CVE-2026-58195: Agentic-Flow MCP Server RCE Vulnerability

CVE-2026-58195 Overview

CVE-2026-58195 is an OS command injection vulnerability [CWE-78] in Agentic-Flow, an AI agent orchestration platform. Versions prior to 2.0.14 interpolate attacker-influenceable Model Context Protocol (MCP) tool parameters directly into shell command strings passed to execSync(). Affected parameters include agent, task, name, language, and agentdb across multiple MCP server and tool source files. Successful exploitation grants arbitrary operating system command execution with the privileges of the MCP server user. The issue is fixed in version 2.0.14.

Critical Impact
Remote attackers can execute arbitrary OS commands through crafted MCP tool parameters, compromising confidentiality, integrity, and availability of the host running the Agentic-Flow MCP server.

Affected Products

Agentic-Flow versions prior to 2.0.14
Agentic-Flow MCP server components (src/mcp/standalone-stdio.ts, src/mcp/fastmcp/servers/*.ts)
Agentic-Flow FastMCP tools (tools/agent/{execute,list,parallel}.ts, tools/swarm/orchestrate.ts, tools/hooks/pretrain.ts)

Discovery Timeline

2026-07-17 - CVE-2026-58195 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-58195

Vulnerability Analysis

The flaw resides in multiple Agentic-Flow MCP server modules that shell out via Node.js child_process.execSync(). Each affected module builds command strings using template-string interpolation of tool parameters supplied by MCP clients. Because execSync() invokes a shell by default, any shell metacharacter contained in parameters such as agent, task, name, language, or agentdb is interpreted by the shell rather than treated as literal argument data. An attacker who can reach the MCP endpoint or influence the parameters passed to a tool can inject additional commands using shell operators such as ;, &&, |, or command substitution.

Root Cause

The root cause is unsafe composition of shell commands from untrusted input, an instance of Improper Neutralization of Special Elements used in an OS Command [CWE-78]. The affected files mix trusted binary paths with attacker-controllable arguments inside a single string, then hand that string to execSync(), which spawns /bin/sh -c. No allowlisting, quoting, or argv-array separation was performed on the interpolated parameters.

Attack Vector

Exploitation occurs over the network against the MCP server transport (stdio, HTTP streaming, or HTTP/SSE). An attacker sends a crafted tool invocation whose parameter values carry shell metacharacters. When the vulnerable handler builds and executes the command, the injected payload runs with the privileges of the MCP server user. User interaction is required in the form of a client invoking the tool, which is consistent with the MCP orchestration model where agents relay requests to tool endpoints.

typescript

// Patch excerpt from agentic-flow/src/mcp/fastmcp/servers/http-sse.ts
#!/usr/bin/env node
/* eslint-disable @typescript-eslint/no-explicit-any -- pre-existing catch(error: any) handlers; outside scope of CWE-78 fix */
// FastMCP server with HTTP/SSE transport - All agentic-flow tools
import { FastMCP } from 'fastmcp';
import { z } from 'zod';
-import { execSync, execFileSync } from 'child_process';
+import { execFileSync } from 'child_process';
+
+// Security: All shell-outs use execFileSync with argv arrays (shell: false) to
+// prevent OS command injection via tool parameters (CWE-78). Do NOT reintroduce
+// execSync with template-string interpolation here.
+const NPX_EXEC_OPTS = { shell: false as const };

Source: GitHub commit 0c2ec96

The fix replaces execSync with execFileSync using explicit argv arrays and shell: false, ensuring parameters are passed as argument vectors rather than parsed by a shell interpreter.

Detection Methods for CVE-2026-58195

Indicators of Compromise

MCP tool invocations whose parameters (agent, task, name, language, agentdb) contain shell metacharacters such as ;, &&, |, backticks, or $( sequences.
Unexpected child processes such as /bin/sh, bash, curl, wget, or nc spawned by the Node.js process running the Agentic-Flow MCP server.
Outbound network connections initiated by the MCP server host to unrecognized destinations shortly after MCP tool calls.

Detection Strategies

Instrument or monitor process creation on hosts running Agentic-Flow to alert when the MCP server parent process spawns shells or interpreters.
Enable verbose MCP server logging and search for tool parameter values containing shell control characters or long argument strings.
Perform static analysis of any forked or vendored copies of Agentic-Flow to identify residual execSync() calls that interpolate parameters.

Monitoring Recommendations

Correlate MCP request logs with endpoint process telemetry to identify tool invocations that immediately precede shell activity.
Monitor for new persistence mechanisms, cron jobs, or SSH key additions on hosts running MCP servers.
Track egress traffic from MCP hosts to detect data exfiltration or command-and-control callbacks resulting from injected commands.

How to Mitigate CVE-2026-58195

Immediate Actions Required

Upgrade Agentic-Flow to version 2.0.14 or later on all hosts running the MCP server.
Restrict network exposure of MCP HTTP, SSE, and streaming endpoints to trusted clients only using firewall rules or a reverse proxy.
Run the MCP server as a least-privileged, non-root user in an isolated container or namespace to limit blast radius.
Audit MCP server logs for anomalous tool invocations containing shell metacharacters prior to the upgrade.

Patch Information

The vulnerability is remediated in Agentic-Flow 2.0.14. The fix, tracked in pull request #170 and commit 0c2ec96, replaces execSync template-string calls with execFileSync using argv arrays and shell: false. See the GitHub Security Advisory GHSA-vcv2-r9jh-99m5 for the full disclosure.

Workarounds

If upgrading is not immediately possible, disable or remove the affected MCP tool handlers (agent execute, agent list, agent parallel, swarm orchestrate, hooks pretrain) from the server configuration.
Place the MCP server behind an authenticated gateway that validates parameter values against a strict allowlist rejecting shell metacharacters.
Apply mandatory access controls (AppArmor, SELinux, or seccomp) to prevent the Node.js process from executing shells and network utilities.

bash

# Upgrade Agentic-Flow to the patched release
npm install agentic-flow@2.0.14

# Verify the installed version
npm ls agentic-flow