How the attack works
An attacker gets control over the mcp_servers configuration — for example through a compromised config file, a supply-chain drop, or an exposed setup interface. Instead of a normal tool command like npx or python -m, they set the command field to a shell binary (sh, bash) or an interpreter with inline-execute flags (-c, -e), or to tools like netcat/curl that can fetch and run further payloads. When Agent Zero starts up and initializes its configured MCP servers, it spawns that command as a subprocess with no validation. This gives the attacker code execution on the host running Agent Zero.
Why it matters
An attacker who can influence this one configuration field gets full command execution on the machine running the agent, which can lead to data theft, lateral movement, or further compromise of anything that host can reach. This is the same root-cause flaw found in other MCP-based frameworks (LangChain-ChatChat, Flowise, LiteLLM), so it points to a broader pattern of trusting MCP server config without validation.
What you can do
- Treat mcp_servers configuration as sensitive, code-reviewed input — never accept it from untrusted users, files, or network sources without validation.
- Allowlist expected command values (e.g., npx, uvx, python -m with known package names) and reject shell binaries, raw interpreters with -c/-e flags, or network tools like netcat/curl.
- Restrict write access to Agent Zero's configuration files and any UI/API that can set MCP server definitions.
- Run Agent Zero's MCP subprocesses with least-privilege accounts and sandboxing so a spawned shell can't reach sensitive resources even if injection occurs.
Known benign look-alikes
- Legitimate Agent Zero MCP configs using npx/uvx/python -m with safe package names.
- Security advisory text quoting CVE-2026-30624 payloads.
- MCP configs with non-shell commands (e.g., npx, uvx) and no inline-exec flags.