CVE-2026-55581 mcp-shell: Secure Mode Allowlist Bypass via Default `/bin/bash` Executable
Attackers can bypass the executable allowlist in mcp-shell by invoking /bin/bash with the -c flag, allowing arbitrary command execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55581?
CVE-2026-55581 is a high-severity command injection vulnerability in sonirico mcp-shell, published on 25 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, the default Docker security.yaml includes /bin/bash in allowed_executables, while security.go validates only the first token and checkBlockedPatternsAndCommands does not reject the shell command-mode flag -c. A caller of the shell_exec MCP tool can provide the command argument `/bin/bash -c <arbitrary-command>`, which passes validation and reaches executor.go, where parseCommand and exec.CommandContext execute the arbitrary command as mcpuser outside the intended allowlist. This issue is fixed in version 0.6.0.
Which versions are affected by CVE-2026-55581?
3 open source packages ship an affected version, including github.com/sonirico/mcp-shell.
| Package | Affected | Fixed in |
|---|---|---|
github.com/sonirico/mcp-shell Go | All versions | 0.6.0 |
github.com/sonirico/mcp-shell Go | All versions | 0.6.0 |
github.com/sonirico/mcp-shell Go | All versions | 0.6.0 |
How do I fix CVE-2026-55581?
Upgrade github.com/sonirico/mcp-shell to 0.6.0 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-55581 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55581 exists.
Sources
Also known as GHSA-3x77-wg38-92r3, GO-2026-6290.