CVE-2026-7590: Branch Monkey MCP RCE Vulnerability

CVE-2026-7590 Overview

CVE-2026-7590 is an operating system (OS) command injection vulnerability in the open-source project eyal-gor/p_69_branch_monkey_mcp up to commit 69bc71874ce40050ef45fde5a435855f18af3373. The flaw resides in an unknown function within branch_monkey_mcp/bridge_and_local_actions/routes/advanced.py, part of the Preview Endpoint component. Attackers can manipulate the dev_script argument to inject arbitrary operating system commands. The attack is exploitable remotely and a public proof-of-concept exists. The project does not use versioning, so affected and unaffected releases cannot be enumerated. The maintainer was notified through an issue report but has not responded.

Critical Impact
Remote attackers can inject arbitrary OS commands through the dev_script parameter of the Preview Endpoint, leading to unauthorized command execution on the host running the application.

Affected Products

eyal-gor/p_69_branch_monkey_mcp up to commit 69bc71874ce40050ef45fde5a435855f18af3373
Component: Preview Endpoint (branch_monkey_mcp/bridge_and_local_actions/routes/advanced.py)
Project does not use semantic versioning; all known builds prior to a fix are considered affected

Discovery Timeline

2026-05-01 - CVE-2026-7590 published to the National Vulnerability Database (NVD)
2026-05-01 - Last updated in NVD database

Technical Details for CVE-2026-7590

Vulnerability Analysis

CVE-2026-7590 is classified under [CWE-77] Improper Neutralization of Special Elements used in a Command. The vulnerable code lives in branch_monkey_mcp/bridge_and_local_actions/routes/advanced.py, which exposes a Preview Endpoint that accepts a user-controlled dev_script argument. The endpoint passes this argument to an OS-level command interpreter without proper sanitization or argument escaping. Because the route is reachable over the network and requires no authentication or user interaction, an unauthenticated attacker can issue crafted HTTP requests to trigger command execution. Successful exploitation grants the attacker the privileges of the process running the MCP service. The Exploit Prediction Scoring System (EPSS) reports a probability of 2.177% with an 84.45 percentile, indicating elevated likelihood of exploitation activity relative to the broader CVE population.

Root Cause

The root cause is the unsafe handover of attacker-controlled input to a shell or subprocess invocation. The dev_script parameter is concatenated or interpolated into a command string without escaping shell metacharacters such as ;, |, &, backticks, or $(). Any caller able to reach the Preview Endpoint can append additional commands that the operating system will execute alongside the intended preview action.

Attack Vector

The attack vector is the network. An attacker sends an HTTP request to the Preview Endpoint and supplies a malicious value for dev_script that includes shell separators followed by arbitrary commands. No credentials or user interaction are required. Exploitation can lead to information disclosure, persistence on the host, lateral movement, or installation of additional tooling, depending on the privileges of the running service.

No verified exploitation code is published in this advisory. Refer to the GitHub PoC Repository and the GitHub Issue Discussion for technical details, and the VulDB Vulnerability Details for additional context.

Detection Methods for CVE-2026-7590

Indicators of Compromise

HTTP requests to the Preview Endpoint route defined in branch_monkey_mcp/bridge_and_local_actions/routes/advanced.py containing shell metacharacters such as ;, |, &&, `, or $() in the dev_script parameter.
Unexpected child processes spawned by the Python interpreter hosting the MCP service, especially shells (/bin/sh, bash, cmd.exe) or network utilities (curl, wget, nc).
Outbound connections from the MCP host to unfamiliar IPs or domains shortly after Preview Endpoint requests.

Detection Strategies

Inspect web access logs for requests targeting the Preview Endpoint with non-script content in dev_script, particularly URL-encoded shell separators.
Correlate process creation telemetry with HTTP requests to identify subprocess execution lineage rooted in the MCP server.
Apply file integrity monitoring on the MCP deployment directory to detect unauthorized changes following exploitation.

Monitoring Recommendations

Forward application, web server, and host process telemetry to a centralized analytics platform for unified query and correlation.
Alert on anomalous process trees where the MCP service spawns interpreters or LOLBins not seen in baseline activity.
Track egress traffic from systems that host the MCP service and flag connections to non-allowlisted destinations.

How to Mitigate CVE-2026-7590

Immediate Actions Required

Remove the Preview Endpoint from public exposure and restrict access to trusted networks only until a fix is available.
Audit existing logs for prior abuse of the dev_script parameter and investigate any suspicious subprocess activity.
Run the MCP service under a least-privileged account and within a sandbox or container with restricted egress.

Patch Information

No official patch is available at the time of publication. The maintainer was notified through the GitHub Issue Discussion but has not responded. Operators should monitor the GitHub PoC Repository for upstream fixes and review the VulDB Submission Report and VulDB CTI Information for further updates.

Workarounds

Disable the Preview Endpoint route in branch_monkey_mcp/bridge_and_local_actions/routes/advanced.py if it is not required for operations.
Place the service behind an authenticating reverse proxy and apply a Web Application Firewall (WAF) rule that rejects shell metacharacters in the dev_script parameter.
Replace any shell-based command invocation with argument-array execution (for example, subprocess.run([...], shell=False)) and validate dev_script against a strict allowlist.

bash

# Example NGINX rule to block shell metacharacters in dev_script
location /preview {
    if ($arg_dev_script ~* "[;&|`$()<>]") {
        return 403;
    }
    proxy_pass http://branch_monkey_mcp_upstream;
}