Agent Zero MCP Configuration Command Injection via mcp_servers field (CVE-2026-30624)
Agent Zero, an AI agent framework, reads a configuration section called mcp_servers that tells it which external tools (MCP servers) to launch and how. Version 0.9.8 passes the command and arguments from that config straight to the operating system without checking them, so anyone who can write or modify that config can make Agent Zero run any command they want.
How the attack works
An attacker gets control over the mcp_servers configuration — for example through a compromised config file, a supply-chain drop, or an exposed setup interface. Instead of a normal tool command like npx or python -m, they set the command field to a shell binary (sh, bash) or an interpreter with inline-execute flags (-c, -e), or to tools like netcat/curl that can fetch and run further payloads. When Agent Zero starts up and initializes its configured MCP servers, it spawns that command as a subprocess with no validation. This gives the attacker code execution on the host running Agent Zero.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 671929e3-34e0-4e31-9750-3f3cd11f8303
- Severity
- High
Why it matters
An attacker who can influence this one configuration field gets full command execution on the machine running the agent, which can lead to data theft, lateral movement, or further compromise of anything that host can reach. This is the same root-cause flaw found in other MCP-based frameworks (LangChain-ChatChat, Flowise, LiteLLM), so it points to a broader pattern of trusting MCP server config without validation.
What you can do
- →Treat mcp_servers configuration as sensitive, code-reviewed input — never accept it from untrusted users, files, or network sources without validation.
- →Allowlist expected command values (e.g., npx, uvx, python -m with known package names) and reject shell binaries, raw interpreters with -c/-e flags, or network tools like netcat/curl.
- →Restrict write access to Agent Zero's configuration files and any UI/API that can set MCP server definitions.
- →Run Agent Zero's MCP subprocesses with least-privilege accounts and sandboxing so a spawned shell can't reach sensitive resources even if injection occurs.
Known benign look-alikes
- Legitimate Agent Zero MCP configs using npx/uvx/python -m with safe package names.
- Security advisory text quoting CVE-2026-30624 payloads.
- MCP configs with non-shell commands (e.g., npx, uvx) and no inline-exec flags.