External risk intelligence

cli-mcp-server Command Allowlist Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-85660

The vulnerability exists in a command-line interface Model Context Protocol (MCP) server. While MCP servers can be exposed as network services for AI agents or remote tools, they are frequently used locally or within restricted development or internal environments, making public internet exposure possible but not the default or intended design for most deployments.

OS Command Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in a command-line server allows attackers to bypass security checks and execute unauthorized commands, potentially impacting systems where this server is enabled with specific operator settings. The main concern is confirming the relevance and exposure of this technology within our environment.

Bypass security checks to run unintended commands.
Matters for systems allowing shell operators.
Confirm relevance and exposure of this server.

Attack Path

How an attacker could exploit the issue

An attacker could reach this vulnerability by interacting with a command-line interface server exposed to the network. By crafting a request that includes specially formatted shell commands, an attacker can bypass the server's command validation, leading to the execution of arbitrary commands. This could allow an attacker to compromise the server's integrity and data.

Network access required.
Bypasses command validation.
Leads to arbitrary command execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to execute arbitrary commands on systems running the affected software when the `ALLOW_SHELL_OPERATORS` setting is enabled. This could impact system behavior and potentially expose or modify system data.

System commands and data.
Remote command execution.
Unauthorized system control.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given that the vulnerability is in a command-line interface tool, ownership likely falls to the teams managing the development or operational environments where this tool is deployed. Initial steps should focus on identifying all instances of the tool, confirming their exposure and criticality, and then engaging the responsible application or platform owners to plan remediation.

Application owners should confirm deployments and impact.
Verify tool reachability and business criticality.
Plan risk-based remediation with owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is cli-mcp-server?

cli-mcp-server is a tool designed to expose command-line interface functionality via the Model Context Protocol (MCP). It allows AI agents or remote systems to interact with local terminal commands. Developers typically use it to integrate command execution capabilities into AI-driven workflows, effectively bridging the gap between automated assistants and server-side shell operations.

What does the CVE-2026-85660 bypass mean?

This vulnerability falls under the category of OS Command Injection (CWE-78). It means that when the software is configured to support shell operators, it fails to properly sanitize input. An attacker can use specific syntax—like backticks or command substitution—to trick the server into running commands that were not explicitly included in the allowed list, effectively ignoring the intended security restrictions.

How does an attacker trigger this command injection?

An attacker triggers this by sending a crafted request to the server that uses shell substitution characters. The vulnerability only activates if the specific configuration setting ALLOW_SHELL_OPERATORS is enabled. If this setting is disabled, or if the server does not allow shell-specific syntax in its input, the bypass mechanism cannot be invoked to run unauthorized commands.

Is my server at risk if it is not on the internet?

According to Halo Surface Signal, this software is often used in local or restricted development environments, though it can be exposed as a network service. If your instance is strictly internal and isolated from untrusted networks, the immediate risk is lower compared to services exposed directly to the public internet. You should verify if your deployment is reachable by unauthorized parties.

What are the first steps to address this vulnerability?

Begin by auditing your environment to locate all active deployments of the software. Determine if the ALLOW_SHELL_OPERATORS setting is currently enabled in your configurations. If it is, consider disabling this feature or restricting network access to the server as an immediate protective measure while you coordinate with your application owners to manage the risk.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.