CVE-2026-30624
Published: 15 April 2026
Description
Agent Zero 0.9.8 contains a remote code execution vulnerability in its External MCP Servers configuration feature. The application allows users to define MCP servers using a JSON configuration containing arbitrary command and args values. These values are executed by the…
more
application when the configuration is applied without sufficient validation or restriction. An attacker may supply a malicious MCP configuration to execute arbitrary operating system commands, potentially resulting in remote code execution with the privileges of the Agent Zero process.
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the lack of validation on JSON configuration inputs containing arbitrary command and args values, preventing command injection and RCE.
Enforces restrictions on inputs to the External MCP Servers configuration feature, blocking acceptance of malicious arbitrary OS commands.
Limits who can apply MCP server configurations, mitigating unauthenticated remote supply of malicious JSON configs.
Security SummaryAI
Agent Zero version 0.9.8 is affected by CVE-2026-30624, a remote code execution vulnerability in its External MCP Servers configuration feature. The application permits users to specify MCP servers through a JSON configuration that includes arbitrary command and args values. These values are executed by the application upon applying the configuration, lacking adequate validation or restrictions, which enables attackers to supply malicious configurations for executing arbitrary operating system commands. This issue, published on 2026-04-15, carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) and is associated with CWE-77 (Command Injection).
The vulnerability can be exploited remotely by unauthenticated attackers over the network with low complexity and no user interaction required. By providing a crafted MCP server configuration, an attacker can trigger execution of arbitrary OS commands with the privileges of the Agent Zero process, potentially leading to remote code execution. The impact includes low confidentiality and integrity effects alongside high availability disruption, allowing control over the host system depending on the process context.
For mitigation details, refer to the advisory at https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem/, which covers RCE vulnerabilities in the MCP supply chain across the AI ecosystem.
Details
- CWE(s)
Affected Products
AI Security AnalysisAI
- AI Category
- AI Agent Protocols and Integrations
- Risk Domain
- Protocol-Specific Risks
- OWASP Top 10 for LLMs 2025
- None mapped
- MITRE ATLAS Techniques
- None mapped
- Classification Reason
- Matched keywords: mcp, mcp, mcp
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote command injection in JSON configuration feature enables exploitation of public-facing application (T1190) for arbitrary OS command execution (T1059).