Cua computer-server Vulnerability: Critical Authentication Bypass
EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- cua computer-server (npm)
- Affected versions
- >= cua-driver-rs-v0.6.3, <= cua-driver-rs-v0.6.3 or >= cli-v0.1.12, <= cli-v0.1.12 or >= bench-v0.2.11, <= bench-v0.2.11 or >= agent-v0.8.4, <= agent-v0.8.4 or >= cua-driver-rs-v0.6.7, <= cua-driver-rs-v0.6.7 or >= cua-driver-rs-v0.6.6, <= cua-driver-rs-v0.6.6 or >= cua-driver-rs-v0.6.5, <= cua-driver-rs-v0.6.5 or >= cua-driver-rs-v0.6.4, <= cua-driver-rs-v0.6.4 or >= cua-driver-rs-v0.6.2, <= cua-driver-rs-v0.6.2 or >= cua-driver-rs-v0.6.1, <= cua-driver-rs-v0.6.1 or >= agent-v0.8.3, <= agent-v0.8.3 or >= cua-driver-rs-v0.6.0, <= cua-driver-rs-v0.6.0 or >= cua-driver-rs-v0.5.8, <= cua-driver-rs-v0.5.8 or >= computer-v0.5.19, <= computer-v0.5.19 or >= cua-driver-rs-v0.5.7, <= cua-driver-rs-v0.5.7 or >= cua-driver-rs-v0.5.6, <= cua-driver-rs-v0.5.6 or >= train-v0.1.1, <= train-v0.1.1 or >= computer-server-v0.3.41, <= computer-server-v0.3.41 or >= cua-driver-rs-v0.5.5, <= cua-driver-rs-v0.5.5 or >= cua-driver-rs-v0.5.4, <= cua-driver-rs-v0.5.4 or >= computer-server-v0.3.40, <= computer-server-v0.3.40 or >= cua-driver-rs-v0.5.3, <= cua-driver-rs-v0.5.3 or >= lume-v0.3.10, <= lume-v0.3.10 or >= cua-driver-rs-v0.5.2, <= cua-driver-rs-v0.5.2 or >= cua-driver-rs-v0.5.1, <= cua-driver-rs-v0.5.1 or >= cua-driver-rs-v0.5.0, <= cua-driver-rs-v0.5.0 or >= cua-driver-rs-v0.4.3, <= cua-driver-rs-v0.4.3 or >= cua-driver-rs-v0.4.2, <= cua-driver-rs-v0.4.2 or >= cua-driver-rs-v0.4.1, <= cua-driver-rs-v0.4.1 or >= cua-driver-rs-v0.4.0, <= cua-driver-rs-v0.4.0 or >= cua-driver-rs-v0.3.6, <= cua-driver-rs-v0.3.6 or >= cua-driver-rs-v0.3.5, <= cua-driver-rs-v0.3.5 or >= cua-driver-rs-v0.3.4, <= cua-driver-rs-v0.3.4 or >= cua-driver-rs-v0.3.3, <= cua-driver-rs-v0.3.3 or >= cua-driver-rs-v0.3.2, <= cua-driver-rs-v0.3.2 or >= cua-driver-rs-v0.3.1, <= cua-driver-rs-v0.3.1 or >= cua-driver-rs-v0.3.0, <= cua-driver-rs-v0.3.0 or >= cua-driver-rs-v0.2.18, <= cua-driver-rs-v0.2.18 or >= cua-driver-rs-v0.2.17, <= cua-driver-rs-v0.2.17 or >= cua-driver-rs-v0.2.16, <= cua-driver-rs-v0.2.16 or >= cua-driver-rs-v0.2.15, <= cua-driver-rs-v0.2.15 or >= cua-driver-rs-v0.2.14, <= cua-driver-rs-v0.2.14 or >= cua-driver-rs-v0.2.13, <= cua-driver-rs-v0.2.13 or >= cua-driver-rs-v0.2.12, <= cua-driver-rs-v0.2.12 or >= cua-driver-rs-v0.2.11, <= cua-driver-rs-v0.2.11 or >= cua-driver-rs-v0.2.10, <= cua-driver-rs-v0.2.10 or >= cua-driver-rs-v0.2.9, <= cua-driver-rs-v0.2.9 or >= cua-driver-rs-v0.2.8, <= cua-driver-rs-v0.2.8 or >= cua-driver-rs-v0.2.7, <= cua-driver-rs-v0.2.7 or >= cua-driver-rs-v0.2.6, <= cua-driver-rs-v0.2.6 or >= cua-driver-rs-v0.2.5, <= cua-driver-rs-v0.2.5 or >= cua-driver-rs-v0.2.4, <= cua-driver-rs-v0.2.4 or >= cua-driver-rs-v0.2.3, <= cua-driver-rs-v0.2.3 or >= cua-driver-rs-v0.2.2, <= cua-driver-rs-v0.2.2 or >= cua-driver-rs-v0.2.1, <= cua-driver-rs-v0.2.1 or >= cua-driver-v0.2.0, <= cua-driver-v0.2.0 or >= cua-driver-rs-v0.2.0, <= cua-driver-rs-v0.2.0 or >= cua-driver-rs-v0.1.4, <= cua-driver-rs-v0.1.4 or >= cua-driver-rs-v0.1.3, <= cua-driver-rs-v0.1.3 or >= cua-driver-v0.1.9, <= cua-driver-v0.1.9 or >= cua-driver-v0.1.8, <= cua-driver-v0.1.8 or >= cua-driver-v0.1.7, <= cua-driver-v0.1.7 or >= cua-driver-v0.1.6, <= cua-driver-v0.1.6 or >= cua-driver-v0.1.5, <= cua-driver-v0.1.5 or >= cua-driver-v0.1.4, <= cua-driver-v0.1.4 or >= cua-driver-v0.1.3, <= cua-driver-v0.1.3 or >= cua-driver-v0.1.2, <= cua-driver-v0.1.2 or >= cua-driver-v0.1.1, <= cua-driver-v0.1.1 or >= cua-driver-v0.1.0, <= cua-driver-v0.1.0 or >= cua-driver-v0.0.15, <= cua-driver-v0.0.15 or >= cua-driver-v0.0.14, <= cua-driver-v0.0.14 