CVE-2026-55580 mcp-shell — Security Disabled by Default in Bare-Binary Deploy Path + Shell Interpreter in Secure-Mode Allowlist
An attacker can execute arbitrary OS commands via the shell_exec tool because security validation is disabled by default in the bare-binary deployment path.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55580?
CVE-2026-55580 is a high-severity command injection vulnerability in sonirico mcp-shell, published on 25 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, config.go initializes Security.Enabled to false, and when MCP_SHELL_SEC_CONFIG_FILE is unset, main.go starts the documented bare-binary deployment without a security policy. SecurityValidator.validateCommand in security.go then short-circuits and allows every command supplied to the shell_exec MCP tool, so an LLM connected over stdio can execute unrestricted OS commands as the mcp-shell process user. The README from-source installation and MCP client configuration omit MCP_SHELL_SEC_CONFIG_FILE, making the insecure state the documented default. This issue is fixed in version 0.6.0.
Weakness: CWE-78
Which versions are affected by CVE-2026-55580?
3 open source packages ship an affected version, including github.com/sonirico/mcp-shell.
| Package | Affected | Fixed in |
|---|---|---|
github.com/sonirico/mcp-shell Go | All versions | 0.6.0 |
github.com/sonirico/mcp-shell Go | All versions | 0.6.0 |
github.com/sonirico/mcp-shell Go | All versions | 0.6.0 |
How do I fix CVE-2026-55580?
Upgrade github.com/sonirico/mcp-shell to 0.6.0 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-55580 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55580 exists.
Sources
Also known as GHSA-f5pj-2738-996m, GO-2026-6292.