CVE-2026-10688: Blender-MCP Code Injection Vulnerability

CVE-2026-10688 Overview

CVE-2026-10688 is a code injection vulnerability in the ahujasid blender-mcp project, a Model Context Protocol (MCP) server that bridges large language models with Blender. The flaw resides in the execute_blender_code function defined in /src/blender_mcp/server.py. An attacker can manipulate the code argument to inject and execute arbitrary code remotely. The exploit has been publicly disclosed and the project maintainer has not responded to the issue report. Because blender-mcp follows a rolling release model, no fixed version is identified. The vulnerability is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Remote attackers with low-level privileges can inject arbitrary code through the execute_blender_code MCP tool, leading to unauthorized execution within the Blender process context.

Affected Products

ahujasid/blender-mcp repository up to commit 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b
Any deployment exposing the MCP server's execute_blender_code tool
Rolling release distributions of the project (no discrete version identifiers)

Discovery Timeline

2026-06-02 - CVE-2026-10688 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-10688

Vulnerability Analysis

The blender-mcp server exposes a Model Context Protocol tool named execute_blender_code that accepts a code parameter and passes it to the Blender Python runtime. The implementation does not sanitize, sandbox, or restrict the supplied code before execution. Any client that can reach the MCP endpoint can submit arbitrary Python statements, which Blender then evaluates with the privileges of the running process. This pattern aligns with [CWE-74] injection weaknesses where untrusted input flows into a sensitive downstream interpreter.

The exploit has been publicly disclosed through the project's issue tracker. According to the GitHub Issue Tracker and VulDB Vulnerability Details, the maintainer has not acknowledged the report.

Root Cause

The root cause is the absence of input validation and execution sandboxing in execute_blender_code. The function trusts the code argument as legitimate Blender automation input and forwards it directly to a Python evaluator. There is no allowlist of permitted operations, no AST inspection, and no separation between LLM-generated automation and arbitrary system access.

Attack Vector

The attack vector is network-based and requires low privileges combined with user interaction, typically through an MCP client session. An attacker submits crafted Python code through the code argument of the execute_blender_code tool. The Blender process then executes the payload, allowing file access, subprocess invocation, or further pivoting depending on the host configuration. Because MCP servers are often invoked by AI assistants, a malicious prompt or compromised tool catalog can trigger exploitation indirectly.

No verified proof-of-concept code is published in this article. Refer to the GitHub PoC Repository and VulDB CVE Summary for additional technical context.

Detection Methods for CVE-2026-10688

Indicators of Compromise

Unexpected child processes spawned by the Blender or blender-mcp server process, such as shell interpreters or network utilities.
MCP request logs containing execute_blender_code invocations with payloads referencing os, subprocess, socket, eval, or __import__.
Outbound network connections originating from the Blender process to untrusted destinations.
New or modified files in user directories shortly after MCP tool invocations.

Detection Strategies

Inspect MCP server logs for execute_blender_code arguments and flag payloads that import system or networking modules.
Apply runtime process monitoring to alert on Blender spawning interpreters, package managers, or remote access tooling.
Correlate MCP client identity with tool calls to detect unauthorized or anomalous code execution requests.

Monitoring Recommendations

Forward MCP server stdout, stderr, and tool invocation telemetry to a centralized logging platform for retention and analysis.
Enable host-based endpoint telemetry on workstations running blender-mcp to capture process lineage and file system changes.
Track network egress from Blender processes and alert on connections outside expected automation endpoints.

How to Mitigate CVE-2026-10688

Immediate Actions Required

Disable or remove the execute_blender_code tool from MCP server configurations until a patched build is verified.
Restrict blender-mcp to localhost and authenticated clients; do not expose it to untrusted networks.
Run the MCP server under a dedicated low-privilege user account with no access to sensitive files or credentials.
Audit MCP client allowlists and remove any catalog entries that route LLM prompts to this tool without human review.

Patch Information

No official patch is available. The project uses a rolling release strategy and the maintainer has not yet responded to the disclosure tracked at the GitHub Issue Tracker. Monitor the GitHub PoC Repository for commits that introduce input validation or sandboxing on execute_blender_code.

Workarounds

Fork the repository and modify execute_blender_code to enforce an allowlist of Blender API calls through AST inspection before execution.
Execute the MCP server inside a container or virtual machine with no network egress and minimal mounted file systems.
Place a reviewing proxy in front of the MCP endpoint that requires human approval for any execute_blender_code invocation.
Remove the tool registration entirely and rely on safer, parameterized Blender automation endpoints.

bash

# Example: run blender-mcp inside an isolated, non-privileged sandbox
useradd -r -s /usr/sbin/nologin blendermcp
sudo -u blendermcp firejail --net=none --private \
  --whitelist=/opt/blender-mcp \
  python /opt/blender-mcp/src/blender_mcp/server.py