or >= cua-driver-v0.0.13, <= cua-driver-v0.0.13 or >= cua-driver-v0.0.12, <= cua-driver-v0.0.12 or >= cua-driver-v0.0.11, <= cua-driver-v0.0.11 or >= cua-driver-v0.0.10, <= cua-driver-v0.0.10 or >= cua-driver-v0.0.9, <= cua-driver-v0.0.9 or >= cua-driver-v0.0.8, <= cua-driver-v0.0.8 or >= cua-driver-v0.0.7, <= cua-driver-v0.0.7 or >= cua-driver-v0.0.6, <= cua-driver-v0.0.6 or >= cua-driver-v0.0.5, <= cua-driver-v0.0.5 or >= cua-driver-v0.0.4, <= cua-driver-v0.0.4 or >= cua-driver-v0.0.3, <= cua-driver-v0.0.3 or >= cua-driver-v0.0.2, <= cua-driver-v0.0.2 or >= sandbox-v0.1.16, <= sandbox-v0.1.16 or >= sandbox-v0.1.15, <= sandbox-v0.1.15 or >= sandbox-v0.1.14, <= sandbox-v0.1.14 or >= computer-server-v0.3.39, <= computer-server-v0.3.39 or >= sandbox-v0.1.13, <= sandbox-v0.1.13 or >= computer-server-v0.3.38, <= computer-server-v0.3.38 or >= computer-server-v0.3.37, <= computer-server-v0.3.37 or >= computer-server-v0.3.36, <= computer-server-v0.3.36 or >= cli-v0.1.11, <= cli-v0.1.11 or >= computer-server-v0.3.35, <= computer-server-v0.3.35 or >= computer-server-v0.3.34, <= computer-server-v0.3.34 or >= cli-v0.1.10, <= cli-v0.1.10 or >= bench-v0.2.10, <= bench-v0.2.10 or >= agent-v0.8.2, <= agent-v0.8.2 or >= core-v0.3.1, <= core-v0.3.1 or >= cli-v0.1.9, <= cli-v0.1.9 or >= cua-v0.1.6, <= cua-v0.1.6 or >= computer-server-v0.3.33, <= computer-server-v0.3.33 or >= computer-v0.5.18, <= computer-v0.5.18 or >= bench-v0.2.9, <= bench-v0.2.9 or >= sandbox-v0.1.12, <= sandbox-v0.1.12 or >= agent-v0.8.1, <= agent-v0.8.1 or >= core-v0.3.0, <= core-v0.3.0 or >= cua-v0.1.5, <= cua-v0.1.5 or >= sandbox-v0.1.11, <= sandbox-v0.1.11 or >= agent-v0.8.0, <= agent-v0.8.0 or >= core-v0.2.0, <= core-v0.2.0 or >= sandbox-apps-v0.1.1, <= sandbox-apps-v0.1.1 or >= sandbox-v0.1.10, <= sandbox-v0.1.10 or >= sandbox-v0.1.9, <= sandbox-v0.1.9 or >= computer-server-v0.3.32, <= computer-server-v0.3.32 or >= computer-server-v0.3.31, <= computer-server-v0.3.31 or >= computer-server-v0.3.30, <= computer-server-v0.3.30 or >= computer-server-v0.3.29, <= computer-server-v0.3.29 or >= sandbox-v0.1.8, <= sandbox-v0.1.8 or >= sandbox-v0.1.7, <= sandbox-v0.1.7 or >= sandbox-v0.1.6, <= sandbox-v0.1.6 or >= sandbox-v0.1.5, <= sandbox-v0.1.5 or >= sandbox-v0.1.4, <= sandbox-v0.1.4 or >= cua-v0.1.4, <= cua-v0.1.4 or >= sandbox-v0.1.3, <= sandbox-v0.1.3 or >= bench-v0.2.8, <= bench-v0.2.8 or >= lume-v0.3.9, <= lume-v0.3.9 or >= lume-v0.3.8, <= lume-v0.3.8 or >= lume-v0.3.7, <= lume-v0.3.7 or >= lume-v0.3.6, <= lume-v0.3.6 or >= cua-v0.1.3, <= cua-v0.1.3 or >= cua-v0.1.2, <= cua-v0.1.2 or >= cua-v0.1.1, <= cua-v0.1.1 or >= sandbox-v0.1.2, <= sandbox-v0.1.2 or >= agent-v0.7.39, <= agent-v0.7.39 or >= core-v0.1.19, <= core-v0.1.19 or >= lume-v0.3.5, <= lume-v0.3.5 or >= sandbox-v0.1.1, <= sandbox-v0.1.1 or >= computer-server-v0.3.28, <= computer-server-v0.3.28 or >= agent-v0.7.38, <= agent-v0.7.38 or >= lume-v0.3.4, <= lume-v0.3.4 or >= docker-xfce-v0.1.14, <= docker-xfce-v0.1.14 or >= lume-v0.3.3, <= lume-v0.3.3 or >= lume-v0.3.2, <= lume-v0.3.2 or >= computer-server-v0.3.27, <= computer-server-v0.3.27 or >= lume-v0.3.1, <= lume-v0.3.1 or >= bench-v0.2.7, <= bench-v0.2.7 or >= lume-v0.3.0, <= lume-v0.3.0 or >= agent-v0.7.37, <= agent-v0.7.37 or >= computer-server-v0.3.26, <= computer-server-v0.3.26 or >= computer-server-v0.3.25, <= computer-server-v0.3.25 or >= docker-xfce-v0.1.15, <= docker-xfce-v0.1.15 or >= computer-server-v0.3.24, <= computer-server-v0.3.24 or >= computer-server-v0.3.23, <= computer-server-v0.3.23 or >= computer-server-v0.3.22, <= computer-server-v0.3.22 or >= computer-server-v0.3.21, <= computer-server-v0.3.21 or >= agent-v0.7.36, <= agent-v0.7.36 