Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain

What happened?

Summary: 5 findings — unauthenticated full-API exposure (F1, lead Critical), read-side authorization gap that persists even with API_AUTH_KEY set (F2), unauthenticated file write of.py/.sh/.yaml to a server-returned path (F3), default-permissive CORS that combines with a loopback-only check to grant any browser page on whitelisted localhost ports credentialed cross-origin access (F-A4), and partial API-key disclosure via _mask_secret() (F-A5). --- Shared baseline (applies t

Key details

• An unauthenticated attacker can create a session, send a message, and trigger the LLM agent to execute arbitrary shell commands as root via BashTool.
• Read endpoints such as /sessions/{id}/messages and /runs lack authentication dependencies even when API_AUTH_KEY is set, exposing full session history including secrets.
• The Dockerfile runs the FastAPI process as root (uid=0) with no USER directive, and docker-compose binds port 8899 to 0.0.0.0 without network restrictions.

Summarised by SecOraLens from GitHub Security Advisories. Always read the original source before acting. How SecOraLens verifies advisories.