CVE-2026-81835: Roo-Code MCP Integration RCE Vulnerability

CVE-2026-81835 Overview

CVE-2026-81835 is a code injection vulnerability in RooCodeInc Roo-Code versions up to 3.51.1. The flaw resides in the fetch_instructions function of the malicious_mcp_server.py file within the MCP Integration Trust Model component. Attackers can exploit this issue remotely, and a public proof-of-concept has been disclosed. The vendor has confirmed that Roo-Code is no longer supported and the repository has been archived. This vulnerability only affects unsupported product versions, and no patched release will be issued. The weakness is classified under CWE-74 (Improper Neutralization of Special Elements in Output).

Critical Impact
Remote code injection is possible against unsupported Roo-Code instances that integrate with malicious Model Context Protocol (MCP) servers, requiring user interaction.

Affected Products

RooCodeInc Roo-Code up to and including version 3.51.1
Roo-Code MCP Integration Trust Model component
The upstream repository has been archived and is no longer maintained

Discovery Timeline

2026-08-28 - CVE-2026-81835 published to the National Vulnerability Database (NVD)
2026-08-28 - Last updated in NVD database
2026-09-03 - Exploit Prediction Scoring System (EPSS) data recorded

Technical Details for CVE-2026-81835

Vulnerability Analysis

CVE-2026-81835 is a code injection flaw (CWE-74) affecting the fetch_instructions function inside malicious_mcp_server.py. The function is part of Roo-Code's MCP Integration Trust Model, which governs how the client consumes instructions returned by an external Model Context Protocol (MCP) server. Because responses from a connected MCP server are not neutralized before being processed, an attacker controlling the server can craft instruction payloads that Roo-Code interprets as executable code.

Exploitation requires the user to connect the Roo-Code client to an attacker-controlled MCP server. Once connected, the malicious fetch_instructions response drives unintended code execution within the client context. A public proof-of-concept demonstrating the flow was published as a GitHub Gist referenced by VulDB CVE-2026-81835.

Root Cause

The root cause is missing input validation and improper trust of instructions returned by remote MCP servers. Roo-Code's MCP Integration Trust Model treats server-provided data as trusted content, allowing injected payloads to influence execution paths inside fetch_instructions.

Attack Vector

The attack vector is network-based with low privileges required and active user interaction. A victim must connect the Roo-Code client to a malicious MCP server. The server then returns crafted instruction data that triggers code injection during handling by fetch_instructions.

Because no verified exploit code is provided in the enriched data, refer to the GitHub Gist proof-of-concept for the disclosed exploitation flow and the VulDB entry for additional technical context.

Detection Methods for CVE-2026-81835

Indicators of Compromise

Outbound connections from developer workstations to unfamiliar MCP server endpoints referenced in Roo-Code configuration files.
Presence of malicious_mcp_server.py or unexpected MCP server registrations in Roo-Code project directories.
Unusual child processes spawned by the Roo-Code client following an MCP fetch_instructions exchange.

Detection Strategies

Inventory endpoints running Roo-Code 3.51.1 or earlier and flag them as end-of-life software.
Inspect MCP server configurations for untrusted or externally hosted servers and correlate with process telemetry from the Roo-Code client.
Alert on script or interpreter execution originating from the Roo-Code process tree immediately after network calls to MCP endpoints.

Monitoring Recommendations

Log and review all MCP server connections initiated by developer tooling, including source, destination, and duration.
Monitor for creation or modification of files matching *mcp*server*.py in user profiles and repository workspaces.
Track process lineage for the Roo-Code client to identify anomalous execution of shells, interpreters, or download utilities.

How to Mitigate CVE-2026-81835

Immediate Actions Required

Remove Roo-Code from all endpoints, as the project is archived and no fixed version will be released.
Block outbound connections from developer environments to unapproved MCP servers.
Audit existing Roo-Code MCP configurations and revoke any references to untrusted servers.

Patch Information

No patch is available. The vendor has publicly stated that Roo-Code is no longer supported and the repository has been archived. Continued use of the software is not recommended. See the VulDB advisory for CVE-2026-81835 for the vendor statement and disclosure details.

Workarounds

Migrate to a supported MCP-compatible client that validates and sandboxes server-provided instructions.
Restrict MCP client usage to an allowlist of internally operated, authenticated MCP servers.
Isolate any remaining Roo-Code installations in dedicated, network-segmented environments without access to sensitive data.

bash

# Configuration example: block outbound traffic from Roo-Code to untrusted MCP endpoints
# Replace <allowed_mcp_host> with your internal MCP server
iptables -A OUTPUT -p tcp -m owner --uid-owner roo-code -d <allowed_mcp_host> -j ACCEPT
iptables -A OUTPUT -p tcp -m owner --uid-owner roo-code -j REJECT