or >= lume-v0.2.86, <= lume-v0.2.86 or >= agent-v0.7.35, <= agent-v0.7.35 or >= cli-v0.1.8, <= cli-v0.1.8 or >= agent-v0.7.34, <= agent-v0.7.34 or >= agent-v0.7.33, <= agent-v0.7.33 or >= bench-v0.2.6, <= bench-v0.2.6 or >= agent-v0.7.32, <= agent-v0.7.32 or >= docker-xfce-v0.1.13, <= docker-xfce-v0.1.13 or >= bench-v0.2.5, <= bench-v0.2.5 or >= computer-v0.5.17, <= computer-v0.5.17 or >= computer-server-v0.3.20, <= computer-server-v0.3.20 or >= agent-v0.7.31, <= agent-v0.7.31 or >= lume-v0.2.85, <= lume-v0.2.85 or >= docker-xfce-v0.1.12, <= docker-xfce-v0.1.12 or >= lume-v0.2.84, <= lume-v0.2.84 or >= lume-v0.2.83, <= lume-v0.2.83 or >= cli-v0.1.7, <= cli-v0.1.7 or >= agent-v0.7.30, <= agent-v0.7.30 or >= auto-v0.1.2, <= auto-v0.1.2 or >= lume-v0.2.82, <= lume-v0.2.82 or >= computer-v0.5.16, <= computer-v0.5.16 or >= agent-v0.7.29, <= agent-v0.7.29 or >= docker-cua-qemu-linux-v0.1.4, <= docker-cua-qemu-linux-v0.1.4 or >= docker-xfce-v0.1.11, <= docker-xfce-v0.1.11 or >= cli-v0.1.6, <= cli-v0.1.6 or >= agent-v0.7.28, <= agent-v0.7.28 or >= computer-v0.5.15, <= computer-v0.5.15 or >= computer-server-v0.3.19, <= computer-server-v0.3.19 or >= core-v0.1.18, <= core-v0.1.18 or >= cli-v0.1.5, <= cli-v0.1.5 or >= auto-v0.1.1, <= auto-v0.1.1 or >= computer-server-v0.3.18, <= computer-server-v0.3.18 or >= agent-v0.7.27, <= agent-v0.7.27 or >= npm-playground-v0.2.4, <= npm-playground-v0.2.4 or >= npm-playground-v0.2.3, <= npm-playground-v0.2.3 or >= npm-playground-v0.2.2, <= npm-playground-v0.2.2 or >= npm-playground-v0.2.1, <= npm-playground-v0.2.1 or >= agent-v0.7.26, <= agent-v0.7.26 or >= lume-v0.2.81, <= lume-v0.2.81 or >= cli-v0.1.4, <= cli-v0.1.4 or >= cli-v0.1.3, <= cli-v0.1.3 or >= computer-v0.5.14, <= computer-v0.5.14 or >= lume-v0.2.80, <= lume-v0.2.80 or >= lume-v0.2.79, <= lume-v0.2.79 or >= lume-v0.2.78, <= lume-v0.2.78 or >= npm-playground-v0.2.0, <= npm-playground-v0.2.0 or >= docker-cuabot-v1.0.5, <= docker-cuabot-v1.0.5 or >= npm-playground-v0.1.4, <= npm-playground-v0.1.4 or >= docker-cua-qemu-android-v0.1.3, <= docker-cua-qemu-android-v0.1.3 or >= docker-cua-qemu-windows-v0.1.3, <= docker-cua-qemu-windows-v0.1.3 or >= docker-cua-qemu-linux-v0.1.3, <= docker-cua-qemu-linux-v0.1.3 or >= docker-kasm-v0.1.4, <= docker-kasm-v0.1.4 or >= docker-xfce-v0.1.10, <= docker-xfce-v0.1.10 or >= lume-v0.2.77, <= lume-v0.2.77 or >= cuabot-v1.0.14, <= cuabot-v1.0.14 or >= bench-v0.2.4, <= bench-v0.2.4 or >= cli-v0.1.2, <= cli-v0.1.2 or >= computer-server-v0.3.17, <= computer-server-v0.3.17 or >= agent-v0.7.25, <= agent-v0.7.25 or >= computer-v0.5.13, <= computer-v0.5.13 or >= core-v0.1.17, <= core-v0.1.17 or >= cli-v0.1.1, <= cli-v0.1.1 or >= npm-playground-v0.1.3, <= npm-playground-v0.1.3 or >= npm-playground-v0.1.2, <= npm-playground-v0.1.2 or >= cuabot-v1.0.9, <= cuabot-v1.0.9 or >= npm-playground-v0.1.1, <= npm-playground-v0.1.1 or >= cuabot-v1.0.13, <= cuabot-v1.0.13 or >= npm-playground-v0.1.0, <= npm-playground-v0.1.0 or >= cuabot-v1.0.12, <= cuabot-v1.0.12 or >= cuabot-v1.0.11, <= cuabot-v1.0.11 or >= cuabot-v1.0.10, <= cuabot-v1.0.10 or >= cuabot-v1.0.8, <= cuabot-v1.0.8 or >= cuabot-v1.0.7, <= cuabot-v1.0.7 or >= cuabot-v1.0.6, <= cuabot-v1.0.6 or >= cuabot-v1.0.5, <= cuabot-v1.0.5 or >= docker-cuabot-v1.0.4, <= docker-cuabot-v1.0.4 or >= cuabot-v1.0.4, <= cuabot-v1.0.4 or >= cuabot-v1.0.3, <= cuabot-v1.0.3 or >= cuabot-v1.0.2, <= cuabot-v1.0.2 or >= cuabot-v1.0.1, <= cuabot-v1.0.1 or >= agent-v0.7.24, <= agent-v0.7.24 or >= lume-v0.2.76, <= lume-v0.2.76 or >= lume-v0.2.75, <= lume-v0.2.75 or >= lume-v0.2.72, <= lume-v0.2.72 or >= lume-v0.2.74, <= lume-v0.2.74 or >= lume-v0.2.73, <= lume-v0.2.73 or >= lume-v0.2.71, <= lume-v0.2.71 or >= lume-v0.2.70, <= lume-v0.2.70 or >= lume-v0.2.69, <= lume-v0.2.69 or >= lume-v0.2.68, <= lume-v0.2.68 or >= lume-v0.2.67, <= lume-v0.2.67 or >= lume-v0.2.66, <= lume-v0.2.66 or >= lume-v0.2.65, <= lume-v0.2.65 or >= lume-v0.2.64, <= lume-v0.2.64 or >= lume-v0.2.63, <= lume-v0.2.63 or >= lume-v0.2.62, <= lume-v0.2.62 or >= lume-v0.2.61, <= lume-v0.2.61 or >= agent-v0.7.23, <= agent-v0.7.23 or >= lume-v0.2.60, <= lume-v0.2.60 or >= lume-v0.2.59, <= lume-v0.2.59 or >= lume-v0.2.58, <= lume-v0.2.58 or >= lume-v0.2.57, <= lume-v0.2.57 or >= lume-v0.2.56, <= lume-v0.2.56 or >= lume-v0.2.55, <= lume-v0.2.55 or >= lume-v0.2.54, <= lume-v0.2.54 or >= lume-v0.2.53, <= lume-v0.2.53 or >= computer-server-v0.3.16, <= computer-server-v0.3.16 or >= computer-server-v0.3.15, <= computer-server-v0.3.15 or >= agent-v0.7.22, <= agent-v0.7.22 or >= docker-xfce-v0.1.9, <= docker-xfce-v0.1.9 or >= docker-xfce-v0.1.8, <= docker-xfce-v0.1.8 or >= npm-core-v0.1.4, <= npm-core-v0.1.4 or >= npm-computer-v0.1.6, <= npm-computer-v0.1.6 or >= computer-v0.5.12, <= computer-v0.5.12 or >= agent-v0.7.21, <= agent-v0.7.21 or >= lume-v0.2.52, <= lume-v0.2.52 or >= docker-xfce-v0.1.7, <= docker-xfce-v0.1.7 or >= docker-cua-qemu-windows-v0.1.2, <= docker-cua-qemu-windows-v0.1.2 or >= docker-cua-qemu-linux-v0.1.2, <= docker-cua-qemu-linux-v0.1.2 or >= docker-cua-qemu-android-v0.1.2, <= docker-cua-qemu-android-v0.1.2 or >= computer-server-v0.3.14, <= computer-server-v0.3.14 or >= docker-kasm-v0.1.3, <= docker-kasm-v0.1.3 or >= agent-v0.7.20, <= agent-v0.7.20 or >= computer-v0.5.11, <= computer-v0.5.11 or >= docker-xfce-v0.1.6, <= docker-xfce-v0.1.6 or >= docker-xfce-v0.1.5, <= docker-xfce-v0.1.5 or >= npm-cli-v0.2.0, <= npm-cli-v0.2.0 or >= npm-cli-v0.1.9, <= npm-cli-v0.1.9 or >= computer-server-v0.3.13, <= computer-server-v0.3.13 or >= agent-v0.7.19, <= agent-v0.7.19 or >= agent-v0.7.18, <= agent-v0.7.18 or >= lume-v0.2.51, <= lume-v0.2.51 or >= computer-server-v0.3.12, <= computer-server-v0.3.12 or >= computer-server-v0.3.11, <= computer-server-v0.3.11 or >= computer-server-v0.3.10, <= computer-server-v0.3.10 or >= computer-server-v0.3.9, <= computer-server-v0.3.9 or >= lume-v0.2.50, <= lume-v0.2.50 or >= lume-v0.2.49, <= lume-v0.2.49 or >= lume-v0.2.48, <= lume-v0.2.48 or >= lume-v0.2.47, <= lume-v0.2.47 or >= computer-server-v0.3.8, <= computer-server-v0.3.8 or >= computer-server-v0.3.7, <= computer-server-v0.3.7 or >= computer-server-v0.3.6, <= computer-server-v0.3.6 or >= mcp-server-v0.1.16, <= mcp-server-v0.1.16 or >= computer-server-v0.3.5, <= computer-server-v0.3.5 or >= lume-v0.2.46, <= lume-v0.2.46 or >= lume-v0.2.45, <= lume-v0.2.45 or >= lume-v0.2.44, <= lume-v0.2.44 or >= lume-v0.2.43, <= lume-v0.2.43 or >= lume-v0.2.42, <= lume-v0.2.42 or >= lume-v0.2.41, <= lume-v0.2.41 or >= lume-v0.2.40, <= lume-v0.2.40 or >= lume-v0.2.39, <= lume-v0.2.39 or >= lume-v0.2.38, <= lume-v0.2.38 or >= computer-server-v0.3.4, <= computer-server-v0.3.4 or >= computer-server-v0.3.3, <= computer-server-v0.3.3 or >= lume-v0.2.35, <= lume-v0.2.35 or >= lume-v0.2.37, <= lume-v0.2.37 or >= lume-v0.2.36, <= lume-v0.2.36 or >= lume-v0.2.34, <= lume-v0.2.34 or >= lume-v0.2.33, <= lume-v0.2.33 or >= lume-v0.2.32, <= lume-v0.2.32 or >= agent-v0.7.16, <= agent-v0.7.16 or >= lume-v0.2.31, <= lume-v0.2.31 or >= lume-v0.2.30, <= lume-v0.2.30 or >= agent-v0.7.17, <= agent-v0.7.17 or >= computer-v0.5.10, <= computer-v0.5.10 or >= core-v0.1.16, <= core-v0.1.16 or >= agent-v0.7.15, <= agent-v0.7.15 or >= computer-v0.5.7, <= computer-v0.5.7 or >= agent-v0.7.14, <= agent-v0.7.14 or >= agent-v0.7.13, <= agent-v0.7.13 or >= lume-v0.2.29, <= lume-v0.2.29 or >= lume-v0.2.28, <= lume-v0.2.28 or >= docker-kasm-v0.1.2, <= docker-kasm-v0.1.2 or >= agent-v0.7.12, <= agent-v0.7.12 or >= docker-lumier-v0.1.2, <= docker-lumier-v0.1.2 or >= docker-cua-qemu-windows-v0.1.1, <= docker-cua-qemu-windows-v0.1.1 or >= agent-v0.7.11, <= agent-v0.7.11 or >= som-v0.1.4, <= som-v0.1.4 or >= docker-cua-qemu-linux-v0.1.1, <= docker-cua-qemu-linux-v0.1.1 or >= docker-kasm-v0.1.1, <= docker-kasm-v0.1.1 or >= docker-xfce-v0.1.3, <= docker-xfce-v0.1.3 or >= docker-xfce-v0.1.2, <= docker-xfce-v0.1.2 or >= bench-v0.2.3, <= bench-v0.2.3 or >= docker-xfce-v0.1.1, <= docker-xfce-v0.1.1 or >= agent-v0.7.10, <= agent-v0.7.10 or >= core-v0.1.14, <= core-v0.1.14 or >= computer-v0.5.6, <= computer-v0.5.6 or >= agent-v0.7.9, <= agent-v0.7.9 or >= core-v0.1.13, <= core-v0.1.13 or >= computer-v0.5.5, <= computer-v0.5.5 or >= agent-v0.7.8, <= agent-v0.7.8 or >= core-v0.1.12, <= core-v0.1.12 or >= computer-v0.5.4, <= computer-v0.5.4 or >= agent-v0.7.6, <= agent-v0.7.6 or >= agent-v0.7.5, <= agent-v0.7.5 or >= agent-v0.7.4, <= agent-v0.7.4 or >= computer-server-v0.3.2, <= computer-server-v0.3.2 or >= computer-server-v0.3.1, <= computer-server-v0.3.1 or >= lume-v0.2.27, <= lume-v0.2.27 or >= lume-v0.2.26, <= lume-v0.2.26 or >= lume-v0.2.25, <= lume-v0.2.25 or >= bench-v0.2.1, <= bench-v0.2.1 or >= bench-v0.2.0, <= bench-v0.2.0 or >= cua-v0.1.8, <= cua-v0.1.8 or >= npm-core-v0.1.3, <= npm-core-v0.1.3 or >= npm-computer-v0.1.5, <= npm-computer-v0.1.5 or >= agent-v0.7.3, <= agent-v0.7.3 or >= agent-v0.7.2, <= agent-v0.7.2 or >= computer-v0.5.1, <= computer-v0.5.1 or >= computer-server-v0.3.0, <= computer-server-v0.3.0 or >= agent-v0.7.1, <= agent-v0.7.1 or >= agent-v0.7.0, <= agent-v0.7.0 or >= computer-v0.5.0, <= computer-v0.5.0 or >= agent-v0.6.2, <= agent-v0.6.2 or >= agent-v0.6.1, <= agent-v0.6.1 or >= computer-v0.4.19, <= computer-v0.4.19 or >= computer-server-v0.2.0, <= computer-server-v0.2.0 or >= agent-v0.6.0, <= agent-v0.6.0 or >= lume-v0.2.23, <= lume-v0.2.23 or >= agent-v0.5.2, <= agent-v0.5.2 or >= computer-v0.4.18, <= computer-v0.4.18 or >= agent-v0.5.1, <= agent-v0.5.1 or >= cua-v0.1.7, <= cua-v0.1.7 or >= computer-server-v0.1.31, <= computer-server-v0.1.31 or >= agent-v0.5.0, <= agent-v0.5.0 or >= agent-v0.4.53, <= agent-v0.4.53 or >= computer-v0.4.17, <= computer-v0.4.17 or >= agent-v0.4.52, <= agent-v0.4.52 or >= computer-v0.4.16, <= computer-v0.4.16 or >= agent-v0.4.51, <= agent-v0.4.51 or >= computer-v0.4.15, <= computer-v0.4.15 or >= agent-v0.4.50, <= agent-v0.4.50 or >= computer-v0.4.14, <= computer-v0.4.14 or >= agent-v0.4.49, <= agent-v0.4.49 or >= computer-v0.4.13, <= computer-v0.4.13 or >= agent-v0.4.48, <= agent-v0.4.48 or >= agent-v0.4.47, <= agent-v0.4.47 or >= agent-v0.4.46, <= agent-v0.4.46 or >= agent-v0.4.45, <= agent-v0.4.45 or >= agent-v0.4.44, <= agent-v0.4.44 or >= agent-v0.4.43, <= agent-v0.4.43 or >= agent-v0.4.42, <= agent-v0.4.42 or >= agent-v0.4.41, <= agent-v0.4.41 or >= agent-v0.4.40, <= agent-v0.4.40 or >= agent-v0.4.39, <= agent-v0.4.39 or >= computer-server-v0.1.30, <= computer-server-v0.1.30 or >= agent-v0.4.38, <= agent-v0.4.38 or >= computer-v0.4.12, <= computer-v0.4.12 or >= computer-server-v0.1.29, <= computer-server-v0.1.29 or >= computer-v0.4.11, <= computer-v0.4.11 or >= computer-server-v0.1.28, <= computer-server-v0.1.28 or >= agent-v0.4.36, <= agent-v0.4.36 or >= agent-v0.4.37, <= agent-v0.4.37 or >= mcp-server-v0.1.15, <= mcp-server-v0.1.15 or >= computer-server-v0.1.27, <= computer-server-v0.1.27 or >= computer-server-v0.1.26, <= computer-server-v0.1.26 or >= agent-v0.4.35, <= agent-v0.4.35 or >= computer-server-v0.1.25, <= computer-server-v0.1.25 or >= agent-v0.4.34, <= agent-v0.4.34 