Security Advisory

CVE-2026-79538 : Authenticated OS command injection and container RCE in metatool-ai/metamcp

Severity

Critical

CVSS 3.1

9.9

Published

September 22, 2026

Back to advisories

Table of Contents

Advisory details

Product:

MetaMCP (github.com/metatool-ai/metamcp)

Affected versions:

v2.4.22 and ai-dev commit ff4ff2d

Patched version:

CVSS 3.1 vector:

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE:

CWE-78 OS Command Injection; CWE-94 Code Injection

Publication status:

Pending publication on CVE.org

Summary

MetaMCP's inspector proxy accepts user-controlled process parameters. An authenticated user may be able to execute commands inside the application container.

Where the bug is

Component: the inspector proxy's STDIO transport handler in the backend
Public exposure: the frontend forwards the inspector proxy routes to the backend, so they are reachable on the public frontend port
Authentication gate: any valid user session. Self-registration with email and password is enabled by default and may permit account creation without email verification.

How it works

The inspector proxy exists so a user can launch and test their own configured MCP servers. For the STDIO transport, the handler accepts the process parameters from the request itself rather than resolving them from a server record the caller owns, and does not check them against an allowlist.

The only gate is a logged-in session. Registration is open by default, so an anonymous visitor can register, get a session, and reach the proxy. Because the frontend forwards the proxy routes on the public port, the handler is reachable from the network, not just from localhost.

This is the same class as the upstream MCP Inspector proxy-spawn issue, CVE-2025-49596. The differences here: the handler is exposed on the public frontend rather than localhost only, and it sits behind an authenticated session that default self-registration may make available without email verification. Command execution and secret disclosure were reproduced in a controlled deployment. No third-party host was tested.

Impact

Successful exploitation could expose secrets available to the container and may permit unauthorized access to tenant data or session forgery. The demonstrated execution context is an unprivileged application container; host-level root access was not established.

How to fix it

No patched release had been identified as of September 22, 2026. Treat this as an operational risk:

Until a patch is available, restrict public access and limit deployments to trusted networks.
Block external access to the inspector proxy routes (the /mcp-proxy/ path prefix) at the reverse proxy.
Turn off open self-registration.
Rotate every secret that was in the environment of an exposed deployment, including database credentials and the authentication signing secret.
For a code fix: derive process parameters from the caller's own saved server records rather than from the request, or remove raw process execution from the inspector proxy entirely.