On 27 October 2026, VulnCheck published nine CVE records against nine Model Context Protocol (MCP) servers. Eight are OS command injection. One is a permissive allowlist. Every injection record in the batch is scored with a local attack vector and low privileges required.
That scoring is correct on the CVSS form. It is a poor description of the agent case.
What was published
The nine records, as summarised by Severity Daily:
| CVE | Project (as stated in the record) | Failure mode in one line |
|---|---|---|
| CVE-2026-117558 | ai-sdlc MCP Server through 0.31.2 | repo interpolated into gh and run via execSync |
| CVE-2026-117559 | DroidMind through 0.4.0 | Shell allowlist bypassed with $() / backticks |
| CVE-2026-117560 | ATXP Gemini CLI Extension through 1.0.0 | Unsanitised tool params reach runAtxp() |
| CVE-2026-117561 | sf-mcp through 1.3.2 | escapeValue() misses backticks and $(); values reach execSync |
| CVE-2026-117567 | esp-mcp through commit 28afddf | target, port, project_path, project_name reach create_subprocess_shell |
| CVE-2026-117568 | mcp-ffmpeg through 1.0.5 | videoPath / outputDir reach child_process.exec |
| CVE-2026-117569 | Kali-GPT through commit a608c74 | Scanner params run with subprocess.run(..., shell=True) |
| CVE-2026-117570 | nmap-mcp through commit 3636afa | NSE categories such as exploit / dos past an allowlist |
| CVE-2026-117573 | hagent through commit 761eec6 | Tool args interpolated into shell commands |
Eight of the nine name no fix and no fixed version in the public write-up. Only CVE-2026-117558 is listed with a patch reference.
One record, read carefully
CVE-2026-117567 (esp-mcp) is typical of the batch. Attackers can put shell metacharacters into MCP tool parameters. Those values are passed to asyncio.create_subprocess_shell, so the resulting commands run as the MCP server user.
The Agentic Times notes that for esp-mcp, Kali-GPT and hagent, the NVD entries say prompt injection can reach the flaw: hostile text an agent reads can steer a tool call into running commands.
Four records in the nine name the attacker as a prompt-injected agent. CVE-2026-117560 is the most specific: instructions planted in email or SMS can put $() or backticks into parameters such as message_id, subject, or query. CVE-2026-117568 needs no prompt injection; the payload can live in a file or directory name.
Why "AV:L" is the wrong mental model for agents
CVSS marks these as local because the process that issues the shell call is already running as a user on the host. In an agent stack, that "local" caller is often the agent itself, after it read untrusted mail, a web page, a ticket, or a skill file.
The chain is short:
- Untrusted text reaches the model context.
- The model chooses an MCP tool and fills parameters from that text.
- The MCP server interpolates those parameters into a shell.
- The shell runs as the MCP server user.
From the host's point of view, nothing remote happened. From the operator's point of view, reading an email just became code execution.
That is why inventory matters more than a single CVSS number. The question is which MCP servers your agents can call, and whether anything can deny a catastrophic tool call before it leaves the host.
What a tool gate can and cannot do
A memory firewall and a host-side tool gate do not patch a vulnerable MCP server, and they do not rewrite third-party tool descriptions at registration. Where a host hook can deny, they can stop catastrophic tool calls before the host runs them. On Claude Code and OpenClaw, risky calls can also get an approval card when the gate is enforcing. Hermes has no approval prompt, so it blocks those calls instead.
ShieldCortex is a local, MIT-licensed memory firewall for agents (npm i -g shieldcortex). Writes through it are scanned. Action Guard (the tool gate) can deny only when bound to the host's hook:
| Host | Memory firewall | Tool gate |
|---|---|---|
| Claude Code | Yes | Bound via PreToolUse. Off until you turn it on. Only an enforcing posture hard-stops or asks approval; Watch only and Enforce when ready (shadow until readiness evidence exists; none ships) still let ordinary dangerous calls through. |
| OpenClaw | Yes | Bound via before_tool_call. Same off / Watch only / Enforce when ready split as Claude Code. |
| Hermes | Via local API | Bound via pre_tool_call once you run hermes plugins enable shieldcortex and shieldcortex api is up. Then it enforces by default (advisory opt-out: SHIELDCORTEX_ENFORCE=0). No approval prompt. |
| Cursor / Codex / generic MCP | Yes if the agent calls ShieldCortex tools | Unbound. Cannot wrap host Bash. |
shieldcortex doctor prints that split and will not say protected for a host that cannot deny. For Hermes it only reports whether the plugin copy is present, so confirm the plugin is enabled and the local API is running before you claim a deny path.
So for this CVE batch: only a live enforcing Guard posture on Claude Code or OpenClaw, or an enabled Hermes plugin with the local API up, can hard-block shell-shaped tool calls of this kind. Enabling the gate alone is not enough on Claude Code or OpenClaw if it is still Watch only or Enforce when ready. It does not fix the MCP server. On Cursor it cannot deny host Bash. It also does not cover connect-time bugs that never issue a model tool call.
Practical steps this week
- List every MCP server each agent can call. Prefer projects with a fixed release over commit-only boundaries.
- Treat email, SMS, web pages, tickets, and skill files as untrusted input into tool parameters, not as safe text.
- On Claude Code or OpenClaw, turn Action Guard on and confirm it is enforcing, not Watch only or Enforce when ready in shadow. On Hermes, enable the plugin and keep
shieldcortex apiup; do not treat a doctor "plugin present" line as a deny. Useshieldcortex doctorplus those runtime checks. - On Cursor or Codex, do not expect a memory scanner to stop shell execution. Keep high-risk MCP servers off those hosts until you have another control.
ShieldCortex is free for local use. Enterprise enquiries go to sales@drakonsystems.com. Product detail: shieldcortex.ai.