Is CVE-2026-86124 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-86124?

CVE-2026-86124 has a CVSS v3 severity of CRITICAL (9.8).

Back

CVE-2026-86124

Description

AutoAgent contains an unauthenticated remote code execution vulnerability in the TCP server that binds to all interfaces and executes attacker-supplied commands as root. Attackers can connect to the exposed communication port and execute arbitrary bash commands within the container, gaining access to bind-mounted host workspace directories.