CVE-2026-58169 describes a DNS rebinding authentication bypass vulnerability in HKUDS Vibe-Trading prior to version 0.1.10. The vulnerability arises because the server trusts TCP peer addresses for loopback clients and lacks proper Host header validation when binding to 0.0.0.0 with credentialed CORS enabled. An attacker can craft a malicious DNS rebinding page to issue authenticated requests to the local API server, access the shell execution endpoint configured with a bash-enabled preset, and execute arbitrary code remotely as the API process user. Additionally, the attacker can overwrite LLM and data-source settings to exfiltrate credentials. The CVSS 3.1 score is 7.5, indicating high severity, with network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to bypass bearer-token authentication, execute arbitrary shell commands remotely as the API process user, and exfiltrate sensitive credentials by modifying local settings. This compromises confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the API server from untrusted networks, disable credentialed CORS if possible, and implement network-level protections to prevent DNS rebinding attacks.