CVE-2026-55580: mcp-shell Unrestricted RCE Vulnerability

CVE-2026-55580 Overview

CVE-2026-55580 affects mcp-shell, a Model Context Protocol (MCP) server that executes shell commands on behalf of a connected large language model (LLM). Versions prior to 0.6.0 ship with Security.Enabled initialized to false in config.go. When the MCP_SHELL_SEC_CONFIG_FILE environment variable is unset, the documented bare-binary deployment starts without a security policy. The SecurityValidator.validateCommand function in security.go then short-circuits and permits every command supplied to the shell_exec MCP tool. An LLM connected over stdio can execute arbitrary operating system commands as the mcp-shell process user. This issue is tracked under [CWE-78] and is fixed in version 0.6.0.

Critical Impact
An LLM with access to a default mcp-shell deployment can execute unrestricted OS commands as the process user, resulting in full local compromise of confidentiality, integrity, and availability.

Affected Products

sonirico/mcp-shell versions prior to 0.6.0
Documented README from-source installations that omit MCP_SHELL_SEC_CONFIG_FILE
MCP client configurations following the default upstream guidance

Discovery Timeline

2026-08-25 - CVE-2026-55580 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-55580

Vulnerability Analysis

The root defect is an insecure default configuration that collapses the security policy check on the command execution path. The SecurityConfig struct in config.go declares an Enabled bool field that defaults to Go's zero value, which is false. On startup, main.go reads MCP_SHELL_SEC_CONFIG_FILE. When that variable is not set, no policy is loaded and Security.Enabled remains false. The shell_exec tool then forwards every incoming command to the operating system without allowlist, blocklist, or pattern checks.

Because the tool is exposed to an LLM over standard input/output (stdio), any prompt injection or adversarial output that reaches the model can be translated directly into shell execution. The vulnerability class is Command Injection through missing authorization, not through parser abuse.

Root Cause

The SecurityValidator.validateCommand function in security.go returns early with a permissive result when Security.Enabled is false. The upstream README documents installation and MCP client configuration without setting MCP_SHELL_SEC_CONFIG_FILE, so the insecure state is the documented default rather than an operator misconfiguration.

Attack Vector

An attacker requires a channel that can influence the connected LLM's tool calls. This includes prompt injection through untrusted documents, indirect injection through retrieved content, or direct access to the MCP session. Once the model issues a shell_exec call, commands execute as the mcp-shell process user with that user's full filesystem and network privileges.

// Source: https://github.com/sonirico/mcp-shell/commit/f31377fce6ec31114e5a4398c0e5270552bce09f
// Patch context in config.go - SecurityConfig struct
type SecurityConfig struct {
    Enabled            bool          `yaml:"enabled"`
    AllowedCommands    []string      `yaml:"allowed_commands"`    // Deprecated: use AllowedExecutables
    BlockedCommands    []string      `yaml:"blocked_commands"`    // Deprecated: use validation instead
    BlockedPatterns    []string      `yaml:"blocked_patterns"`    // Deprecated: use validation instead
    AllowedExecutables []string      `yaml:"allowed_executables"` // Secure: list of allowed executable paths
    MaxExecutionTime   time.Duration `yaml:"max_execution_time"`
    WorkingDirectory   string        `yaml:"working_directory"`
    RunAsUser          string        `yaml:"run_as_user"`
    MaxOutputSize      int           `yaml:"max_output_size"`
    AuditLog           bool          `yaml:"audit_log"`
    UseShellExecution  bool          `yaml:"use_shell_execution"` // Legacy mode - enables shell execution (DANGEROUS)
}

The fix in version 0.6.0 makes secure mode the default and removes interpreters from the allowlist. See the GitHub Security Advisory GHSA-f5pj-2738-996m for the full remediation.

Detection Methods for CVE-2026-55580

Indicators of Compromise

Child processes spawned by the mcp-shell binary that do not match an approved executable allowlist.
Absence of MCP_SHELL_SEC_CONFIG_FILE in the environment of running mcp-shell processes.
Outbound network connections initiated by processes whose parent is mcp-shell.
Unexpected filesystem writes under the home directory or working directory of the mcp-shell service account.

Detection Strategies

Inventory hosts running mcp-shell and identify the installed version through mcp-shell --version or binary hash lookup against the v0.6.0 release.
Alert on process ancestry chains where mcp-shell is the parent of shells (sh, bash, zsh) or interpreters (python, perl, ruby, node).
Correlate MCP audit logs, when AuditLog is enabled post-patch, with endpoint telemetry to identify divergent command activity.

Monitoring Recommendations

Ingest process execution telemetry from hosts running MCP servers into a centralized data lake with OCSF normalization for cross-source correlation.
Monitor changes to mcp-shell configuration files and the MCP_SHELL_SEC_CONFIG_FILE environment variable across deployments.
Establish a baseline of expected shell_exec command patterns and alert on deviations, especially reconnaissance commands such as id, uname -a, curl, and wget.

How to Mitigate CVE-2026-55580

Immediate Actions Required

Upgrade mcp-shell to version 0.6.0 or later, where secure mode is the default. See the GitHub Release v0.6.0.
Audit all MCP client configurations to confirm MCP_SHELL_SEC_CONFIG_FILE points to a restrictive policy file.
Rotate any credentials, tokens, or keys accessible to the mcp-shell process user if the service ran without a policy.
Review shell history and audit logs on affected hosts for unexpected command execution.

Patch Information

The fix is delivered in mcp-shell version 0.6.0. The upstream commit f31377fce6ec31114e5a4398c0e5270552bce09f makes secure mode the default and removes interpreters from the allowlist. Full details are available in GitHub Pull Request #16 and the GitHub Security Advisory GHSA-f5pj-2738-996m.

Workarounds

Set MCP_SHELL_SEC_CONFIG_FILE to a configuration that sets enabled: true and defines a minimal allowed_executables list.
Run mcp-shell under a dedicated low-privilege service account with no interactive shell and no sudo rights.
Isolate the mcp-shell process inside a container or sandbox with read-only filesystem, dropped Linux capabilities, and egress network restrictions.
Disable use_shell_execution (legacy mode) in the policy file to prevent shell metacharacter interpretation.

bash

# Configuration example: minimal secure policy for mcp-shell
# Save as /etc/mcp-shell/policy.yaml and export the variable before launch
cat > /etc/mcp-shell/policy.yaml <<'EOF'
enabled: true
allowed_executables:
  - /usr/bin/git
  - /usr/bin/ls
max_execution_time: 10s
working_directory: /var/lib/mcp-shell/workdir
run_as_user: mcp-shell
max_output_size: 65536
audit_log: true
use_shell_execution: false
EOF

export MCP_SHELL_SEC_CONFIG_FILE=/etc/mcp-shell/policy.yaml