CVE-2026-57860: ForgeCode AI CLI RCE Vulnerability

CVE-2026-57860 Overview

CVE-2026-57860 is an arbitrary code execution vulnerability in ForgeCode (tailcallhq/forgecode), an AI pair-programming command-line interface (CLI). The tool automatically loads and executes Model Context Protocol (MCP) servers defined in a repository's .mcp.json file on startup without prompting the user for confirmation. A malicious repository can supply a crafted .mcp.json whose mcpServers entries specify arbitrary command and args values. When a developer runs the forge CLI inside a cloned untrusted repository, the specified commands execute with the invoking user's privileges. The flaw maps to [CWE-829: Inclusion of Functionality from Untrusted Control Sphere].

Critical Impact
Cloning and opening an untrusted repository with ForgeCode results in arbitrary code execution as the invoking user, providing a reliable initial-access and persistence primitive against developers.

Affected Products

ForgeCode CLI (tailcallhq/forgecode)
Versions prior to the commit 68ca3a3 that introduced the MCP trust prompt
Any developer workstation where the forge CLI is invoked inside an untrusted repository

Discovery Timeline

2026-07-17 - CVE-2026-57860 published to the National Vulnerability Database (NVD)
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-57860

Vulnerability Analysis

ForgeCode reads project-local MCP server configuration from .mcp.json at startup. Each entry in mcpServers declares a command and args array used to spawn a server process. ForgeCode spawns these processes automatically, before any user interaction, and without validating the source or content of the configuration. An attacker who controls the repository controls the process arguments that ForgeCode executes.

Because code execution occurs at CLI startup, simply running forge inside a cloned repository is sufficient to trigger the payload. The spawned process inherits the invoking user's privileges and environment, including SSH keys, cloud credentials, and access tokens present on a typical developer workstation.

Root Cause

The root cause is trust-boundary confusion. ForgeCode treats project-local .mcp.json files as authoritative configuration rather than as untrusted data originating from the repository. There is no signature check, no allowlist, and no interactive prompt gating the initial connection. The fix introduces an interactive trust gate that must be called once at startup, deferring any MCP interaction until the user explicitly approves the project-local configuration.

Attack Vector

Exploitation requires a developer to clone a malicious repository and run the forge CLI within it. A crafted .mcp.json such as one specifying command: bash with args: ['-c', 'touch /tmp/pwned'] will execute the supplied shell command on startup. Realistic payloads can install persistence, exfiltrate SSH keys, or drop a remote access implant.

rust

// Security patch: crates/forge_api/src/api.rs
// Introduces an interactive trust gate for project-local MCP config.
     /// Refresh MCP caches by fetching fresh data
     async fn reload_mcp(&self) -> Result<()>;
 
+    /// Applies the interactive trust gate for any project-local MCP config.
+    /// Servers are NOT connected here — connections remain lazy and happen on
+    /// first tool use. Must be called once at startup.
+    async fn init_mcp(&self) -> Result<()>;
+
     /// List of commands defined in .md file(s)
     async fn get_commands(&self) -> Result<Vec<Command>>;
// Source: https://github.com/tailcallhq/forgecode/commit/68ca3a3a26c73c38a700453d3d021b5bbdc15dbd

rust

// Security patch: crates/forge_api/src/forge_api.rs
     async fn reload_mcp(&self) -> Result<()> {
         self.services.mcp_service().reload_mcp().await
     }
+
+    async fn init_mcp(&self) -> Result<()> {
+        self.services.mcp_service().init_mcp().await
+    }
     async fn get_commands(&self) -> Result<Vec<Command>> {
         self.services.get_commands().await
     }
// Source: https://github.com/tailcallhq/forgecode/commit/68ca3a3a26c73c38a700453d3d021b5bbdc15dbd

See the Vulncheck Advisory and GitHub Issue #3252 for additional technical details.

Detection Methods for CVE-2026-57860

Indicators of Compromise

Presence of a .mcp.json file at the root of a cloned repository containing shell interpreters (bash, sh, zsh, cmd.exe, powershell) as the command value.
Child processes spawned by the forge binary that are not legitimate MCP servers, such as shells, curl, wget, or scripting runtimes.
Unexpected files, cron entries, or SSH authorized_keys modifications appearing shortly after a developer runs forge in a new repository.

Detection Strategies

Hunt for process ancestry where forge is the parent of an interactive shell or a network utility.
Scan developer workstations and code-review pipelines for .mcp.json files containing suspicious command/args combinations before ForgeCode is invoked.
Correlate outbound network connections initiated by processes whose parent is forge against known-good MCP server destinations.

Monitoring Recommendations

Enable command-line and process-creation logging on developer endpoints and forward events to a central data lake for retention.
Alert on writes to .mcp.json in repositories cloned from unvetted sources within the last 24 hours.
Monitor developer identity credentials (cloud tokens, Git credentials) for anomalous use following a forge invocation.

How to Mitigate CVE-2026-57860

Immediate Actions Required

Upgrade ForgeCode to a build that includes commit 68ca3a3a26c73c38a700453d3d021b5bbdc15dbd, which adds the interactive init_mcp trust gate.
Audit developer workstations for .mcp.json files in recently cloned repositories and remove or review any that were not authored internally.
Rotate credentials (SSH keys, cloud tokens, Git personal access tokens) on any workstation that ran forge inside an untrusted repository before the patch.

Patch Information

The upstream fix is delivered in commit 68ca3a3 titled feat(mcp-trust): launch mcp trust prompt on startup (#3265). The patch adds an init_mcp method that applies an interactive trust gate for any project-local MCP configuration and defers MCP server connections until first tool use. See GitHub Issue #3022 and GitHub Issue #3252 for the tracking discussion.

Workarounds

Do not run forge inside a repository until you have manually inspected the .mcp.json file (if present) and validated every command and args entry.
Evaluate untrusted repositories inside an ephemeral virtual machine or container that has no persistent credentials or network access to internal systems.
Configure a pre-invocation script that renames or removes any .mcp.json file in a working tree before the forge CLI is launched.

bash

# Pre-invocation check: block forge startup if an untrusted .mcp.json exists
if [ -f "./.mcp.json" ]; then
  echo "[!] .mcp.json detected. Review contents before running forge:"
  cat ./.mcp.json
  read -p "Proceed? (y/N) " confirm
  [ "$confirm" = "y" ] || exit 1
fi
forge "$@"