CVE-2026-30624

HighRCE

Published: 15 April 2026

Published

15 April 2026

Modified

20 April 2026

KEV Added

—

Patch

—

CVSS Score 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

EPSS Score 0.0032 55.4th percentile

Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-30624 is a high-severity Command Injection (CWE-77) vulnerability in Agent-Zero Agent-Zero. Its CVSS base score is 8.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 44.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

This vulnerability is AI-related — categorised as AI Agent Protocols and Integrations; in the Protocol-Specific Risks risk domain.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-9 (Information Input Restrictions).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly addresses the lack of validation on JSON configuration inputs containing arbitrary command and args values, preventing command injection and RCE.

SI-9 Information Input Restrictions good match

prevent

Enforces restrictions on inputs to the External MCP Servers configuration feature, blocking acceptance of malicious arbitrary OS commands.

CM-5 Access Restrictions for Change partial match

prevent

Limits who can apply MCP server configurations, mitigating unauthenticated remote supply of malicious JSON configs.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059 Command and Scripting Interpreter Execution

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

attack.mitre.org →

Why these techniques?

Unauthenticated remote command injection in JSON configuration feature enables exploitation of public-facing application (T1190) for arbitrary OS command execution (T1059).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Agent Zero 0.9.8 contains a remote code execution vulnerability in its External MCP Servers configuration feature. The application allows users to define MCP servers using a JSON configuration containing arbitrary command and args values. These values are executed by the…

application when the configuration is applied without sufficient validation or restriction. An attacker may supply a malicious MCP configuration to execute arbitrary operating system commands, potentially resulting in remote code execution with the privileges of the Agent Zero process.

Deeper analysisAI

Agent Zero version 0.9.8 is affected by CVE-2026-30624, a remote code execution vulnerability in its External MCP Servers configuration feature. The application permits users to specify MCP servers through a JSON configuration that includes arbitrary command and args values. These values are executed by the application upon applying the configuration, lacking adequate validation or restrictions, which enables attackers to supply malicious configurations for executing arbitrary operating system commands. This issue, published on 2026-04-15, carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) and is associated with CWE-77 (Command Injection).

The vulnerability can be exploited remotely by unauthenticated attackers over the network with low complexity and no user interaction required. By providing a crafted MCP server configuration, an attacker can trigger execution of arbitrary OS commands with the privileges of the Agent Zero process, potentially leading to remote code execution. The impact includes low confidentiality and integrity effects alongside high availability disruption, allowing control over the host system depending on the process context.

For mitigation details, refer to the advisory at https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem/, which covers RCE vulnerabilities in the MCP supply chain across the AI ecosystem.