Techno Blog
Chronicles from the Digital Era
Chronicles from the Digital Era: Cybersecurity Watch and Expertise
Recherche & expertise
CVE-2026-57860 – How automated mcp loading enables initial access and persistance.
Reading time:
7 minute(s)
-
21 September 2026
Background
In the past few months, AI Coding assitants have proven useful in many ways, not only in coding tasks but also in hacking. Paired with a state-of-the-art Model, a coding harness can analyze code, identify vulnerabilities and write a complete exploit from scratch in a few hours.
The two major open-source coding agents are Opencode and Forgecode. Both terminal-based, wired to an LLM API of your choice and both capable of connecting to local and remote MCP servers to gain access to a broad toolset.
This new family of software also introduces a new family of attack surfaces
The Attack Surface : Auto-loading of Untrusted Configuration
One pattern runs across virtually every coding agent in the industry : configuration files, MCPs, MCP Definitions, plugins and similar resources are loaded and executed automatically at launch with little to no verification, sandboxing, or user consent.
Auto-loading is a legitimate and useful feature. The problem is that none of these tools, by default, distinguish between configuration originating from a trusted source and configuration that does not. Any code that lands in the right or location may be executed automatically.
The attack scenarios this enables fall into two distinct categories :
- Initial access: a user clones an external or untrusted repository; malicious configuration executes silently on first launch
- Persistence: an attacker with write access to a trusted, established repository plants a payload that executes every time a developer opens the project, blending into normal workflow
ForgeCode: CVE-2026-57860
After identifying this class of vulnerability conceptually, I audited ForgeCode’s MCP handling and confirmed the same pattern: .mcp.json files are parsed and their defined MCP server configurations are executed automatically at startup, with no prompt and no trust check.
Proof of concept: [Bug]: Arbitrary Code Execution when running forge in untrusted repo · Issue #3022 · tailcallhq/forgecode
The ForgeCode team responded promptly. The issue was patched and assigned CVE-2026-57860. The fix was a trust dialog that surfaces any pre-configured .mcp.json file to the user before execution, requiring explicit confirmation.
OpenCode: Unpatched Plugin Auto-Execution
A parallel issue exists in OpenCode’s plugin system. Plugins in OpenCode can be scoped globally or per-project and are designed to integrate external features or alter default behavior. The same dangerous assumption applies : plugin files are trusted and executed blindly, regardless of their origin.
This was reported to the OpenCode team. They classified it as “unharmful known behavior” and issued no fix. It remains unpatched.
Prior Art: Claude Code
This vulnerability class is not new. Two earlier CVEs document the same pattern in Claude Code:
In both cases, code executed before the trust dialog was presented to the user — meaning the prompt that was supposed to protect the user fired after the damage was already done. Both were patched.
The Fix Is Simple
A confirmation dialog. That’s it. Alert the user when a project includes pre-configured MCP, plugin, or agent configuration files, and ask whether they trust it before executing anything. ForgeCode does this. Claude Code does this. OpenCode does not.
Tools in this space are increasingly used by people who may not fully understand the implications of “executing code on launch”. The attack surface is real, exploitation is trivial, and a single confirmation prompt stands between a useful developer tool and a reliable initial access vector.
Security engineer with hands-on SOC operations experience in threat detection, incident response, and enterprise infrastructure defense. Actively conducting security research across multiple domains.
Ces contenus pourraient vous intéresser