or >= agent-v0.4.33, <= agent-v0.4.33 or >= computer-v0.4.10, <= computer-v0.4.10 or >= computer-v0.4.9, <= computer-v0.4.9 or >= computer-v0.4.8, <= computer-v0.4.8 or >= computer-v0.4.7, <= computer-v0.4.7 or >= computer-server-v0.1.23, <= computer-server-v0.1.23 or >= agent-v0.4.32, <= agent-v0.4.32 or >= computer-v0.4.6, <= computer-v0.4.6 or >= agent-v0.4.31, <= agent-v0.4.31 or >= agent-v0.4.30, <= agent-v0.4.30 or >= agent-v0.4.29, <= agent-v0.4.29 or >= agent-v0.4.28, <= agent-v0.4.28 or >= agent-v0.4.27, <= agent-v0.4.27 or >= agent-v0.4.26, <= agent-v0.4.26 or >= computer-v0.4.5, <= computer-v0.4.5 or >= agent-v0.4.25, <= agent-v0.4.25 or >= computer-server-v0.1.22, <= computer-server-v0.1.22 or >= agent-v0.4.24, <= agent-v0.4.24 or >= agent-v0.4.23, <= agent-v0.4.23 or >= agent-v0.4.22, <= agent-v0.4.22 or >= agent-v0.4.21, <= agent-v0.4.21 or >= agent-v0.4.20, <= agent-v0.4.20 or >= agent-v0.4.19, <= agent-v0.4.19 or >= agent-v0.4.18, <= agent-v0.4.18 or >= agent-v0.4.17, <= agent-v0.4.17 or >= agent-v0.4.16, <= agent-v0.4.16 or >= core-v0.1.9, <= core-v0.1.9 or >= agent-v0.4.15, <= agent-v0.4.15 or >= computer-v0.4.4, <= computer-v0.4.4 or >= agent-v0.4.14, <= agent-v0.4.14 or >= computer-v0.4.3, <= computer-v0.4.3 or >= computer-v0.4.2, <= computer-v0.4.2 or >= agent-v0.4.13, <= agent-v0.4.13 or >= agent-v0.4.12, <= agent-v0.4.12 or >= agent-v0.4.10, <= agent-v0.4.10 or >= agent-v0.4.9, <= agent-v0.4.9 or >= agent-v0.4.8, <= agent-v0.4.8 or >= agent-v0.4.7, <= agent-v0.4.7 or >= agent-v0.4.6, <= agent-v0.4.6 or >= agent-v0.4.5, <= agent-v0.4.5 or >= agent-v0.4.4, <= agent-v0.4.4 or >= agent-v0.4.3, <= agent-v0.4.3 or >= computer-server-v0.1.20, <= computer-server-v0.1.20 or >= agent-v0.4.2, <= agent-v0.4.2 or >= core-v0.1.8, <= core-v0.1.8 or >= core-v0.1.7, <= core-v0.1.7 or >= core-v0.1.6, <= core-v0.1.6 or >= computer-v0.4.0, <= computer-v0.4.0 or >= agent-v0.4.1, <= agent-v0.4.1 or >= agent-v0.4.0, <= agent-v0.4.0 or >= computer-v0.3.7, <= computer-v0.3.7 or >= computer-v0.3.6, <= computer-v0.3.6 or >= agent-v0.3.2, <= agent-v0.3.2 or >= computer-server-v0.1.19, <= computer-server-v0.1.19 or >= computer-v0.3.5, <= computer-v0.3.5 or >= computer-server-v0.1.18, <= computer-server-v0.1.18 or >= computer-server-v0.1.17, <= computer-server-v0.1.17 or >= computer-server-v0.1.16, <= computer-server-v0.1.16 or >= computer-v0.3.4, <= computer-v0.3.4 or >= computer-v0.3.3, <= computer-v0.3.3 or >= computer-v0.3.2, <= computer-v0.3.2 or >= computer-server-v0.1.15, <= computer-server-v0.1.15 or >= computer-v0.3.1, <= computer-v0.3.1 or >= computer-server-v0.1.14, <= computer-server-v0.1.14 or >= agent-v0.3.1, <= agent-v0.3.1 or >= computer-v0.3.0, <= computer-v0.3.0 or >= agent-v0.2.15, <= agent-v0.2.15 or >= computer-v0.2.13, <= computer-v0.2.13 or >= agent-v0.2.14, <= agent-v0.2.14 or >= agent-v0.2.13, <= agent-v0.2.13 or >= computer-v0.2.11, <= computer-v0.2.11 or >= computer-server-v0.1.13, <= computer-server-v0.1.13 or >= agent-v0.2.11, <= agent-v0.2.11 or >= computer-v0.2.12, <= computer-v0.2.12 or >= agent-v0.2.12, <= agent-v0.2.12 or >= lume-v0.2.22, <= lume-v0.2.22 or >= lume-v0.2.21, <= lume-v0.2.21 or >= lume-v0.2.20, <= lume-v0.2.20 or >= lume-v0.2.19, <= lume-v0.2.19 or >= lume-v0.2.18, <= lume-v0.2.18 or >= lume-v0.2.17, <= lume-v0.2.17 or >= lume-v0.2.16, <= lume-v0.2.16 or >= computer-v0.2.10, <= computer-v0.2.10 or >= computer-server-v0.1.12, <= computer-server-v0.1.12 or >= agent-v0.2.10, <= agent-v0.2.10 or >= agent-v0.2.9, <= agent-v0.2.9 or >= agent-v0.2.8, <= agent-v0.2.8 or >= computer-v0.2.9, <= computer-v0.2.9 or >= computer-server-v0.1.11, <= computer-server-v0.1.11 or >= agent-v0.2.7, <= agent-v0.2.7 