CVE-2026-79403: Kilo Code's local server let other programs switch on 'allow everything' without a password

Vulnerability · Kilo Code · HIGH

Incident dateNot stated

DisclosedSep 29, 2026 (CVE and NVD). Fix released Jul 3, 2026 in 7.4.1.

Added hereOct 14, 8:20 AM ET

Last verifiedOct 14, 2026

Summary

CVE-2026-79403 covers Kilo Code, an open-source AI coding agent. Its CLI runs a local HTTP server, and the /permission/allow-everything endpoint, which saves wildcard approvals for the agent's tools and commands, could be called without authentication. The daemon's password also defaulted to the fixed string 'kilo'. According to the fix, that left the endpoint reachable by local scripts and by browser requests that could find the server's port. NVD describes the result as arbitrary code execution by a local attacker. Kilo Code 7.4.1, released Jul 3, 2026, fixes it.

Severity

HIGH Anything running locally could turn off the approval checks that sit between the agent and your shell. The score shown on NVD, from CISA's ADP, is CVSS 3.1 8.4 High (local, no privileges, no user interaction). Fixed in 7.4.1.

Timeline

Jul 3, 2026
Pull request #11887, 'fix(cli): require auth for allow everything endpoint', is merged, and Kilo Code v7.4.1 is released the same day.
Sep 29, 2026
CVE-2026-79403 is published and appears on NVD and in GitHub's advisory database as GHSA-vmfg-8hhv-69wh: Kilo Code before 7.4.1 affected.

How it happened

The allow-everything route stayed callable on localhost when the server ran without global authentication, and the daemon's own credential was a fixed default. The fix makes this endpoint fail closed unless credentials are configured, gives TUI worker servers a generated password, and replaces the fixed 'kilo' password with a generated one, restarting daemons that still use the old password. NVD lists CWE-280 (Improper Handling of Insufficient Privileges), and a proof of concept is linked from the CVE record. The v7.4.1 release notes do not mention the fix. We checked on GitHub that the fix commit (51e45d7fb7) is in v7.4.1 and not in v7.4.0.

How to check your app

Check which version of the Kilo Code CLI you have installed and update to 7.4.1 or later.
If you run kilo serve, configure server credentials instead of leaving it without authentication.
On shared or multi-user machines, remember that other local users and processes can reach localhost ports.

Sources

Corrections and updates

None. Re-checked against every source on Oct 14, 2026.

If you want someone to check your own app for problems like this, LockedVibe, which has the same owner as this site, lists its security scans on its pricing page. Disclosure.