Cua computer-server versions prior to 0.3.42 contain a flaw that bypasses user authentication when the CONTAINER_NAME environment variable is not set, and the service binds to all network interfaces by default. Because of this, an unauthenticated actor can connect to TCP port 8000 and issue commands through the run_command endpoint, exchange files using the file operation endpoints, or spawn a full interactive PTY shell. The weakness is an example of improper restriction of privileges (CWE-306).

The vulnerability affects installations of Cua computer-server from trycua, specifically all releases before 0.3.42.

The CVSS score of 9.3 flags this as a high‑severity flaw. Although no EPSS value is available and the issue is not listed in CISA’s KEV catalog, the data indicate that the flaw can be exploited remotely over the network. An attacker only needs open access to TCP port 8000, implies a likely attack vector of unauthenticated network access. Once accessed, the attacker can run arbitrary shell commands, read or write any file on the host, and gain a persistent interactive shell without authentication. This breadth of capabilities warrants immediate remediation.