CVE-2026-81096 mims-harvard CVE debrief

Who should care

Administrators and users of ToolUniverse should assess their exposure and take immediate action to upgrade to version 1.3.0 or later and implement additional security measures. This includes reviewing compensating controls for exposed systems, checking relevant monitoring and detection logs, and tracking exceptions and retesting remediated assets. Operators, platform administrators, and security teams should also review the vulnerability's impact on their

Why it matters

CVE-2026-81096 is a critical vulnerability in ToolUniverse that allows unauthenticated remote code execution. The vulnerability exists in the python_code_executor tool and can be exploited by escaping the sandbox and executing code as the server process. The HTTP and MCP servers' lack of authentication and debugging enabled by default also contribute to the vulnerability. Administrators and users of ToolUniverse should assess their exposure and take immediate action to upgrade to version 1.3.0 or later and implement additional security measures.

• Unauthenticated remote code execution
• Sandbox escape vulnerability in python_code_executor tool
• Lack of authentication and debugging enabled by default on HTTP and MCP servers

Technical summary

The python_code_executor tool in ToolUniverse does not properly sanitize user input, allowing an attacker to escape the sandbox and execute arbitrary code. The HTTP and MCP servers bind to every interface with debugging enabled and no authentication, making it possible for any caller to reach the port and execute code as the server process. This vulnerability allows unauthenticated remote code execution, posing a critical risk to administrators and users of ToolUniverse. The vulnerability exists in the python_code_executor tool and can be exploited by escaping the sandbox and executing code as the server process.

Defensive priority

High

Recommended defensive actions

• Immediately upgrade to version 1.3.0 or later
• Implement additional authentication and authorization mechanisms for the HTTP and MCP servers
• Restrict access to the servers to only necessary interfaces and ports
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the python_code_executor tool not properly sanitizing user input, allowing an attacker to escape the sandbox and execute arbitrary code. The HTTP and MCP servers' lack of authentication and debugging enabled by default also contribute to the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.