CVE-2026-82536: Roo-Code Auth Bypass Vulnerability

CVE-2026-82536 Overview

CVE-2026-82536 is an auto-approve bypass vulnerability in Roo-Code through version 3.54.0. The flaw resides in the shell command parsing logic used by the AI coding agent to enforce command allowlists. The parser omits the bash |& pipe operator (stderr-and-stdout redirection) from its operator token set. Attackers can chain an allowlisted command prefix with |& followed by a denied command. The parser approves the full pipeline while bash executes the denied component under the agent's auto-execute privileges on the developer's machine. The vulnerability is classified under [CWE-184: Incomplete List of Disallowed Inputs].

Critical Impact
Attackers who can influence agent input can execute arbitrary shell commands with the developer's local privileges, bypassing the auto-approve allowlist entirely.

Affected Products

Roo-Code through version 3.54.0
Deployments using the auto-approve shell command allowlist feature
Developer workstations running the Roo-Code AI coding agent

Discovery Timeline

2026-09-08 - CVE-2026-82536 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-82536

Vulnerability Analysis

Roo-Code implements an auto-approve feature that allows the AI agent to execute shell commands matching a developer-defined allowlist without prompting. To enforce this policy safely on compound command lines, Roo-Code parses shell input and splits it on known operator tokens (such as |, &&, ||, ;). Each resulting sub-command is validated against the allowlist before execution.

The parser's operator token set is incomplete. It does not recognize the bash |& operator, which pipes both stdout and stderr from one command to the next. When the parser encounters a command line containing |&, it fails to split on that boundary and treats the entire construct as a single allowlisted invocation. Bash, however, interprets |& correctly and executes both sides of the pipeline as independent processes.

Exploitation requires the attacker to supply or influence a prompt or instruction consumed by the agent. In agentic development workflows, prompt injection paths include malicious repository content, README files, issue descriptions, or third-party MCP tool output.

Root Cause

The root cause is an incomplete disallowed-input list in the shell command parser. The tokenizer enumerates operator sequences but omits |&, breaking the assumption that every sub-command in a pipeline is individually validated.

Attack Vector

An attacker crafts a command payload of the form <allowlisted_prefix> |& <denied_command>. When the agent evaluates the payload, the parser sees only the allowlisted prefix and approves execution. Bash then runs the denied command with the agent's auto-execute privileges, granting arbitrary command execution on the developer's workstation. See the Vulncheck Security Advisory and the GitHub PoC Repository for the demonstrated payload structure.

Detection Methods for CVE-2026-82536

Indicators of Compromise

Shell history or process telemetry containing the |& operator originating from the Roo-Code agent process.
Unexpected child processes spawned by the Roo-Code agent that do not match the configured allowlist.
Outbound network connections or file writes initiated by processes launched from the agent's shell context.

Detection Strategies

Instrument endpoint process telemetry to record full command lines for children of the Roo-Code process and alert on |& occurrences.
Compare executed commands against the agent's declared allowlist and flag divergence.
Review AI agent transcripts and prompt inputs for injected instructions containing pipe-both operators.

Monitoring Recommendations

Enable command-line auditing on developer endpoints (for example, Windows Event ID 4688 with command line logging, or Linux auditd execve rules).
Forward process execution telemetry to a centralized data lake for retrospective hunting across developer fleets.
Baseline normal Roo-Code agent behavior and alert on deviations such as new binaries invoked or credential-access utilities executed.

How to Mitigate CVE-2026-82536

Immediate Actions Required

Disable the auto-approve shell command feature in Roo-Code until an updated release is deployed.
Restrict Roo-Code usage to trusted repositories and vetted prompt sources to reduce prompt injection exposure.
Audit recent agent shell execution logs on developer workstations for |& usage or unexpected child processes.

Patch Information

At the time of publication, no fixed version is enumerated in the NVD entry beyond the affected range through 3.54.0. Monitor the Vulncheck Security Advisory and the Roo-Code project for a release that adds |& to the parser's operator token set.

Workarounds

Require manual approval for every shell command the agent proposes, disabling auto-approve entirely.
Run the Roo-Code agent inside a container, sandbox, or dedicated virtual machine with no access to production credentials, SSH keys, or source-control tokens.
Configure host-level allowlists (for example, AppArmor, SELinux, or Windows AppLocker) to block execution of sensitive binaries by the agent process regardless of its own allowlist logic.

bash

# Configuration example: disable auto-approve for shell commands in Roo-Code settings
# Set the auto-approve toggle for command execution to false and require explicit user confirmation.
rooCode.autoApprove.shellCommands = false
rooCode.requireConfirmationForExecution = true