Vulnerability Report

CVE-2026-5029

RCE

Title: Code Runner MCP Server Unauthenticated RCE

RCE

Proof Of Concept

PoC Available for CVE-2026-5029

CWE Category CWE-306
Published Date May 12, 2026
Modified Date May 12, 2026
Exploit Status Available
Score 8.7 CVSS v4.0
Exploit Probability (EPSS)
0.29%

Vulnerability Summary

CVE-2026-5029: A remote code execution vulnerability exists in Code Runner MCP Server when run with the --transport http option, which exposes the /mcp JSON-RPC endpoint without authentication on port 3088. An unauthenticated remote attacker can invoke the run-code MCP tool to supply arbitrary source code and execute it via child_process.exec() using the specified language interpreter. This allows execution of arbitrary code with the privileges of the user running the server. This vulnerability has not been fixed and might affect the project in all versions.

Impacted Vendors

Analysis in Progress...

Reference Links

https://cert.pl/en/posts/2026/05/CVE-2026-5029
CVSS v4.0
Source Entity [email protected]
Severity HIGH
8.7
Attack Vector
ADJACENT
Complexity
LOW
Privileges
N/A
Interaction
NONE
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
N/A
RAW VECTOR CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2026-5029 Exploits & PoCs (Proof Of Concept)

GitHub https://github.com/0x00phantom-hat/CVE-2026-5029-Exploit
View Code
MODIFIED

Vulnerability data updated via NVD.

MODIFIED

Vulnerability data updated via NVD.

Attack Vector Matrix

Access Vector ADJACENT
Complexity LOW
Privileges N/A
Interaction NONE
CVSS Vector String CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected Stack

No specific products linked.