CVE-2026-90617: GH05TCREW PentestAgent RCE Vulnerability

CVE-2026-90617 Overview

CVE-2026-90617 is an operating system command injection vulnerability in the GH05TCREW PentestAgent project, an open-source security tooling agent hosted on GitHub. The flaw resides in the run_task function within interface/main.py, part of the Model Context Protocol (MCP) HTTP Server component. Attackers can reach the vulnerable code path over the network without authentication or user interaction. The project uses a rolling release model, so affected versions are identified by commit hash rather than semantic versions; the flaw is present up to commit cf882dabea3ed91cef016cdd115e5426315665a2. Public exploit details have been disclosed, and a fix proposed via GitHub Pull Request #101 is awaiting acceptance.

Critical Impact

Unauthenticated remote attackers can inject arbitrary operating system commands through the MCP HTTP Server, resulting in command execution in the context of the PentestAgent process.

Affected Products

• GH05TCREW PentestAgent (rolling release) up to commit cf882dabea3ed91cef016cdd115e5426315665a2
• MCP HTTP Server component (interface/main.py, run_task function)
• Any deployment exposing the PentestAgent MCP HTTP endpoint on a reachable network

Discovery Timeline

• 2026-09-14 - CVE-2026-90617 published to the National Vulnerability Database (NVD)
• 2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90617

Vulnerability Analysis

The vulnerability is classified as Improper Neutralization of Special Elements Used in a Command [CWE-77]. The run_task handler in interface/main.py processes task input received over the MCP HTTP Server interface and passes attacker-influenced data into an operating system command invocation without adequate sanitization or argument isolation. Because the MCP HTTP Server is designed to accept task submissions programmatically, the injection point is reachable through a standard HTTP request. Successful exploitation lets an attacker run arbitrary shell commands with the privileges of the PentestAgent process, which typically has broad tooling access given the agent's offensive-security purpose. Public disclosure of the exploit and a pending upstream patch increase the operational urgency for anyone running the affected commits.

Root Cause

The root cause is unsafe construction of a shell command inside run_task, where untrusted request fields are concatenated or interpolated into a command string. Metacharacters such as ;, &&, |, backticks, and $() are not neutralized, allowing the shell to interpret injected payloads as additional commands. The pending Pull Request #101 proposes the corrective change.

Attack Vector

The attack vector is network-based against the MCP HTTP Server endpoint. An attacker sends a crafted HTTP request to the run_task route with a payload containing shell metacharacters embedded in a task parameter. No authentication or prior interaction is required. Refer to the GitHub Issue #90 Discussion and VulDB entry for CVE-2026-90617 for exploitation context. Because no verified proof-of-concept code is being reproduced here, defenders should treat any unexpected process spawning from the agent as suspicious.

Detection Methods for CVE-2026-90617

Indicators of Compromise

• Unexpected child processes spawned by the PentestAgent Python interpreter, particularly shells (sh, bash, cmd.exe) or discovery tools invoked outside normal task flow.
• HTTP POST requests to the MCP HTTP Server run_task endpoint containing shell metacharacters such as ;, |, &&, backticks, or $(...) in task fields.
• Outbound network connections from the host running PentestAgent to unfamiliar IP addresses shortly after run_task invocations.
• New files, cron entries, or systemd units created by the PentestAgent process user.

Detection Strategies

• Enable verbose request logging on the MCP HTTP Server and alert on payloads containing shell metacharacters in run_task parameters.
• Correlate MCP HTTP Server access logs with process creation telemetry to identify commands that do not match legitimate tool invocations.
• Deploy endpoint detection and response tooling that captures parent-child process lineage for the PentestAgent process.

Monitoring Recommendations

• Monitor for anomalous outbound traffic from hosts running PentestAgent, especially to previously unseen destinations.
• Track integrity of interface/main.py and pin deployments to a reviewed commit hash to detect unauthorized modification.
• Alert on privilege changes, new user accounts, or SSH key additions on hosts running the agent.

How to Mitigate CVE-2026-90617

Immediate Actions Required

• Restrict network exposure of the MCP HTTP Server to trusted management networks only; do not expose it to the internet.
• Run PentestAgent under a least-privileged service account and inside an isolated container or virtual machine.
• Pin deployments to a commit that includes the fix from Pull Request #101 once merged, and rebuild from source.
• Review recent MCP HTTP Server logs for run_task requests containing shell metacharacters and investigate any matches.

Patch Information

No official released version is available because the project follows a rolling release strategy. A proposed fix is tracked in GitHub Pull Request #101 and referenced in GitHub Issue #90. Until the pull request is accepted and merged, operators should apply the change manually or hold deployments at a known-good commit.

Workarounds

• Place the MCP HTTP Server behind an authenticated reverse proxy that filters or rejects shell metacharacters in request bodies.
• Disable the run_task endpoint entirely if it is not required for the deployment's use case.
• Apply an application-layer allowlist that constrains task parameters to expected characters and lengths.
• Enforce mandatory access controls (AppArmor, SELinux, or seccomp) to restrict which binaries the agent process may execute.

# Configuration example: restrict MCP HTTP Server exposure with a host firewall
# Allow only a trusted management subnet to reach the service port
sudo iptables -A INPUT -p tcp --dport <MCP_PORT> -s 10.10.20.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport <MCP_PORT> -j DROP