CVE-2026-81836 RooCodeInc CVE debrief

Who should care

Users of RooCodeInc Roo-Code up to 3.51.1 should verify their configurations and apply vendor remediation if available. This includes operators, platform administrators, vulnerability management teams, and security teams who may be impacted by the vulnerability. Additionally, users should review compensating controls for exposed systems while remediation is scheduled and verified. Monitoring and detection logs for exposed assets should also be reviewed to ensure extra review is conducted where necessary. Affected product deployments should be confirmed in managed environments and an owner assigned for follow-up. Vendor-supported updates or mitigations should be planned through normal change control where exposure is confirmed. Exceptions should be tracked, and remediated assets retested, with the item only closed after evidence is documented. The CVE record was published on 2026-08-28T00:18:21.783Z and has not been modified since then. The NVD entry is currently Deferred. The vulnerability has a CVSS score of 2.9 and a severity of LOW. The attack may be performed from remote. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit is now public and may be used. Multiple issues were reported to the vendor beforehand. They explain, that 'they all apply to Roo Code, a project we no longer support - the repository was archived a while ago, and we don't encourage anyone to use it.' This vulnerability only affects products that are no longer supported by the maintainer. The CVE record was published on 2026-08-28T00:18:21.783Z and has not been modified since then. The NVD entry is currently Deferred. The vulnerability has a CVSS score of 2.9 and a severity of LOW. The attack may be performed from remote. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit is now public and may be used. Multiple issues were reported to the vendor beforehand. They explain, that 'they all apply to Roo Code, a project we no longer support - the repository was archived a while ago, and we don't encourage anyone to use it.' This vulnerability only affects products

Technical summary

The CVE-2026-81836 vulnerability was detected in RooCodeInc Roo-Code up to 3.51.1, affecting the OAuth Callback component. The attack results in cleartext transmission of sensitive information and requires high complexity. Exploitability is difficult, and the exploit is now public. Multiple issues were reported to the vendor beforehand, who stated that they no longer support the project. The vulnerability has a CVSS score of 2.9 and a severity of LOW.

Defensive priority

Low complexity attacks may be feasible; verify and apply vendor remediation if available.

Recommended defensive actions

• Verify affected product versions and configurations.
• Apply vendor remediation if available.
• Implement compensating controls to mitigate cleartext transmission of sensitive information.
• Monitor for potential exploitation attempts.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE-2026-81836 vulnerability was detected in RooCodeInc Roo-Code up to 3.51.1, affecting the OAuth Callback component. The attack results in cleartext transmission of sensitive information and requires high complexity. Exploitability is difficult, and the exploit is now public. Multiple issues were reported to the vendor beforehand, who stated that they no longer support the project.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.