A critical unauthenticated remote code execution vulnerability in HKUDS AutoAgent allows attackers to execute arbitrary commands as root, posing an immediate risk of system compromise.

The application utilizes a TCP server that binds to all interfaces and lacks authentication, permitting unauthenticated remote users to send commands that are executed by the underlying bash shell with root privileges.

A successful exploit grants the attacker complete control over the affected container and access to sensitive bind-mounted host workspace directories. Given the CVSS score of 9.8, this vulnerability represents a critical risk that could lead to full system takeover, data theft, and unauthorized lateral movement within the production environment.

Immediate Action: Restrict network access to the TCP communication port immediately via firewall rules or security groups to prevent unauthorized connections. Monitor vendor channels for an official patch release and apply updates as soon as they become available.

Proactive Monitoring: Review system and container logs for unauthorized inbound connections to the communication port and unexpected bash command execution patterns. Monitor for unusual process creation originating from the AutoAgent container.

Compensating Controls: Deploy a network-level firewall to whitelist only trusted IP addresses that require access to the AutoAgent communication port. If possible, isolate the containerized environment within a dedicated, restricted network segment to minimize the impact of potential lateral movement.

Public Exploit Available: No (exploit_available unknown)

The severity of this vulnerability cannot be overstated, as it provides a direct path to root-level system access for any attacker capable of reaching the service port. Organizations should prioritize isolating affected instances immediately and continue to monitor for official vendor updates to fully remediate the underlying logic flaw.