CVE-2026-58169: Vibe-Trading DNS rebinding authentication bypass leading to RCE

Vibe-Trading before v0.1.10 contains a DNS rebinding authentication bypass vulnerability (CWE-346 Origin Validation Error). The FastAPI API server (agent/api_server.py) binds to 0.0.0.0 by default and treats any TCP connection from a loopback peer address (127.0.0.1, ::1, localhost) as a trusted local/dev-mode caller, bypassing API_AUTH_KEY bearer-token authentication entirely. Because the server performs no Host header validation on loopback-trusted requests, an attacker can use DNS rebinding to make a victim's browser issue same-origin JSON requests to the local API with an attacker-controlled Host header and no bearer token. The loopback peer IP causes _is_local_client() to return True, so _validate_api_auth() skips authentication. Furthermore, _shell_tools_enabled_for_request() returns True for loopback clients, enabling the bash tool in the agent's tool registry. The attacker can then send a message to a session that triggers the BashTool, which executes subprocess.run(command, shell=True) — achieving remote code execution as the API process user. The attacker can also overwrite LLM and data-source settings to exfiltrate credentials.

• Package/component affected: HKUDS/Vibe-Trading — agent/api_server.py (loopback trust/auth boundary, Host-header validation), agent/src/tools/bash_tool.py (BashTool RCE primitive), agent/src/tools/__init__.py (shell tool gating)
• Affected versions: Vibe-Trading < 0.1.10 (confirmed on v0.1.9, commit 8cebccb9b301f962d11bf0fa8c6be9bf7d7e12f2)
• Fixed version: v0.1.10 (commit 54f944743efee7b9cbaaeafb5966c583d0d4ac66), via PR #242 (6e06017) — adds _reject_untrusted_loopback_host middleware
• Risk level: High (CVSS 7.7 / 8.1)
• Consequences: Unauthenticated remote code execution as the API process user; unauthorized access to privileged control-plane endpoints (/live/runner/start, /swarm/runs, /sessions/{id}/messages); credential exfiltration via settings overwrite (/settings/llm, /settings/data-sources)

Impact Parity

• Disclosed/claimed maximum impact: DNS rebinding authentication bypass leading to remote code execution (code_execution) and credential exfiltration
• Reproduced impact from this run: Full chain demonstrated — DNS rebinding → auth bypass → shell tools enabled → BashTool executes arbitrary shell command as API process user (uid=1000(vscode)). The proof file /tmp/vibe_trading_rce_proof_*.txt was created with RCE_CONFIRMED. The agent trace shows tool_call: bash with exit_code: 0 and stdout: "uid=1000(vscode)...".
• Parity: full
• Not demonstrated: The reproduction used a mock LLM server (simulating an attacker-controlled LLM endpoint) to instruct the agent to invoke the bash tool. In a real attack, the attacker would either poison the LLM settings (via the auth-bypassed /settings/llm PUT) to point the agent at an attacker-controlled LLM, or craft a user message that persuades the agent to run a shell command. The code-execution primitive (BashTool with subprocess.run(shell=True)) is the same either way.

Root Cause

The root cause is a loopback peer IP trust without Host header validation:

1. _is_local_client(request) (line 668) checks only request.client.host (the TCP peer address). If it is 127.0.0.1, ::1, localhost, or a trusted Docker gateway, it returns True.

2. _validate_api_auth() (line 645): when API_AUTH_KEY is not configured (dev mode), a loopback client is allowed without any token. When API_AUTH_KEY IS configured, the loopback shortcut is not used — but in dev mode (the default), the bypass is complete.

3. _shell_tools_enabled_for_request(request) (line 727): returns _is_local_client(request) or _env_shell_tools_enabled(). For loopback clients, this is True, enabling the bash and background_run tools in the agent registry.

4. No Host header validation existed — a loopback request carrying Host: attacker.example:8899 was trusted as local. DNS rebinding makes a browser send exactly such a request: the attacker's domain resolves to 127.0.0.1, the browser connects from loopback, and sends Host: attacker.example:8899 (the original hostname) with no bearer token.

5. The BashTool.execute() (line 38 of bash_tool.py) calls subprocess.run(command, shell=True, cwd=cwd, ...) — arbitrary command execution.

Fix (PR #242, commit 6e06017): Added _reject_untrusted_loopback_host middleware that rejects loopback requests carrying an untrusted Host header with HTTP 403 ("Untrusted local API host") before route handlers are reached. Accepted loopback Host values: localhost, 127.0.0.1, ::1, [::1], testserver, plus any configured via API_ALLOWED_HOSTS. Remote clients remain governed by bearer-token auth. Normal loopback dev-mode requests with Host: 127.0.0.1:port continue to work (no regression).

