EUVD-2026-102905
GHSA-2vx4-m2rp-32rx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft repo with malicious MCP config
-
DeliveryDistribute repo to target developer
-
ExploitVictim opens repository in ZCode
-
ExecutionZCode auto-connects to attacker MCP server
-
ImpactArbitrary code execution on host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to open an attacker-crafted repository in Z.ai ZCode v3.11.2.6792; the trigger is ZCode automatically establishing connections to MCP servers declared in the repository's workspace configuration, which the description presents as automatic (apparently default) behavior with no user approval step. Limiting factors: the attack is local and content-delivered (AV:L) and demands user interaction (UI:R) - the victim must actually open the malicious repo - so it cannot be triggered remotely or unattended; it is also constrained to the specific affected ZCode build and requires the attacker to get their repository in front of the target. |
| Impact | Signals are moderately consistent but point to a conditional, interaction-dependent threat rather than a mass-exploitation emergency. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) correctly models this as a local, low-complexity flaw requiring victim interaction, and total technical impact (SSVC: Technical Impact total; C:H/I:H/A:H) is justified because the outcome is arbitrary code execution. However, the attack vector is NOT network-reachable despite the RCE tag: exploitation requires the victim to open an attacker-crafted repository, so this behaves like a malicious-content/supply-chain trap, not a remotely sprayable exploit. SSVC rates Exploitation as 'poc' (not active) and Automatable as 'no', and no CISA KEV listing and no EPSS score are present in the input - consistent with a vulnerability that is demonstrable but not yet weaponized at scale. Note the conflict between the 'Authentication Bypass' tag and CWE-284 (Improper Access Control): the actual defect is ZCode automatically trusting and connecting to MCP servers declared in untrusted workspace config, which is an improper-trust/access-control issue, not an authentication bypass - treat the tag as imprecise. Net: a real priority for developers using the affected ZCode build (public POC + total impact), but limited real-world blast radius due to required user interaction, local vector, and niche product footprint. |
| Exploit ScenarioDerived | An attacker publishes or shares a repository (e.g., via a public git host or a pull request) containing a crafted workspace configuration that declares a malicious MCP server. When a developer opens that repository in Z.ai ZCode v3.11.2.6792, the IDE automatically establishes the declared MCP connection and executes attacker-controlled logic, yielding code execution on the developer's machine. Publicly available exploit code exists (referenced POC gist and GitHub repository), lowering the barrier to reproduction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Opening an attacker-crafted repository in Z.ai ZCode v3.11.2.6792 can lead to arbitrary code execution because the IDE automatically connects to MCP (Model Context Protocol) servers declared in the repository's workspace configuration without requiring user approval. The flaw is rated CVSS 7.8 with a local attack vector and required user interaction - a victim must actively open the malicious repository - and publicly available exploit code exists, though there is no confirmed active exploitation (not in CISA KEV), so the threat is conditional and interaction-dependent rather than a mass-exploitation emergency. Exploitation is unauthenticated from the attacker's perspective and grants high confidentiality, integrity, and availability impact on the affected host.
RemediationAI
No vendor-released patch was identified at time of analysis, so remediation must be compensating-control driven until Z.ai publishes a fixed build. The most direct mitigation is to stop ZCode from honoring repository-supplied MCP declarations: disable the automatic MCP server connection / auto-approval behavior in ZCode settings (if exposed) or treat any repository-provided workspace configuration as untrusted and review or strip MCP server entries before opening the project. Because that setting may not exist in v3.11.2.6792, pair it with a hard boundary - run ZCode in an isolated VM or container with no access to host credentials, SSH keys, cloud tokens, or the corporate network, accepting the trade-off that the agent loses legitimate access to production tooling. Additional controls: restrict outbound egress from the developer workstation to an allowlist of approved MCP endpoints so rogue servers declared in a repo cannot be reached (side effect: may break legitimate self-hosted MCP tooling and requires maintaining the allowlist), and enforce policy that repositories from external or untrusted sources are opened only in a sandboxed profile. Detection should focus on unexpected outbound connections from ZCode to unfamiliar MCP hosts immediately after a repository is opened. Monitor http://zai.com and http://zcode.com and the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-88755 for an updated release; the public proof-of-concept at https://github.com/lkloliver/poc/tree/main/CVE-2026-88755 can be used to validate that any mitigation actually blocks the auto-connect trigger.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-284, Improper Access Control: ZCode fails to gate a security-sensitive action - establishing outbound connections to MCP servers - on explicit user consent. MCP (Model Context Protocol) is the framework used by AI-assisted development tools to let models invoke external tools and data sources through locally or remotely defined servers; servers are typically declared in repository-scoped configuration files so a project can define its own tooling. Because ZCode trusts that workspace configuration implicitly, a cloned or opened repository can inject an arbitrary MCP server endpoint into the tool's context, and the client will connect to it automatically. Since MCP servers can expose tool-calling capabilities that the host process executes with the developer's privileges, a malicious server can translate that automatic connection into arbitrary code execution on the workstation. The CVSS vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H confirms the attack is delivered locally via repository content (not over the network) and requires user interaction, but needs no prior authentication and results in total compromise of confidentiality, integrity, and availability within the vulnerable host's security scope. The supplied CPE string is a placeholder (n/a:n/a), so version pinning must come from the advisory text, which identifies Z.ai ZCode v3.11.2.6792 specifically.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attacker needs no privileges (PR:N) but the victim must open a crafted repo locally (AV:L, UI:R); automatic MCP connection yields code execution, so C/I/A all High.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers to execute arbitrary code via opening a crafted repository.
Executive ViewAI
Z.ai ZCode v3.11.2.6792 will automatically connect to MCP servers declared in a repository's workspace configuration and execute their code without asking the user, meaning any developer who opens an untrusted project can hand full control of their workstation to an attacker. The people affected are engineers who hold access to source code, credentials, build pipelines, and internal systems, so a single successful lure can escalate into intellectual property theft, supply-chain tampering, or a foothold for lateral movement. No vendor patch exists yet, and because the trigger is opening a malicious repository the risk cannot be closed through routine patch cycles alone.
No vendor-released patch identified at time of analysis. Interim mitigations: disable or block automatic MCP server connection and require explicit user approval for MCP servers declared in workspace configuration; restrict MCP servers to a pre-approved internal allowlist; prohibit opening repositories from untrusted or external sources; run Z.ai ZCode in a sandboxed or isolated environment with least-privilege credentials and restricted outbound network egress; monitor endpoints for unexpected child processes or anomalous outbound connections originating from the IDE; and migrate off Z.ai ZCode v3.11.2.6792 where the auto-connection behavior cannot be disabled.
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB