CVE-2026-30624

Agent Zero 0.9.8 is vulnerable to Remote Code Execution (RCE) due to a flaw in its External MCP Servers configuration feature. The application fails to sufficiently validate or restrict JSON configuration values for commands and arguments. An attacker can provide a malicious MCP configuration to ...