deployments where the CONTAINER_NAME environment variable is unset, particularly containerized or VM-based agent execution backends exposing TCP port 8000 to untrusted networks

Indicators of Compromise

• Unexpected inbound connections to TCP port 8000
• Unauthenticated HTTP/API requests to run_command endpoint
• Unauthenticated HTTP/API requests to file read/write endpoints
• Unexpected PTY shell sessions spawned on computer-server hosts
• Process execution originating from computer-server without corresponding authenticated session logs

Remediation Steps

1. 1

   Upgrade computer-server

   Update Cua computer-server to version 0.3.42 or later, which enforces authentication regardless of CONTAINER_NAME configuration state.

2. 2

   Set CONTAINER_NAME explicitly

   Ensure the CONTAINER_NAME environment variable is always explicitly set in all deployment configurations as a compensating control until upgrade is complete.

3. 3

   Restrict network exposure

   Bind computer-server to localhost or internal-only interfaces, and use firewall rules or security groups to block external access to TCP port 8000.

4. 4

   Audit for compromise

   Review logs for unauthenticated access to run_command, file operation, and PTY endpoints, and rotate any credentials or API keys that may have resided on affected hosts.

5. 5

   Network segmentation for agent infrastructure

   Isolate AI agent execution backends (Cua, similar computer-use frameworks) on segmented networks with strict ingress controls to limit blast radius from similar future vulnerabilities.