Related fixes in the same v0.1.10 cycle:

• PR #243 (7eb8dea): require explicit opt-in (VIBE_TRADING_ENABLE_SHELL_TOOLS) for agent shell tools — closes the BashTool exposure even if the Host gate is bypassed
• PR #245 (b608fc5): require bearer token for settings WRITE endpoints — closes the credential exfiltration path

Reproduction Steps

1. Script: bundle/repro/reproduction_steps.sh — self-contained, run with PRUVA_ROOT=<bundle_dir> bash bundle/repro/reproduction_steps.sh
2. What the script does:
   • Installs Python dependencies (fastapi, uvicorn, langchain, dnslib, etc.)
   • Clones/reuses the Vibe-Trading repo from the project cache
   • Starts a DNS rebinding server (dns_rebind_server.py) that resolves rebind.attacker.test to 127.0.0.1
   • Proves the DNS rebinding with a real DNS A-record query → 127.0.0.1
   • Starts a mock OpenAI-compatible LLM server (mock_llm_server.py) that returns a bash tool-call instructing the agent to execute id; whoami; echo RCE_CONFIRMED > /tmp/...
   • Phase 1 (vulnerable v0.1.9): Starts the real Vibe-Trading API server (bound to 0.0.0.0:8899, dev mode, mock LLM). Uses curl --resolve rebind.attacker.test:8899:127.0.0.1 to send DNS-rebound HTTP requests with no bearer token:
     • POST /sessions → HTTP 201 (auth bypassed, session created)
     • POST /sessions/{id}/messages → triggers the agent loop → BashTool executes the attacker's command → RCE proof file created
     • PUT /settings/llm → auth-bypassed settings write (credential exfiltration path)
   • Phase 2 (fixed v0.1.10): Same DNS-rebound requests → HTTP 403 ("Untrusted local API host"). Normal loopback with Host: 127.0.0.1:8899 → HTTP 201 (no regression).
   • Writes validation_verdict.json and runtime_manifest.json
3. Expected evidence:
   • logs/dns_rebind_proof.txt: DNS_A:rebind.attacker.test:127.0.0.1
   • logs/vuln_create_session.txt: HTTP 201 with session_id (no auth)
   • logs/vuln_rce_proof.txt: RCE_CONFIRMED
   • logs/vuln_trace.jsonl: tool_call: bash with exit_code: 0, stdout: "uid=1000(vscode)..."
   • logs/fixed_create_session.txt: HTTP 403 {"detail":"Untrusted local API host"}
   • logs/fixed_normal_loopback.txt: HTTP 201 (no regression)

Evidence

All artifacts are under bundle/logs/ and bundle/repro/:

Key trace excerpt (vuln_trace.jsonl):

{"type": "tool_call", "iter": 1, "tool": "bash", "args": {"command": "id; whoami; echo RCE_CONFIRMED > /tmp/vibe_trading_rce_proof_49561.txt", "run_dir": "..."}}
{"type": "tool_result", "iter": 1, "tool": "bash", "status": "ok", "elapsed_ms": 4, "preview": "{\"status\": \"ok\", \"exit_code\": 0, \"stdout\": \"uid=1000(vscode) gid=1000(vscode) groups=1000(vscode),969(969)\\nvscode\\n\", \"stderr\": \"id: cannot find name for group ID 969\\n\"}"}

Vulnerable vs fixed comparison:

Environment:

• Python 3.14.4, FastAPI + uvicorn, langchain-openai (ChatOpenAI)
• Vibe-Trading v0.1.9 (vulnerable) / v0.1.10 (fixed)
• API server bound to 0.0.0.0:8899 (default), dev mode (no API_AUTH_KEY)
• DNS rebinding server: dnslib UDP server on 127.0.0.1:5353
• Mock LLM: http.server on 127.0.0.1:9099 returning OpenAI-compatible tool-call responses

Recommendations / Next Steps

1. Upgrade to v0.1.10 or later — the _reject_untrusted_loopback_host middleware (PR #242) blocks DNS-rebinding Host headers on loopback peers with HTTP 403.
2. Set API_AUTH_KEY in any deployment exposed beyond a single-user localhost — this forces bearer-token auth even for loopback clients when configured, removing the dev-mode bypass.
3. Set VIBE_TRADING_ENABLE_SHELL_TOOLS=1 only when explicitly needed — PR #243 requires explicit opt-in for the BashTool; without it, the RCE primitive is unavailable even if auth is bypassed.
4. Bind to 127.0.0.1 instead of 0.0.0.0 when the API is not meant to be network-accessible.
5. Configure API_ALLOWED_HOSTS if fronting the local API with a specific loopback hostname.
6. Testing: run the security regression tests: PYTHONPATH=agent python -m pytest agent/tests/test_security_auth_api.py -q

Additional Notes

• Idempotency: The script was run twice consecutively; both runs produced identical results (HTTP 201 + RCE on vulnerable, HTTP 403 on fixed). The script cleans up all background processes on exit and uses a PID-suffixed proof file to avoid collisions.
• Mock LLM justification: The reproduction uses a mock OpenAI-compatible LLM server that returns a bash tool-call. This simulates the attack scenario where the attacker either (a) poisons the LLM settings via the auth-bypassed /settings/llm PUT to point at an attacker-controlled LLM, or (b) sends a user message that the agent's LLM responds to with a bash tool-call. The BashTool's subprocess.run(shell=True) is the actual RCE primitive in both cases — the mock LLM merely drives the agent loop to reach it.
• The PUT /settings/llm returned 422 (not 200) on the vulnerable version because the request body did not match the full Pydantic model schema, but the important point is that the request passed authentication (no 401/403) — the auth bypass is confirmed. On the fixed version, the same request returns 403 at the Host-gate middleware before reaching the route handler.
• CORS does not defend against DNS rebinding — after rebinding, the attacker's hostname becomes the browser's same origin, so credentialed CORS requests are sent without cross-origin restrictions.