Critical flaw in open-source 'Cua' AI agent server lets anyone skip the login screen
A missing environment variable is all it takes to bypass authentication entirely — but only if you've actually installed the thing.
What’s actually broken
A newly published vulnerability, CVE-2026-86121, has landed with the maximum-alarm CVSS score of 9.8 out of 10. That’s the rating reserved for bugs that are trivial to exploit, need no login, and can be fired off remotely — so it’s worth working out exactly what it touches before anyone starts panicking.
The affected software is computer-server, a component of trycua/cua, an open-source project for building “computer-use” AI agents — the kind of tool that lets an AI model actually click, type and control a desktop rather than just chat. It’s a reasonably popular project on GitHub, with tens of thousands of stars, aimed squarely at developers building automation and agent-testing fleets, not consumer software most people will have on their laptops.
How the bug actually works
According to NVD’s summary, versions of computer-server before 0.3.42 skip authentication entirely if the CONTAINER_NAME environment variable is left unset — and by default the server also binds to all network interfaces rather than just localhost. Put those two things together and you get a service that’s both listening to the wider network and, in the right misconfiguration, waving unauthenticated requests straight through, apparently allowing an attacker to execute commands on the machine.
In plain terms: this isn’t some obscure cryptographic edge case. It’s closer to leaving a service exposed with no lock on the door, provided the deployer never set one particular configuration value.
So who is actually at risk
This affects people and organisations who have deliberately deployed computer-server as part of a Cua agent setup — think developers spinning up fleets of virtual machines to test or run AI agents, not everyday users of a phone, browser or games console. If you’ve never heard of “Cua” or “computer-use agents” before this article, you almost certainly don’t run this software.
For the people who do run it, exposure depends heavily on how it was deployed. If CONTAINER_NAME was set correctly and the server was kept off public-facing networks — standard practice for any internal tooling — the practical risk is much lower than the headline score suggests. If it was deployed carelessly, on a machine with an open network interface, the picture is considerably worse.
What we don’t yet know, and NVD’s listing doesn’t tell us, is whether this bug has been exploited in the wild, or how many real-world instances of computer-server are sitting exposed on the internet right now. Those are the questions that would turn this from “a serious bug in a niche dev tool” into “an active incident.”
What to do about it
The version threshold given — before 0.3.42 — implies a fix is available upstream, so anyone running computer-server should update immediately and explicitly set CONTAINER_NAME rather than relying on defaults. It’s also worth checking that the server isn’t needlessly bound to every network interface; restricting it to localhost or a trusted internal network removes most of the danger even before patching.
The takeaway
This is a genuinely severe flaw, but a narrow one: it hits developers and organisations running a specific open-source AI-agent server, not the general public. If that’s you, patch now and don’t leave configuration defaults to chance. If it isn’t, there’s nothing here that changes what’s on your own devices today.