or >= computer-v0.2.8, <= computer-v0.2.8 or >= computer-server-v0.1.10, <= computer-server-v0.1.10 or >= mcp-server-v0.1.13, <= mcp-server-v0.1.13 or >= computer-v0.2.7, <= computer-v0.2.7 or >= agent-v0.2.6, <= agent-v0.2.6 or >= computer-v0.2.6, <= computer-v0.2.6 or >= agent-v0.2.5, <= agent-v0.2.5 or >= mcp-server-v0.1.12, <= mcp-server-v0.1.12 or >= computer-v0.2.5, <= computer-v0.2.5 or >= computer-server-v0.1.9, <= computer-server-v0.1.9 or >= agent-v0.2.4, <= agent-v0.2.4 or >= mcp-server-v0.1.11, <= mcp-server-v0.1.11 or >= mcp-server-v0.1.10, <= mcp-server-v0.1.10 or >= computer-v0.2.4, <= computer-v0.2.4 or >= computer-v0.2.3, <= computer-v0.2.3 or >= computer-server-v0.1.8, <= computer-server-v0.1.8 or >= computer-server-v0.1.7, <= computer-server-v0.1.7 or >= agent-v0.2.3, <= agent-v0.2.3 or >= agent-v0.2.2, <= agent-v0.2.2 or >= computer-server-v0.1.6, <= computer-server-v0.1.6 or >= lume-v0.2.15, <= lume-v0.2.15 or >= computer-v0.2.2, <= computer-v0.2.2 or >= computer-server-v0.1.5, <= computer-server-v0.1.5 or >= agent-v0.2.1, <= agent-v0.2.1 or >= computer-v0.2.1, <= computer-v0.2.1 or >= agent-v0.2.0, <= agent-v0.2.0 or >= computer-v0.2.0, <= computer-v0.2.0 or >= lume-v0.2.14, <= lume-v0.2.14 or >= agent-v0.1.44, <= agent-v0.1.44 or >= computer-v0.1.29, <= computer-v0.1.29 or >= agent-v0.1.43, <= agent-v0.1.43 or >= agent-v0.1.42, <= agent-v0.1.42 or >= lume-v0.2.13, <= lume-v0.2.13 or >= agent-v0.1.41, <= agent-v0.1.41 or >= agent-v0.1.40, <= agent-v0.1.40 or >= agent-v0.1.39, <= agent-v0.1.39 or >= agent-v0.1.38, <= agent-v0.1.38 or >= agent-v0.1.37, <= agent-v0.1.37 or >= agent-v0.1.35, <= agent-v0.1.35 or >= computer-v0.1.28, <= computer-v0.1.28 or >= agent-v0.1.34, <= agent-v0.1.34 or >= agent-v0.1.33, <= agent-v0.1.33 or >= computer-v0.1.27, <= computer-v0.1.27 or >= computer-v0.1.26, <= computer-v0.1.26 or >= lume-v0.2.12, <= lume-v0.2.12 or >= lume-v0.2.11, <= lume-v0.2.11 or >= lume-v0.2.10, <= lume-v0.2.10 or >= lume-v0.2.9, <= lume-v0.2.9 or >= lume-v0.2.8, <= lume-v0.2.8 or >= mcp-server-v0.1.9, <= mcp-server-v0.1.9 or >= lume-v0.2.7, <= lume-v0.2.7 or >= lume-v0.2.6, <= lume-v0.2.6 or >= computer-v0.1.24, <= computer-v0.1.24 or >= agent-v0.1.31, <= agent-v0.1.31 or >= lume-v0.2.5, <= lume-v0.2.5 or >= computer-server-v0.1.4, <= computer-server-v0.1.4 or >= lume-v0.2.4, <= lume-v0.2.4 or >= agent-v0.1.30, <= agent-v0.1.30 or >= lume-v0.2.3, <= lume-v0.2.3 or >= pylume-v0.2.1, <= pylume-v0.2.1 or >= mcp-server-v0.1.8, <= mcp-server-v0.1.8 or >= lume-v0.2.2, <= lume-v0.2.2 or >= computer-v0.1.23, <= computer-v0.1.23 or >= agent-v0.1.29, <= agent-v0.1.29 or >= pylume-v0.2.0, <= pylume-v0.2.0 or >= lume-v0.2.1, <= lume-v0.2.1 or >= lume-v0.2.0, <= lume-v0.2.0 or >= som-v0.1.3, <= som-v0.1.3 or >= mcp-server-v0.1.7, <= mcp-server-v0.1.7 or >= lume-v0.1.38, <= lume-v0.1.38 or >= lume-v0.1.37, <= lume-v0.1.37 or >= agent-v0.1.28, <= agent-v0.1.28 or >= mcp-server-v0.1.6, <= mcp-server-v0.1.6 or >= lume-v0.1.36, <= lume-v0.1.36 or >= som-v0.1.2, <= som-v0.1.2 or >= pylume-v0.1.17, <= pylume-v0.1.17 or >= mcp-server-v0.1.5, <= mcp-server-v0.1.5 or >= lume-v0.1.35, <= lume-v0.1.35 or >= core-v0.1.5, <= core-v0.1.5 or >= computer-v0.1.22, <= computer-v0.1.22 or >= computer-server-v0.1.3, <= computer-server-v0.1.3 or >= agent-v0.1.27, <= agent-v0.1.27 or >= lume-v0.1.34, <= lume-v0.1.34 or >= lume-v0.1.33, <= lume-v0.1.33 or >= agent-v0.1.26, <= agent-v0.1.26 or >= lume-v0.1.32, <= lume-v0.1.32 or >= lume-v0.1.31, <= lume-v0.1.31 or >= mcp-server-v0.1.4, <= mcp-server-v0.1.4 or >= lume-v0.1.30, <= lume-v0.1.30 or >= mcp-server-v0.1.3, <= mcp-server-v0.1.3 or >= lume-v0.1.29, <= lume-v0.1.29 or >= mcp-server-v0.1.2, <= mcp-server-v0.1.2 or >= lume-v0.1.28, <= lume-v0.1.28 or >= mcp-server-v0.1.1, <= mcp-server-v0.1.1 or >= lume-v0.1.27, <= lume-v0.1.27 or >= mcp-server-v0.1.0, <= mcp-server-v0.1.0 or >= lume-v0.1.26, <= lume-v0.1.26 or >= agent-v0.1.25, <= agent-v0.1.25 or >= lume-v0.1.25, <= lume-v0.1.25 or >= agent-v0.1.24, <= agent-v0.1.24 or >= lume-v0.1.24, <= lume-v0.1.24 or >= agent-v0.1.23, <= agent-v0.1.23 or >= lume-v0.1.23, <= lume-v0.1.23 or >= agent-v0.1.22, <= agent-v0.1.22 or >= lume-v0.1.22, <= lume-v0.1.22 or >= agent-v0.1.21, <= agent-v0.1.21 or >= lume-v0.1.21, <= lume-v0.1.21 or >= agent-v0.1.20, <= agent-v0.1.20 or >= pylume-v0.1.16, <= pylume-v0.1.16 or >= lume-v0.1.20, <= lume-v0.1.20 or >= computer-v0.1.21, <= computer-v0.1.21 or >= agent-v0.1.19, <= agent-v0.1.19 or >= computer-v0.1.20, <= computer-v0.1.20 or >= computer-v0.1.19, <= computer-v0.1.19 or >= agent-v0.1.18, <= agent-v0.1.18 or >= lume-v0.1.19, <= lume-v0.1.19 or >= computer-v0.1.18, <= computer-v0.1.18 or >= agent-v0.1.17, <= agent-v0.1.17 or >= lume-v0.1.18, <= lume-v0.1.18 or >= som-v0.1.1, <= som-v0.1.1 or >= pylume-v0.1.15, <= pylume-v0.1.15 or >= core-v0.1.4, <= core-v0.1.4 or >= computer-v0.1.7, <= computer-v0.1.7 or >= agent-v0.1.6, <= agent-v0.1.6 or >= pylume-v0.1.14, <= pylume-v0.1.14 or >= lume-v0.1.17, <= lume-v0.1.17 or >= lume-v0.1.16, <= lume-v0.1.16 or >= core-v0.1.3, <= core-v0.1.3 or >= computer-v0.1.6, <= computer-v0.1.6 or >= agent-v0.1.5, <= agent-v0.1.5 or >= pylume-v0.1.13, <= pylume-v0.1.13 or >= lume-v0.1.14, <= lume-v0.1.14 or >= pylume-v0.1.12, <= pylume-v0.1.12 or >= v0.1.13, <= v0.1.13 or >= v0.1.12, <= v0.1.12 or >= pylume-v0.1.11, <= pylume-v0.1.11 or >= lume-v0.1.15, <= lume-v0.1.15 or >= v0.1.11, <= v0.1.11 or >= v0.1.10, <= v0.1.10 or >= v0.1.9, <= v0.1.9 or >= v0.1.8, <= v0.1.8 or >= v0.1.7, <= v0.1.7 or >= v0.1.6, <= v0.1.6 or >= v0.1.5, <= v0.1.5 or >= v0.1.4, <= v0.1.4 or >= v0.1.3, <= v0.1.3 or >= v0.1.2, <= v0.1.2 or >= v0.1.1, <= v0.1.1
- Patched version
- 0.3.42
CVE-2026-86121
An early warning has been issued for a critical vulnerability in cua computer-server versions before 0.3.42, which may allow unauthenticated remote code execution.
What happened
Cua computer-server versions before 0.3.42 reportedly contain a critical vulnerability. When the CONTAINER_NAME environment variable is unset, the server skips authentication and binds to all interfaces by default. This allows unauthenticated attackers to execute arbitrary commands remotely.
The vulnerability affects a wide range of cua computer-server components and version ranges, as detailed in the threat data. No exploits in the wild have been reported yet.
What to do about it
- Upgrade cua computer-server to version 0.3.42 or later to mitigate the vulnerability.
- Review your environment to ensure the CONTAINER_NAME environment variable is properly set.
- Monitor network traffic for any suspicious activity that may indicate an attempted exploit.
- Consult the primary sources for the latest information and updates on this vulnerability.
How 0Day would have caught this
MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If
cua computer-server is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using cua computer-server versions before 0.3.42 or any of the affected components within the specified version ranges.
What should I do right now?
Upgrade to cua computer-server version 0.3.42 or later immediately. Ensure the CONTAINER_NAME environment variable is set correctly. Monitor your network for any unusual activity.
Is there an official fix available?
Yes, cua computer-server version 0.3.42 or later includes a fix for this vulnerability.