Agent Zero MCP Configuration Command Injection via mcp_servers field (CVE-2026-30624) - ATR-2026-00541 (a8322b75-f1c0-5625-94ff-35ebbeb9c1ba)
Detects CVE-2026-30624 (CVSS HIGH, CWE-77): Agent Zero 0.9.8 passes the command and args fields from the mcp_servers configuration directly to OS subprocess execution without validation. An attacker who can supply or modify an Agent Zero MCP server configuration can inject a shell binary or interpreter with inline-exec flags, executing arbitrary commands on the host when Agent Zero initialises its MCP servers.
The attack is equivalent to the class-level vulnerability documented in OX Security's "MCP by design" advisory (April 2026) and shares root cause with CVE-2026-30617 (LangChain-ChatChat), CVE-2026-40933 (Flowise), and CVE-2026-30623 (LiteLLM) — all lack validation of user-controlled MCP STDIO command fields before subprocess spawning.
Agent Zero's configuration format uses 'mcp_servers' as the outer key with JSON or dict-style objects containing 'name', 'command', and 'args'.
Detection covers: (a) mcp_servers config with shell binary in the command field; (b) mcp_servers config where interpreter (-c/-e flags) or netcat/curl command
field enables RCE;
(c) Explicit CVE-2026-30624 / Agent Zero exploitation framing.