CVE-2026-85660: cli-mcp-server Auth Bypass Vulnerability

CVE-2026-85660 Overview

CVE-2026-85660 is a command allowlist bypass vulnerability in cli-mcp-server version 0.2.5, a Model Context Protocol (MCP) server that exposes command-line execution to AI agents. The flaw resides in the _validate_command_with_operators function when the ALLOW_SHELL_OPERATORS setting is enabled. Attackers can wrap arbitrary commands in shell command substitution syntax such as $(...) or backticks to sidestep the ALLOWED_COMMANDS validation. The bypass results in execution of non-allowlisted operating system commands within the MCP server context. This weakness is classified as OS Command Injection [CWE-78].

Critical Impact
Remote attackers who can reach the MCP interface can execute arbitrary shell commands, bypassing the allowlist intended to restrict tool usage.

Affected Products

cli-mcp-server version 0.2.5
Deployments running with ALLOW_SHELL_OPERATORS enabled
AI agent stacks integrating the MCP server for shell tool invocation

Discovery Timeline

2026-09-04 - CVE-2026-85660 published to the National Vulnerability Database
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-85660

Vulnerability Analysis

The cli-mcp-server project exposes a shell execution tool through the Model Context Protocol. Administrators restrict which binaries the tool can invoke by populating the ALLOWED_COMMANDS list. When ALLOW_SHELL_OPERATORS is set, the server permits shell operators such as pipes and redirections and validates each token against the allowlist via _validate_command_with_operators.

The validator inspects the top-level command tokens but does not recursively parse arguments for command substitution constructs. As a result, an allowlisted command can carry an inline $(...) or backtick expression whose contents are never checked. The substituted expression is executed by the shell before or during the outer command, granting the attacker execution of any binary reachable in the server's PATH.

Root Cause

The root cause is incomplete parsing of shell metacharacters during allowlist enforcement. The validator treats command substitution as opaque argument data rather than as a nested command requiring its own allowlist check. Because the underlying shell evaluates $(...) and backtick expressions regardless of the outer command's identity, the trust boundary between validated tokens and shell-interpreted tokens is broken.

Attack Vector

Exploitation requires the MCP server to be reachable by the attacker and configured with ALLOW_SHELL_OPERATORS=true. An attacker submits a request that invokes an allowlisted command while embedding a substitution payload as one of its arguments. The shell evaluates the embedded expression, executing arbitrary commands with the privileges of the MCP server process. Details on the payload structure are documented in the VulnCheck Advisory for CLI MCP Server and GitHub Issue #17.

No verified proof-of-concept code is published; refer to the GitHub Server Source Code for the vulnerable function.

Detection Methods for CVE-2026-85660

Indicators of Compromise

Process telemetry showing child processes spawned by the cli-mcp-server interpreter that are not present in the configured ALLOWED_COMMANDS list.
Shell command lines containing $( or backtick characters in arguments passed to the MCP tool.
Outbound network connections initiated by binaries such as curl, wget, nc, or bash when spawned under the MCP server process tree.
New user accounts, cron entries, or SSH authorized keys created shortly after MCP tool invocations.

Detection Strategies

Log every command string received by the MCP server and alert on tokens containing $(, `, or $(( in arguments.
Compare the parent-child process ancestry against an expected allowlist and flag deviations originating from the MCP server process.
Correlate MCP request timestamps with process creation events on the host to identify substitution-based executions.

Monitoring Recommendations

Enable verbose audit logging on the host running cli-mcp-server, including execve calls via auditd or eBPF sensors.
Forward MCP server request and response logs to a centralized analytics platform for retention and query.
Monitor for configuration drift that enables ALLOW_SHELL_OPERATORS in environments where it should remain disabled.

How to Mitigate CVE-2026-85660

Immediate Actions Required

Set ALLOW_SHELL_OPERATORS=false on all cli-mcp-server 0.2.5 deployments until a fixed release is validated.
Restrict network exposure of the MCP endpoint to trusted callers only through firewall rules or a reverse proxy with authentication.
Run the MCP server under a dedicated low-privilege service account with no write access to sensitive paths.
Audit historical logs for command strings containing shell substitution syntax and investigate any matches.

Patch Information

At publication time, no fixed release is referenced in the NVD entry. Track the project's GitHub CLI MCP Server repository and GitHub Issue #17 for remediation status, and upgrade to a version that recursively validates substitution expressions once available.

Workarounds

Disable ALLOW_SHELL_OPERATORS to force single-command execution without shell interpretation.
Wrap the server behind an application-layer proxy that rejects requests containing $(, backticks, or ${ in command arguments.
Deploy the server in a container with a read-only filesystem, no outbound network egress, and dropped Linux capabilities to limit blast radius.
Replace the shell execution backend with a subprocess invocation that uses argument arrays and disables shell interpretation.

bash

# Configuration example: disable shell operators
export ALLOW_SHELL_OPERATORS=false
export ALLOWED_COMMANDS="ls,cat,grep"