CVE-2026-5029: Code Runner MCP Server RCE Vulnerability

CVE-2026-5029 Overview

CVE-2026-5029 is an unauthenticated remote code execution vulnerability in the Code Runner Model Context Protocol (MCP) Server. The flaw exists when the server is launched with the --transport http option, which exposes the /mcp JSON-RPC endpoint on TCP port 3088 without any authentication. An attacker on an adjacent network can invoke the run-code MCP tool to supply arbitrary source code, which the server passes to child_process.exec() using the specified language interpreter. The result is arbitrary code execution under the privileges of the user running the server. The issue is tracked under [CWE-306: Missing Authentication for Critical Function] and is documented in the CERT Poland Advisory CVE-2026-5029.

Critical Impact
Unauthenticated attackers reachable on the adjacent network can execute arbitrary operating system commands on the host running Code Runner MCP Server. No patch is available.

Affected Products

Code Runner MCP Server when started with --transport http
All known versions of the project (no fixed release available)
Deployments exposing TCP port 3088 to untrusted networks

Discovery Timeline

2026-05-12 - CVE-2026-5029 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-5029

Vulnerability Analysis

The Code Runner MCP Server implements a JSON-RPC interface used by Model Context Protocol clients to request execution of code snippets in a chosen language. When operators select the HTTP transport, the server binds to port 3088 and serves the /mcp endpoint without enforcing authentication, authorization, or origin checks. Any client able to reach the listening socket can issue JSON-RPC calls.

The exposed run-code tool accepts attacker-controlled source code and a target interpreter. The server forwards the payload to child_process.exec() in Node.js, which spawns a shell to run the supplied program. Because the request requires no credentials, exploitation reduces to a single HTTP POST containing JSON-RPC parameters.

Successful exploitation yields full command execution under the account running the server. Attackers can read or modify files, pivot to internal services, persist on the host, or stage further intrusion activity. The project has not issued a fix.

Root Cause

The root cause is the absence of authentication on a security-sensitive RPC endpoint that exposes a code-execution primitive. The HTTP transport mode treats every caller as trusted and provides the run-code tool with no caller validation, scoping, or sandboxing. This is a direct instance of [CWE-306].

Attack Vector

The attack vector is adjacent network. An attacker who can reach TCP port 3088 on the host running the MCP server sends a JSON-RPC request that invokes the run-code tool with arbitrary source code and a supported interpreter such as bash, python, or node. The server passes the payload to child_process.exec() and returns the output to the caller. No prior authentication, user interaction, or privileged position is required.

Further technical details are available in the CERT Poland Advisory CVE-2026-5029.

Detection Methods for CVE-2026-5029

Indicators of Compromise

Inbound HTTP requests to /mcp on TCP port 3088 from unexpected sources
Child processes such as sh, bash, python, or node spawned by the Code Runner MCP Server process
Outbound network connections originating from the MCP server host shortly after /mcp requests
Creation of unexpected files or scripts in directories writable by the MCP server user

Detection Strategies

Inspect HTTP access logs for POST requests to /mcp containing JSON-RPC method names referencing run-code or tools/call
Alert on process lineage where the MCP server binary is the parent of shell or interpreter processes
Monitor for new listeners on TCP port 3088 across the fleet and flag any exposure beyond loopback

Monitoring Recommendations

Capture and retain network flow data for port 3088 to support investigation and threat hunting
Enable endpoint telemetry that records command-line arguments for child processes of Node.js services
Forward MCP server stdout and stderr to a centralized log store for correlation with network events

How to Mitigate CVE-2026-5029

Immediate Actions Required

Stop running Code Runner MCP Server with the --transport http option on untrusted networks
Bind the server to 127.0.0.1 only and require a local client, or block port 3088 at the host firewall
Place the service behind an authenticating reverse proxy that enforces mutual TLS or token-based access control
Run the server as a low-privileged user inside a container or sandbox with no outbound network access

Patch Information

No official patch is available at the time of publication. The CERT Poland advisory states that the vulnerability has not been fixed and may affect the project in all versions. Operators should track the upstream repository and the CERT Poland Advisory CVE-2026-5029 for fix availability.

Workarounds

Use the stdio transport instead of HTTP transport for local MCP client integrations
Restrict TCP port 3088 to loopback with host-based firewall rules until a fix is released
Terminate any production deployments of Code Runner MCP Server that cannot be isolated from untrusted networks

bash

# Configuration example: restrict Code Runner MCP Server to localhost
# Block external access to port 3088 with iptables
iptables -A INPUT -p tcp --dport 3088 ! -s 127.0.0.1 -j DROP

# Or run the server bound to loopback only (preferred)
code-runner-mcp --transport stdio