CVE-2026-30624
Published: 15 April 2026
Summary
CVE-2026-30624 is a high-severity Command Injection (CWE-77) vulnerability in Agent-Zero Agent-Zero. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as AI Agent Protocols and Integrations; in the Protocol-Specific Risks risk domain.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-9 (Information Input Restrictions).
Deeper analysis
Agent Zero version 0.9.8 is affected by CVE-2026-30624, a remote code execution vulnerability in its External MCP Servers configuration feature. The application permits users to specify MCP servers through a JSON configuration that includes arbitrary command and args values. These values are executed by the application upon applying the configuration, lacking adequate validation or restrictions, which enables attackers to supply malicious configurations for executing arbitrary operating system commands. This issue, published on 2026-04-15, carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) and is associated with CWE-77 (Command Injection).
The vulnerability can be exploited remotely by unauthenticated attackers over the network with low complexity and no user interaction required. By providing a crafted MCP server configuration, an attacker can trigger execution of arbitrary OS commands with the privileges of the Agent Zero process, potentially leading to remote code execution. The impact includes low confidentiality and integrity effects alongside high availability disruption, allowing control over the host system depending on the process context.
For mitigation details, refer to the advisory at https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem/, which covers RCE vulnerabilities in the MCP supply chain across the AI ecosystem.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-22943
Vulnerability details
Agent Zero 0.9.8 contains a remote code execution vulnerability in its External MCP Servers configuration feature. The application allows users to define MCP servers using a JSON configuration containing arbitrary command and args values. These values are executed by the…
more
application when the configuration is applied without sufficient validation or restriction. An attacker may supply a malicious MCP configuration to execute arbitrary operating system commands, potentially resulting in remote code execution with the privileges of the Agent Zero process.
- CWE(s)
AI Security AnalysisAI
- AI Category
- AI Agent Protocols and Integrations
- Risk Domain
- Protocol-Specific Risks
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: mcp
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote command injection in JSON configuration feature enables exploitation of public-facing application (T1190) for arbitrary OS command execution (T1059).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the lack of validation on JSON configuration inputs containing arbitrary command and args values, preventing command injection and RCE.
Enforces restrictions on inputs to the External MCP Servers configuration feature, blocking acceptance of malicious arbitrary OS commands.
Limits who can apply MCP server configurations, mitigating unauthenticated remote supply of malicious JSON configs.