mcp-shell: allowlist validates only the first token, so /bin/bash -c runs any command

Impact

mcp-shell's whole security proposition is that shell_exec only runs binaries on an allowlist. Validation looks at the first token and the blocked-pattern check does not reject bash's -c flag, so /bin/bash -c <anything> passes the allowlist and then executes as the mcp-shell process user. In the shipped Docker image that is mcpuser inside the container, so the immediate blast radius is the container and whatever it mounts - source trees, credentials, kubeconfig, model directories that agent tooling is typically given. Anyone who can reach the MCP endpoint gets that; the allowlist provides no containment at all until 0.6.0.

Who can reach it

Any caller who can invoke the shell_exec MCP tool. No authentication beyond MCP connectivity is required in the default deployment, so exposure is exactly the set of clients and agents that can reach the server.

What to do

Upgrade to mcp-shell 0.6.0 and restart the server; for the Docker deployment, rebuild or repull the image and restart the container. Until then, remove /bin/bash from allowed_executables in security.yaml and restrict network access to the MCP endpoint. Fixed in commit f31377f (PR #16).

References

Related entries

• mcp-shell: allowed git binary runs arbitrary commands via a `!` alias, bypassing secure modeCVE-2026-55582 · mcp-shell (security.go shell-metacharacter checks, git alias handling)High
• Gradio: CORS origin validation bypassCVE-2024-47084 · GradioHigh
• Dagster: Vulnerability in Dagster Core prior to 1.13.1CVE-2026-41490 · DagsterHigh
• TorchServe (gRPC 7070/7071): gRPC ports bound to all interfaces regardless of configCVE-2024-35199 · TorchServe (gRPC 7070/7071)High
• Ollama (GGUF parser): Malformed 4-byte GGUF file crashes the server (two HTTP requests)CVE-2024-39720 · Ollama (GGUF parser)High
• Docker Model Runner (vllm-metal backend): `trust_remote_code=True` set unconditionally, no sandboxCVE-2026-5817 · Docker Model Runner (vllm-metal backend)High