CVE-2026-67546

MCP discovery could launch an untrusted program on the shared backend

Heym · Heym MCP stdio discovery

First documented disclosure · Review checkpoint

Summary

The stdio discovery path started a proposed program before establishing whether it was trusted. Code could run with the backend's operating-system permissions.

Severity and exploitation evidence

High · 8.8/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed advisory does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The stdio discovery path started a proposed program before establishing whether it was trusted.

Conditions required

A signed-in user could access local-process MCP discovery.

Potential impact

Code could run with the backend's operating-system permissions.

Affected versions and configurations

Before 0.0.75. The maintainer lists the boundary version in both its affected and patched fields. The CNA excludes the patched build.

Fix and mitigation status

0.0.75.

Practical next steps

Upgrade and restrict who can register or discover local-process MCP servers.

Operating lesson

Apply authorization and isolation to every backend path that can act on behalf of an agent.

Evidence and limits

The public disclosure was on 2026-07-21. The CVE record was published on 2026-11-11.

Sources