CVE-2026-58169: Vibe-Trading DNS Rebinding Authentication Bypass & RCE

Technical summary

The vulnerability chain exploits three authentication and validation gaps: (1) the server binds to 0.0.0.0 and relies on TCP peer address trust to recognize loopback clients, (2) the Host header is not validated during request handling, and (3) CORS is configured to allow credentialed cross-origin requests. An attacker crafts a DNS rebinding attack where a domain initially resolves to the attacker's IP but later resolves to 127.0.0.1 or the target's local IP. The victim's browser makes requests to the malicious domain, which after the rebind resolves to localhost, allowing the attacker's JavaScript to issue authenticated requests using the victim's stored credentials (via CORS with credentials). When combined with a bash-enabled preset configuration, this grants access to the /shell or equivalent code-execution endpoint, leading to RCE as the Vibe-Trading process user. The attacker can then reconfigure LLM providers and data sources to exfiltrate sensitive credentials or API keys.

Business impact

Organizations running Vibe-Trading in environments where users access the web UI can be compromised by a single user clicking a malicious link while logged in. RCE as the API process user typically means data exfiltration, lateral movement within the network, and potential compromise of connected AI services and data sources. Credential theft from LLM and data-source settings amplifies the blast radius, potentially exposing integrations with cloud services, databases, and AI platforms. Teams relying on Vibe-Trading for data orchestration or AI workflows risk service interruption and loss of confidentiality over sensitive configuration and training data.

Affected systems

Vibe-Trading releases before version 0.1.10 are vulnerable. This includes all 0.1.x versions prior to 0.1.10 and any earlier versions. Deployments are at risk if: (1) the application is bound to 0.0.0.0 (default for containerized deployments), (2) users access the web interface from untrusted networks, (3) bash-enabled presets are configured, and (4) CORS is not restricted. Development and staging environments with default configurations are particularly exposed.

Exploitability

The attack requires user interaction (the victim must click a malicious link while logged into Vibe-Trading), which the CVSS vector reflects as AC:H (high complexity). However, once the user visits the attacker's page, the exploit is largely automatic—DNS rebinding and credential exfiltration happen in the background. No special network positioning or system access is required. Exploitation can be weaponized via phishing emails, social engineering, or malicious advertisements. The attack succeeds against out-of-the-box configurations, making it practical for targeted campaigns against Vibe-Trading users.

Remediation

Immediately upgrade to Vibe-Trading 0.1.10 or later, which addresses the DNS rebinding and Host header validation issues. Review and restrict CORS configuration to only necessary origins rather than allowing all cross-origin requests with credentials. Bind the application to localhost or a private IP address instead of 0.0.0.0 if it does not require external access. Disable bash-enabled presets unless explicitly required. For applications already deployed, implement a WAF rule or reverse proxy that validates the Host header against a whitelist of known legitimate hostnames. Consider network segmentation to limit exposure of the Vibe-Trading API to trusted networks.

Patch guidance

Upgrade to Vibe-Trading 0.1.10 or later. Verify the patch is applied by checking the version string in the application's UI or API (e.g., GET /api/version). After patching, test authentication and CORS behavior to ensure bearer tokens are validated correctly regardless of DNS resolution. If running in a container, update the image tag and redeploy. For users on versions before 0.1.10, interim mitigation includes restricting network access to the Vibe-Trading API to trusted IP ranges and disabling bash presets in the configuration.

Detection guidance

Monitor for DNS A-record queries followed by repeated requests to localhost or 127.0.0.1 from the same source IP, which indicate DNS rebinding attempts. Log and alert on requests with mismatched Host headers (e.g., Host: attacker.com connecting to 127.0.0.1). Watch for cross-origin requests with credentials (preflight OPTIONS followed by authenticated POST/PUT). Audit changes to LLM provider settings, data-source credentials, or preset configurations, particularly when triggered from unusual network origins. Check Vibe-Trading application logs for unauthenticated or anomalously authenticated access to /shell or code-execution endpoints. Implement browser-based DNS rebinding detection if feasible.

Why prioritize this

This vulnerability combines high-impact RCE with moderate exploitability (user interaction required), earning a CVSS 7.5/HIGH rating. The critical factors are: (1) unauthenticated RCE is possible after bypassing authentication via DNS rebinding, (2) credential theft from LLM/data-source settings extends the attack scope, and (3) default configurations are vulnerable. While user interaction (clicking a link) raises the bar slightly, the attack is nearly automatic once triggered. Organizations with internet-facing Vibe-Trading instances or users accessing from untrusted networks should prioritize patching within 24–48 hours.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects: Network attack vector (AV:N), High complexity due to user interaction requirement (AC:H), no privilege escalation (PR:N, UI:R), unchanged scope (S:U), and High impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The High complexity acknowledges that the user must visit a malicious page, but once they do, RCE and credential exfiltration are nearly guaranteed. The score correctly penalizes the severity of unauthenticated code execution and multi-stage compromise (authentication bypass → RCE → credential theft).

Frequently asked questions