AutoAgent exposes a TCP command server that listens on all network interfaces. The server accepts Bash commands without requiring authentication, executing them as the root user inside the container. This flaw allows an unauthenticated attacker who can reach the exposed port to run arbitrary commands, exfiltrate data, modify system state, or compromise host resources via bind‑mounted volumes. The weakness results from a missing authentication check (CWE‑306) and therefore enables full control of the container environment.

The vulnerability affects the HKUDS AutoAgent product. No specific version range is listed in the CNA data, so all current releases that include the unpatched TCP server are potentially exposed. The issue arises when the application is run with the default configuration, which binds the TCP server to 0.0.0.0 and permits direct command execution. If the container mounts host directories, the attacker can read or alter host files.

The CVSS score of 9.3 indicates a critical severity. Although EPSS data are not available, the lack of authentication combined with root execution suggests a high likelihood of exploitation by attackers who can reach the service. The vulnerability is not listed in CISA KEV, but the exposure remains significant. Attackers can compromise both the isolated container and any host resources accessed through mounted volumes, effectively gaining privileged access to the underlying host. Mitigation requires either disabling the server or securing it with proper authentication or network restrictions.