vuldb.comadvisoryCVE-2026-90617 in PentestAgent
VulDB entry for CVE-2026-90617, a remote OS command injection (CWE-78) in GH05TCREW PentestAgent. The flaw is in run_task in interface/main.py of the MCP HTTP Server, affects everything up to commit cf882dab, and has a public exploit. The product uses rolling releases, so no version ranges exist, and the fix is an unmerged pull request. The analysis suggests compensating controls: restrict network access to the MCP server, run with least privilege, and validate input upstream.
TL;DR Remote OS command injection in PentestAgent's MCP HTTP Server run_task (CVE-2026-90617), public exploit, fix PR not yet merged.
Organisations named here
- CWE-78
- GH05TCREW
CVEs named here
- CVE-2026-90617
Technologies named here
- PentestAgent
- Model Context Protocol
Related in AppSec
github.comadvisoryFlowise MCP Security Bypass Enables RCE
huntress.comwriteupInside an Oracle Database SQL Injection Attack | Huntress
github.comrepoOASIS
blog.trailofbits.comwriteup