Cua computer-server versions before 0.3.42 skip authentication when the CONTAINER_NAME environment variable is unset and bind to all interfaces by default, allowing unauthenticated attackers to execute arbitrary commands. Attackers can reach TCP port 8000 to run shell commands via the run_command endpoint, read and write arbitrary files through file operation endpoints, and access interactive PTY shells without authentication.

Cua computer-server versions before 0.3.42 contain a critical authentication bypass vulnerability triggered when the CONTAINER_NAME environment variable is unset. The server binds to all network interfaces by default, exposing TCP port 8000 to unauthenticated attackers. Exploitation allows arbitrary shell command execution via the run_command endpoint, unrestricted file read/write through file operation endpoints, and access to interactive PTY shells without any credentials. The vulnerability is particularly dangerous due to its default exposure and ease of exploitation. A fix was introduced in version 0.3.42 via commit 59cf25c0ec54. The issue was tracked and reported via GitHub issue #1892. Organizations using affected versions should upgrade immediately to mitigate risk of full system compromise.