CVE-2026-9764

Bob Shell could start repository-defined MCP servers before the user trusted the workspace

IBM · Bob Shell workspace MCP configuration

First documented disclosure · Review checkpoint

Summary

Opening an untrusted repository could launch code under the account running IBM Bob Shell.

Severity and exploitation evidence

High · 8.8/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed public disclosures do not report exploitation in the wild.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The shell initialized MCP servers declared by the project before requiring the user to trust its configuration.

Conditions required

A user opens a repository controlled by an untrusted party in an affected Bob Shell version.

Potential impact

Repository-defined code could read or change files and run other actions permitted to the user.

Affected versions and configurations

1.0.4 through 2.0.1.

Fix and mitigation status

2.0.2.

Practical next steps

Upgrade Bob Shell to 2.0.2 or later. Until then, IBM advises opening only repositories from trusted sources.

Operating lesson

Require a workspace trust decision before starting project-defined local tools.

Evidence and limits

IBM disclosed the flaw October 7. Its CVE was published November 8.

Sources