Executive brief
PentestAgent is an AI-driven security testing framework that includes an HTTP server for remote task execution. By default, this server binds to all network interfaces without authentication and exposes endpoints that allow attackers to trigger arbitrary shell command execution on the host system. A remote attacker can compromise any machine running PentestAgent and achieve full system control.
Technical details
The vulnerability is a chained authentication bypass and OS command injection in the MCP (Model Context Protocol) HTTP Server component. The root cause is a lack of authentication middleware combined with dangerous tool exposure: the server binds to 0.0.0.0:8080 by default with no API key, bearer token, or IP allowlist validation. An unauthenticated network client can call the run_task endpoint, which accepts arbitrary task strings and passes them to the LLM agent. The agent then executes tool calls, including shell commands via LocalRuntime's asyncio.create_subprocess_shell without sandboxing. The attack is remotely exploitable with no preconditions (no auth required, no user interaction). Exploitation results in arbitrary command execution with the privileges of the PentestAgent process. A pull request to fix this issue has been submitted but awaits acceptance.
Affected products
- GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a2
Timeline
- 2026-09-14: disclosed: Published to NVD
- 2026-08-04: exploited: Public exploit available; proof-of-concept published in GitHub issue #90