title: Agent Zero MCP Configuration Command Injection via mcp_servers field (CVE-2026-30624)
id: ATR-2026-00541
rule_version: 1
status: experimental
description: |
  Detects CVE-2026-30624 (CVSS HIGH, CWE-77): Agent Zero 0.9.8 passes the `command` and `args` fields from the mcp_servers configuration directly to OS subprocess execution without validation. An attacker who can supply or modify an Agent Zero MCP server configuration can inject a shell binary or interpreter with inline-exec flags, executing arbitrary commands on the host when Agent Zero initialises its MCP servers.
  The attack is equivalent to the class-level vulnerability documented in OX Security's "MCP by design" advisory (April 2026) and shares root cause with CVE-2026-30617 (LangChain-ChatChat), CVE-2026-40933 (Flowise), and CVE-2026-30623 (LiteLLM) — all lack validation of user-controlled MCP STDIO command fields before subprocess spawning.
  Agent Zero's configuration format uses 'mcp_servers' as the outer key with JSON or dict-style objects containing 'name', 'command', and 'args'.
  Detection covers: (a) mcp_servers config with shell binary in the command field; (b) mcp_servers config where interpreter (-c/-e flags) or netcat/curl command
      field enables RCE;
  (c) Explicit CVE-2026-30624 / Agent Zero exploitation framing.
author: ATR Community
date: 2026/05/28
schema_version: '0.1'
detection_tier: pattern
maturity: draft
severity: high
references:
  owasp_llm:
    - LLM05:2025
    - LLM06:2025
  owasp_agentic:
    - ASI05:2026
    - ASI04:2026
  mitre_atlas:
    - AML.T0049 - Exploit Public-Facing Application
  mitre_attack:
    - T1059 - Command and Scripting Interpreter
    - T1190 - Exploit Public-Facing Application
  cve:
    - CVE-2026-30624
metadata_provenance:
  mitre_atlas: human-reviewed
  owasp_llm: human-reviewed
  owasp_agentic: human-reviewed
compliance:
  eu_ai_act:
    - article: '15'
      context: |
        CVE-2026-30624 Agent Zero passes mcp_servers command fields directly to OS subprocess without validation; Article 15 cybersecurity requirements mandate that AI agent configuration interfaces sanitize command parameters before execution.
      strength: primary
    - article: '9'
      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the tool-poisoning technique (Agent Zero MCP Configuration Command Injection via mcp_servers field (CVE-2026-30624)).
      strength: secondary
  nist_ai_rmf:
    - subcategory: MP.5.1
      context: |
        Attacker-controlled mcp_servers command values reaching subprocess execution constitute an adversarial input; MP.5.1 requires scanning MCP server config for shell-binary command fields and inline-exec argument patterns.
      strength: primary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (Agent Zero MCP Configuration Command Injection via mcp_servers field (CVE-2026-30624)).
      strength: primary
    - subcategory: MG.3.2
      context: NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (Agent Zero MCP Configuration Command Injection via mcp_servers field (CVE-2026-30624)).
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: |
        Operational controls must detect and block Agent Zero mcp_servers configurations containing shell binary command fields before agent MCP server initialisation.
      strength: primary
    - clause: '8.3'
      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (Agent Zero MCP Configuration Command Injection via mcp_servers field (CVE-2026-30624)) as a treatment control.
      strength: secondary
tags:
  category: tool-poisoning
  subcategory: mcp-config-command-injection
  scan_target: mcp
  confidence: high
  source: cve-disclosure
  vendor_sources: agent-zero-cve-2026-30624
agent_source:
  type: mcp_exchange
  framework:
    - agent-zero
    - any
  provider:
    - any
detection:
  condition: any
  false_positives:
    - Legitimate Agent Zero MCP configs using npx/uvx/python -m with safe package names.
    - Security advisory text quoting CVE-2026-30624 payloads.
    - MCP configs with non-shell commands (e.g., npx, uvx) and no inline-exec flags.
  conditions:
    - field: content
      operator: regex
      value: (?i)(?:mcp_servers|mcpServers)[^\n]{0,300}["\x27]command["\x27]\s*:\s*["\x27](?:(?:\/(?:usr\/(?:local\/)?)?bin\/)?(?:bash|sh|zsh)|cmd(?:\.exe)?|powershell(?:\.exe)?|pwsh|nc|ncat|netcat|curl|wget)["\x27]
      description: |
        Agent Zero mcp_servers / mcpServers JSON/dict with a shell binary or network tool as the command value — direct CVE-2026-30624 attack shape. Matches bare name (sh) and full path (/bin/sh, /usr/bin/bash).
    - field: content
      operator: regex
      value: (?i)(?:mcp_servers|mcpServers)[^\n]{0,300}["\x27]command["\x27]\s*:\s*["\x27](?:python3?|perl|ruby|node|bun)["\x27][^\n]{0,200}["\x27]args["\x27]\s*:\s*\[[^\]]*["\x27]-[ceE]["\x27]
      description: |
        Agent Zero mcp_servers / mcpServers config with interpreter command + -c/-e/-E inline-exec flag in args — interpreter-based RCE via MCP server initialisation
    - field: content
      operator: regex
      value: (?i)(?:mcp_servers|mcpServers)[^\n]{0,100}(?:'command'|"command")[^\n]{0,60}(?:'args'|"args")[^\n]{0,200}(?:-[ceE]\s+["']?[^"'\s]|-[ceE]["']|\|\||&&|;\s*[a-z]|`|\$\()
      description: |
        mcp_servers / mcpServers with command + args fields containing inline-exec flags or shell metacharacters — generalised Agent Zero RCE pattern. Matches both quoted and unquoted -c/-e payloads.
    - field: content
      operator: regex
      value: (?i)(?:CVE-2026-30624|agent.zero[^\n]{0,80}mcp)[^\n]{0,200}(?:inject|exec|exploit|bypass|rce|command[_\s-]?inject)
      description: |
        CVE-2026-30624 or Agent Zero + MCP reference combined with exploitation language — attack framing in skill or tool description
response:
  actions:
    - alert
    - block_tool
  message_template: |
    [ATR-2026-00541] HIGH: Agent Zero mcp_servers configuration with shell binary command field detected (CVE-2026-30624, CWE-77). Agent Zero 0.9.8 passes mcp_servers command values directly to subprocess without validation. Block this configuration; enforce a command allowlist (npx, uvx, python -m) and upgrade Agent Zero to a patched version.
confidence: 82