CVE-2026-67531 agentfront CVE debrief

Who should care

System administrators and security teams using FrontMCP should be aware of this vulnerability and take immediate action to update to version 1.5.7 or later. Those with public mode enabled or potential exposure to indirect prompt injection attacks should prioritize updates and monitoring.

Why it matters

CVE-2026-67531 is a critical vulnerability in FrontMCP that allows for remote code execution, potentially leading to unauthorized access and data breaches. Immediate attention is required to update to version 1.5.7 or later and monitor for potential exposure.

• Potential for remote code execution as the server user
• Exposure of sensitive data such as OAuth client secrets and database credentials
• Possible unauthorized access to cloud instance metadata
• Need for immediate update to version 1.5.7 or later for remediation

Technical summary

The vulnerability arises from the sandboxed codecall:execute tool in FrontMCP exposing live host Zod schema instances to scripts. This allows for exploitation to execute arbitrary code in the server process, potentially leading to unauthorized access and data breaches. The issue is particularly concerning as it can be triggered without human interaction on authenticated servers through indirect prompt injection in tool output or fetched content. A single tools/call is sufficient to escape the sandbox and achieve remote code execution as the server user, exposing everything the process holds such as OAuth client secrets, JWT_SECRET, session keys, database credentials, and cloud instance metadata. The framework's

Defensive priority

High priority should be given to updating FrontMCP to version 1.5.7 or later. Systems using FrontMCP should be reviewed for exposure, especially those with public mode enabled or those that may be vulnerable to indirect prompt injection attacks.

Recommended defensive actions

• Update FrontMCP to version 1.5.7 or later
• Review systems using FrontMCP for exposure, especially those with public mode enabled
• Monitor for indirect prompt injection attacks on authenticated servers
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its critical CVSS score of 9.3 and the affected version of FrontMCP. The vendor, agentfront, has provided a fix in version 1.5.7.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.