CVE-2026-44717: MCP Calculate Server RCE Vulnerability

CVE-2026-44717 Overview

CVE-2026-44717 is a remote code execution vulnerability in MCP Calculate Server, a mathematical calculation service built on the Model Context Protocol (MCP) and the SymPy library. Versions prior to 0.1.1 pass user-supplied mathematical expressions directly to Python's eval() function without input sanitization. Attackers can submit crafted expressions that execute arbitrary Python code in the context of the server process. The issue is tracked as CWE-94: Improper Control of Generation of Code and is fixed in version 0.1.1.

Critical Impact
Unauthenticated attackers can achieve remote code execution on hosts running vulnerable MCP Calculate Server instances by submitting malicious calculation requests.

Affected Products

MCP Calculate Server versions prior to 0.1.1
Applications and AI agent workflows that embed the vulnerable MCP Calculate Server as a calculation backend
MCP-based toolchains exposing the calculation endpoint over a network

Discovery Timeline

2026-05-15 - CVE-2026-44717 published to NVD
2026-05-18 - Last updated in NVD database

Technical Details for CVE-2026-44717

Vulnerability Analysis

MCP Calculate Server exposes a calculation tool through the MCP protocol. The server accepts mathematical expressions from MCP clients and evaluates them using SymPy. In versions prior to 0.1.1, the server invokes Python's built-in eval() directly on attacker-controlled input. Because eval() interprets any valid Python expression, the server executes whatever code an attacker embeds in the request.

The vulnerability requires no authentication, no user interaction, and is reachable over the network wherever the MCP endpoint is exposed. Successful exploitation grants the attacker code execution under the privileges of the server process, which typically has access to local files, environment variables, API keys, and outbound network connectivity. In agentic AI deployments, the calculator is often chained behind a large language model, so a prompt-injected model can trigger exploitation indirectly.

Root Cause

The root cause is the use of eval() as a parser for arithmetic input, with no allowlist of permitted tokens, no abstract syntax tree (AST) inspection, and no sandboxing. Python's eval() resolves attribute access, imports through dunder traversal, and function calls, so any string that reaches it is effectively code. A safer design would use sympy.sympify() with evaluate=False and a restricted symbol set, or ast.literal_eval() for purely numeric inputs.

Attack Vector

An attacker connects to the MCP Calculate Server endpoint as an MCP client and submits a calculation request whose expression field contains a Python payload. Common payloads use dunder traversal such as __import__('os').system(...) or __builtins__ access to spawn subprocesses, write files, or open reverse shells. In LLM-integrated environments, the payload can also be delivered indirectly by injecting it into model context that the agent then forwards to the calculator tool.

Detection Methods for CVE-2026-44717

Indicators of Compromise

MCP calculation requests whose expression parameter contains Python dunder tokens such as __import__, __builtins__, __class__, __subclasses__, or __globals__.
Calls to os, subprocess, socket, pty, or compile appearing inside calculator inputs or server logs.
Child processes spawned by the MCP Calculate Server interpreter, especially shells (/bin/sh, bash, cmd.exe, powershell.exe).
Unexpected outbound network connections originating from the Python process hosting the MCP server.

Detection Strategies

Log every MCP tool invocation with full input arguments and alert on expressions containing non-mathematical tokens or characters outside an arithmetic allowlist.
Apply EDR behavioral rules that flag the calculator process spawning shells, interpreters, or network utilities.
Hunt across application telemetry for SymPy or eval errors followed by anomalous process creation on the same host.

Monitoring Recommendations

Forward MCP server logs and host process telemetry into a centralized analytics platform and correlate tool-call payloads with process and network events.
Baseline normal calculator inputs and alert on length, character class, or token deviations.
Monitor outbound DNS and HTTP from systems running MCP tools to identify command-and-control beacons following exploitation.

How to Mitigate CVE-2026-44717

Immediate Actions Required

Upgrade MCP Calculate Server to version 0.1.1 or later on all hosts and container images.
Inventory MCP toolchains and AI agent stacks to identify any embedded copies of the vulnerable package.
Restrict network exposure of the MCP endpoint to trusted clients only, using network policies or authenticated transports.
Rotate any credentials, tokens, or API keys accessible to the server process if exploitation cannot be ruled out.

Patch Information

The maintainer fixed the issue in MCP Calculate Server 0.1.1 by removing unsafe use of eval() on user-supplied expressions. Details and the patched release are described in the GitHub Security Advisory GHSA-2mgq-7rfg-rwpj. Operators should pin to >=0.1.1 in dependency manifests and rebuild downstream container images.

Workarounds

If patching is not immediately possible, place the MCP server behind an input filter that rejects any expression containing characters outside the set [0-9+\-*/().\s] and known SymPy function names.
Run the MCP Calculate Server as an unprivileged user inside a minimal container with no outbound network access and a read-only filesystem.
Disable or unregister the calculator tool from agent toolchains until the upgrade is verified in production.

bash

# Configuration example: upgrade and constrain the MCP Calculate Server
pip install --upgrade "mcp_calculate_server>=0.1.1"

# Verify the installed version
python -c "import importlib.metadata as m; print(m.version('mcp_calculate_server'))"

# Run under a restricted systemd unit (excerpt)
# /etc/systemd/system/mcp-calc.service
# [Service]
# User=mcpcalc
# NoNewPrivileges=true
# ProtectSystem=strict
# ProtectHome=true
# PrivateTmp=true
# RestrictAddressFamilies=AF_INET AF_INET6
# IPAddressDeny=any
# IPAddressAllow=127.0.0.1/32