CVE-2026-42302: Code Server Auth None Unauthenticated Rce
code-server is started with '--auth none', completely disabling all authentication. Any user with network access to the bound port can open the VS Code IDE without credentials and execute arbitrary commands inside the container (CVE-2026-42302 / CWE-306). Replace '--auth none' with '--auth password' or '--auth cookie', and bind to 127.0.0.1 rather than 0.0.0
Bashgreprules fetch cve-2026-42302-code-server-auth-none-unauthenticated-rce --engine opengrepDescription
code-server is started with '--auth none', completely disabling all authentication. Any user with network access to the bound port can open the VS Code IDE without credentials and execute arbitrary commands inside the container (CVE-2026-42302 / CWE-306). Replace '--auth none' with '--auth password' or '--auth cookie', and bind to 127.0.0.1 rather than 0.0.0
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.