External risk intelligence

ToolUniverse Python Sandbox Escape Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-81096

The affected application components (HTTP and MCP servers) were configured to bind to all network interfaces by default with no authentication enabled, making the service directly reachable and exploitable from the public internet in its default deployment state.

Code Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Python code executor for ToolUniverse allowed unauthenticated attackers to run arbitrary code on the server. This was possible due to insufficient restrictions on attribute lookups and the server's default configuration to listen on all network interfaces without authentication, making it accessible externally. Version 1.3.0 has been released with security enhancements to address this.

Code execution vulnerability in ToolUniverse.
Default configuration allowed external, unauthenticated access.
Confirm relevance and assess exposure to unauthenticated code execution.

Attack Path

How an attacker could exploit the issue

An attacker could reach a vulnerable Python code execution tool that is exposed with no authentication and bound to all network interfaces. By chaining an argument that widens the import allow-list with a lookup that bypasses attribute checks, an attacker could import sensitive modules like `subprocess` to execute arbitrary code on the server. This could allow them to take control of the server process.

No authentication required to reach server.
Escapes sandbox to import sensitive modules.
Leads to unauthenticated remote code execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, unauthenticated attackers could execute arbitrary code on the server by escaping a Python sandbox. This could allow them to compromise the server process.

Server process could be compromised.
Sandbox escape via Python attribute lookup.
Remote code execution on the server.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Python code executor in ToolUniverse allows unauthenticated remote code execution through sandbox escape vulnerabilities. This critical vulnerability, exposed by default network binding and lack of authentication in its HTTP and MCP servers, can be exploited by any reachable caller. Initial actions should focus on identifying all deployments, assessing their reachability and business criticality, confirming ownership, and then prioritizing remediation or mitigation.

Identify affected instances and owners.
Verify network reachability and exposure.
Plan remediation or mitigation by owner.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ToolUniverse and what does it do?

ToolUniverse is a software framework designed to provide tools for computational tasks, specifically featuring a Python code execution environment. It uses specialized servers, such as HTTP and MCP interfaces, to allow users or other systems to send Python scripts to be processed and run on the host server.

What kind of vulnerability is CVE-2026-81096?

This is a Code Injection weakness, identified as CWE-94. It means the system fails to sufficiently sanitize or restrict user-supplied input before execution. In this case, the sandbox meant to isolate the Python code was incomplete, allowing the caller to bypass security checks and interact with system-level Python modules that should have been off-limits.

How does an attacker trigger this sandbox escape?

An attacker sends specially crafted Python code that exploits the executor's weak attribute-lookup process. By using specific coding patterns to walk through object structures, they can reach and import powerful modules like 'subprocess.' Note that simply sending standard Python code that does not attempt to bypass these specific lookup restrictions will not trigger the core sandbox escape.

Is my deployment at risk according to Halo Surface Signal?

Yes, if your instance uses default settings, it is highly likely to be reachable from the public internet. Halo Surface Signal indicates that because the HTTP and MCP servers bind to all network interfaces by default without requiring any authentication, any device with network access to the server can reach these vulnerable components.

How should I respond to this threat?

First, locate all running instances of ToolUniverse and determine which ones are accessible over your network. Confirm if your environment is using version 1.3.0 or later, which introduces necessary bearer-token authentication and restricts network binding to the loopback interface. If you are on an older version, restrict network access immediately while you prepare to update.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.