CVE-2026-7644

NextChat lets unauthenticated clients start a server process through MCP

ChatGPTNextWeb · NextChat MCP server actions

First documented disclosure · Review checkpoint

Summary

An exposed NextChat instance can execute commands selected by an unauthenticated client.

Severity and exploitation evidence

Medium · 6.9/10 · CVSS 4.0. Severity source.

Reported activity: Zeabur reports that service runtime logs showed exploitation of CVE-2026-7644 on August 27. Its September 7 incident report confirms code execution in the affected NextChat container. This CVE had no exact match in the CISA 2026.11.03 KEV catalog.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The server action that adds an MCP server accepts a command and its arguments, stores the configuration and starts a child process. The vulnerable action runs without checking either authorization or the MCP feature flag.

Conditions required

Network access to a vulnerable NextChat server with the affected server actions. The researcher demonstrated standalone 2.16.1 without an access code, including with MCP disabled.

Potential impact

Execution with the NextChat process privileges exposes workload-accessible files, credentials and network services. At Zeabur, separate cache, credential and network controls then allowed the intrusion to reach production data.

Affected versions and configurations

VulDB explicitly lists 2.16.0 and 2.16.1. The researcher and Zeabur both identify 2.16.1.

Fix and mitigation status

Two changes merged October 20. PR 6889 added the feature-flag check. PR 6921 then required a valid deployment access code and limited the child process environment. The latest upstream GitHub release checked was still v2.16.1, so no containing numbered GitHub release was verified.

Practical next steps

Remove vulnerable instances from public access until a reviewed build contains both upstream fixes. Configure a deployment access code, test unauthorized requests with MCP enabled and restrict the workload’s network access and secrets. Rotate credentials if exposure is suspected.

Operating lesson

Check authorization on the server action that launches a tool. Then limit what its process could reach if that check fails.

Evidence and limits

The researcher opened issue 6757 on April 17. VulDB’s advisory timeline begins May 1 and the CNA record appeared May 2. Zeabur’s August exploitation and the October source fixes are separate milestones. Disabling MCP alone did not block the action in the affected release.

Related incident and research records

Related records can include laboratory demonstrations; a relationship does not itself establish exploitation.

Sources