🔥 CVE-2026-5029 — Code Runner MCP Server RCE

Unauthenticated Remote Code Execution via the run-code MCP Tool

Python Status License

Proof of Concept exploit for CVE-2026-5029 — a critical unauthenticated Remote Code Execution vulnerability in Code Runner MCP Server, triggered via the run-code MCP tool when the server is run with --transport http.

📋 Vulnerability Overview

🧠 Technical Description

Code Runner MCP Server exposes a JSON-RPC /mcp endpoint on port 3088 when launched with the --transport http flag. This endpoint is reachable with zero authentication — no API key, no session token, no origin check.

Any unauthenticated remote attacker who can reach the port can directly invoke the run-code MCP tool, which accepts arbitrary source code and a language identifier, writes it to a temp file, and executes it via child_process.exec() using the corresponding interpreter (bash, python, powershell, and 30+ others).

Since there is no sanitization applied to the code parameter at any stage, this results in full unauthenticated Remote Code Execution with the privileges of the process running the MCP server.

Case Study

https://medium.com/@phantom_hat/cve-2026-5029-unpatched-case-study-unauthenticated-remote-code-execution-rce-66c7706f2320

Attack Flow

┌──────────┐   JSON-RPC tools/call    ┌───────────────────────┐   exec()   ┌──────────┐
│ Attacker │ ──── run-code tool ─────▶│  /mcp  (port 3088)    │ ─────────▶ │   RCE    │
│          │    (no auth needed)      │  Code Runner MCP      │            │  on Host │
└──────────┘                          └───────────────────────┘            └──────────┘

1. Reconnaissance — Connect to the exposed /mcp endpoint and enumerate available MCP tools
2. Schema Discovery — Retrieve the run-code tool's input schema (code, languageId)
3. Exploit Delivery — Send a crafted tools/call JSON-RPC request with attacker-controlled code
4. Command Execution — Server writes code to a temp file and executes it via the selected interpreter

🗂️ Repository Structure

.
├── exploit.py           # 🎯 Interactive RCE exploit shell (Rich-based terminal UI)
└── README.md            # 📖 You are here

exploit.py — Interactive Exploit

The primary exploit script, built for professional use in security assessments and case studies. Connects to the target MCP server and drops into an interactive shell where any command is executed live through the vulnerable run-code tool.

Features include:

• Clean, structured terminal output using Rich
• Interactive exploit shell — enter commands, get output, back and forth, no re-running the script
• Language enumeration — list all languages the MCP server advertises support for
• Installed-language probing — checks which interpreters actually exist on the target host
• Selectable execution language via -l (defaults to shellscript)
• Verbose mode for detailed operational output

⚙️ Installation

Prerequisites

• Python 3.8+
• pip package manager

Setup

# Clone the repository
git clone https://github.com/0x00phantom-hat/CVE-2026-5029-Exploit.git
cd CVE-2026-5029-RCE-Exploit

# Install dependencies
pip install fastmcp rich

🚀 Usage

# Drop into an interactive RCE shell (default: shellscript)
python3 exploit.py -u http://TARGET:3088/mcp

# Use a specific language interpreter
python3 exploit.py -u http://TARGET:3088/mcp -l python

# List all languages the MCP server advertises support for
python3 exploit.py -u http://TARGET:3088/mcp --available

# Probe which language runtimes are actually installed on the target
python3 exploit.py -u http://TARGET:3088/mcp --installed -v

# Show the help menu
python3 exploit.py -h

Once connected, the exploit drops into an interactive prompt:

PhantomHat-MCP@Exploit-CVE-2026-5029 $ id

Type exit to close the session.

Command-Line Flags

📸 Exploit Phases

🔗 References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-5029
• CERT.PL Advisory: https://cert.pl/en/posts/2026/05/CVE-2026-5029
• Vulnerable Project: https://github.com/formulahendry/mcp-server-code-runner
• Vulnerable Sink (server.ts): https://github.com/formulahendry/mcp-server-code-runner/blob/main/src/server.ts

🛡️ Remediation

• Do not run --transport http on any network-reachable interface — stick to the default stdio transport
• If HTTP transport is required, bind strictly to 127.0.0.1 and place it behind an authenticated reverse proxy or VPN
• Firewall port 3088 at the host or network level
• Run the server as a low-privilege, sandboxed user or inside a locked-down container
• Monitor for unexpected run-code invocations and unusual child processes

⚠️ Disclaimer

This tool is provided for authorized security testing and educational purposes only.

Unauthorized access to computer systems is illegal under laws including the Computer Fraud and Abuse Act (CFAA), the Computer Misuse Act, and similar legislation worldwide. The author assumes no liability for misuse of this software.

Only use this tool against systems you own or have explicit written authorization to test.

Author: Phantom Hat

For authorized penetration testing and security research only.