A critical authentication bypass vulnerability in trycua cua-computer-server allows unauthenticated remote attackers to achieve full system command execution.

The software fails to enforce authentication when the CONTAINER_NAME environment variable is not configured, binding the service to all network interfaces. This allows an unauthenticated attacker to interact with the run_command endpoint, perform arbitrary file operations, and access interactive PTY shells.

This vulnerability carries a CVSS score of 9.8, reflecting its critical severity. Successful exploitation grants an attacker complete control over the host system, leading to full data compromise, potential lateral movement within the network, and total loss of system integrity.

Immediate Action: Update the trycua cua-computer-server software to version 0.3.42 or later immediately to resolve the authentication logic flaw.

Proactive Monitoring: Review system and application access logs for any unauthorized connections to TCP port 8000, particularly requests targeting the run_command or file operation endpoints.

Compensating Controls: Implement strict network segmentation or a Web Application Firewall (WAF) rule to block all external access to the cua-computer-server management port until the patch is applied.

Public Exploit Available: No

Given the critical nature of this vulnerability and the potential for full remote command execution, administrators must prioritize patching this component. Ensure that the CONTAINER_NAME environment variable is correctly configured as a defensive best practice, though applying the vendor update remains the only definitive way to close the authentication gap.