CVE-2026-55580: mcp-shell security disabled by default and shell interpreter allowlist bypass

CVE-2026-55580 · Severity: high · CVSS 4 · Published 2026-08-25

mcp-shell is a server that allows AI language models to execute shell commands via an MCP (Model Context Protocol) interface. The tool has two critical configuration flaws: security validation is disabled by default in bare-binary deployments, and the official Docker image includes shell interpreters (bash, python) in its command allowlist, which defeats the intended security filtering. Together, these issues mean that default deployments run unrestricted shell command execution accessible to any connected language model via prompt injection or tool manipulation.

Technologies: github.com/sonirico/mcp-shell (Go), Sonirico MCP Shell. Vendors: Go, Sonirico.

Quick answers

Is CVE-2026-55580 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55580 being exploited in the wild.
How severe is CVE-2026-55580?
High severity, with a CVSS score of 4, published 25 August 2026.
Which products and versions are affected?
github.com/sonirico/mcp-shell (Go) < 0.6.0, SEMVER:introduced=0,fixed=0.6.0; Sonirico MCP Shell < 0.6.0.
Is there a fix for CVE-2026-55580?
Yes. github.com/sonirico/mcp-shell (Go): upgrade to 0.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55580 attacked?
It is attacked with local access or from the adjacent network, in a hosted service.
Am I affected by CVE-2026-55580?
Check whether you run github.com/sonirico/mcp-shell (Go) or Sonirico MCP Shell at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/sonirico/mcp-shell (Go): upgrade to 0.6.0 or later
    go get github.com/sonirico/mcp-shell@v0.6.0

Technical details

mcp-shell provides remote shell execution via stdio-based MCP transport. Finding 1: In config.go line 49, the SecurityConfig has Enabled: false by default. The main.go initialization (lines 35–39) reads MCP_SHELL_SEC_CONFIG_FILE from the environment, but if unset, logs "security disabled" and continues without validation. The documented README install path (git clone && make install && mcp-shell) sets no environment variables, resulting in security.go lines 26–29 short-circuiting all validation when Enabled=false. Any connected language model can then call shell_exec with arbitrary commands. Finding 2: The official security.yaml includes /bin/bash and /usr/bin/python3 in allowed_executables. When secure mode is enabled (use_shell_execution: false), executor.go lines 142–163 parse commands via strings.Fields() and check for dangerous metacharacters (|, &amp;, ;, $). However, an attacker can call shell_exec(command="/bin/bash -i") or shell_exec(command="/usr/bin/python3 /path/to/payload.py"), which passes the allowlist and metacharacter filter because the dangerous code lives in the interpreter's arguments or stdin, not in the direct command string. Both vulnerabilities are remotely exploitable by any MCP client (typically the operator's own language model) without network access or authentication. Patched in version 0.6.0.

Affected products

  • sonirico mcp-shell < 0.6.0

Identifiers

  • CVE-2026-55580
  • GHSA-f5pj-2738-996m
  • GO-2026-6292

Timeline

  • 2026-06-14: disclosed: GitHub Security Advisory published
  • 2026-08-25: advisory: Updated advisory with addendum
  • 2026-08-25: patched: Patched in version 0.6.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.