PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45374 Hmbown CVE debrief

CodeWhale is a terminal-based coding agent integrating DeepSeek and MiMo. In versions prior to 0.8.26, the task_create tool spawns durable sub-agents that inherit two insecure defaults: allow_shell defaults to true (config.rs:1499) and auto_approve defaults to true (task_manager.rs:297). When a user approves a task_create call—which itself requires explicit approval (ApprovalRequirement::Required)—they approve what appears to be a benign work prompt. However, the spawned sub-agent silently receives unrestricted, unapproved shell access. This creates a critical authorization bypass where explicit user consent for the parent task is exploited to grant hidden shell capabilities to child agents. The vulnerability is fixed in version 0.8.26.

Vendor
Hmbown
Product
CodeWhale
CVSS
CRITICAL 9.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-30
Advisory published
2026-05-28
Advisory updated
2026-05-30

Who should care

Organizations and developers using CodeWhale terminal coding agents for automated development workflows, particularly those operating in multi-tenant or sensitive environments where unapproved shell execution poses significant risk.

Technical summary

The task_create tool in CodeWhale < 0.8.26 spawns sub-agents with allow_shell=true and auto_approve=true by default. User approval of the parent task_create call—gated by ApprovalRequirement::Required—is insufficient to prevent unauthorized shell access in spawned sub-agents, resulting in critical authorization bypass.

Defensive priority

CRITICAL

Recommended defensive actions

  • Upgrade CodeWhale to version 0.8.26 or later to remediate the insecure default configuration in task_create sub-agents
  • Review any existing task_create sub-agents spawned prior to upgrade for unauthorized shell activity
  • Audit task configurations to verify allow_shell and auto_approve are explicitly set to false where shell access is not required
  • Implement additional approval workflows for sub-agent creation if application architecture permits
  • Monitor for anomalous shell execution patterns in environments where CodeWhale agents operate

Evidence notes

Vulnerability description sourced from official CVE record and NVD entry. Code locations (config.rs:1499, task_manager.rs:297) and default values (allow_shell.unwrap_or(true), auto_approve: Some(true)) cited from CVE description. Fix version 0.8.26 confirmed via GitHub release reference. CVSS 9.6 (Critical) reflects network attack vector, low complexity, no privileges required, user interaction required, changed scope, and high impact across confidentiality, integrity, and availability. CWE-94 (Improper Control of Generation of Code) identified as primary weakness.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45374 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45374

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45374 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45374

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.