CVE-2026-5802
Published: 08 April 2026
Summary
CVE-2026-5802 is a medium-severity Command Injection (CWE-77) vulnerability. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 38.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as AI Agent Protocols and Integrations; in the Protocol-Specific Risks risk domain.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
A vulnerability tracked as CVE-2026-5802 exists in idachev mcp-javadc up to version 1.2.4 within an unknown function of the HTTP Interface component. Manipulation of the jarFilePath argument permits OS command injection, corresponding to CWE-77 and CWE-78, and the issue can be triggered remotely without authentication.
Attackers with network access can supply a malicious jarFilePath value to execute arbitrary operating system commands on the affected server. A publicly available exploit has been disclosed, and the project maintainers were notified via an issue report but have not responded.
The listed references consist of GitHub repository links and Vuldb entries that document the flaw and the lack of a vendor reply, with no patches or mitigation steps provided.
The EPSS score rose from a low starting value to a peak of 0.0176 on 2026-04-16 shortly after the April 8 disclosure before receding to the current 0.0040, indicating a temporary increase in exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-20623
Vulnerability details
A vulnerability was identified in idachev mcp-javadc up to 1.2.4. Impacted is an unknown function of the component HTTP Interface. Such manipulation of the argument jarFilePath leads to os command injection. It is possible to launch the attack remotely. The…
more
exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
- CWE(s)
AI Security AnalysisAI
- AI Category
- AI Agent Protocols and Integrations
- Risk Domain
- Protocol-Specific Risks
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: mcp
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in public-facing HTTP interface directly enables T1190 (Exploit Public-Facing Application) and facilitates T1059 (Command and Scripting Interpreter) for arbitrary OS command execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates OS command injection by requiring validation of untrusted HTTP inputs such as the jarFilePath argument in the vulnerable interface.
Requires timely identification, reporting, and correction of flaws like this command injection vulnerability in mcp-javadc versions up to 1.2.4.
Boundary protection at network interfaces can deploy web application firewalls to filter and block malicious jarFilePath payloads targeting the HTTP interface.