CVE-2026-55582 sonirico CVE debrief

Who should care

Defenders responsible for systems using mcp-shell, especially those in environments where Git is installed and secure mode is enabled, should assess exposure and prioritize remediation.

Why it matters

CVE-2026-55582 allows for arbitrary OS command execution in mcp-shell deployments prior to version 0.6.0, particularly in default Docker image configurations. Defenders should assess exposure, prioritize remediation, and monitor for suspicious activity.

• Potential for arbitrary OS command execution as the mcp-shell process user
• Bypass of default security configurations in mcp-shell
• Exploitation possible without additional authentication beyond MCP connectivity in default deployments
• Verification of version 0.6.0 or later required for fix

Technical summary

The mcp-shell server, used for running shell commands securely, has a vulnerability prior to version 0.6.0. The default security.yaml configuration allows /usr/bin/git, and a bypass in security.go enables a caller of the shell_exec MCP tool to execute arbitrary OS commands as the mcp-shell process user. This is achievable by providing the command argument /usr/bin/git -c alias.pwn=!<arbitrary-command>, causing Git to create a shell alias and execute arbitrary commands.

Defensive priority

Defenders should prioritize upgrading to version 0.6.0 or applying compensating controls to restrict access to the shell_exec MCP tool and monitor for suspicious activity.

Recommended defensive actions

• Upgrade to version 0.6.0 or later
• Restrict access to the shell_exec MCP tool
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD vulnerability detail provide information on the vulnerability, its impact, and the fix. Additional details are available in the source references, including GitHub commits, pull requests, and security advisories.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.