Skip to content
AgentProv

2026-10-16 · 2026-Q4

Claude Agent SDK: A Crafted Session ID Injects an MCP Server and Runs Commands Past SDK Permissions (CVE-2026-96620)

Primary layerL5 Config

Who wrote the file that runs on open?

The question layer 5 asks, and failed here.
Fixable
Vendor patch
Vendor response
Patched
In the wild
No
Actor
Attacker

Target

`claude-agent-sdk` (Python) before 0.2.121

Impact

The SDK passed the `resume` option to the Claude CLI unvalidated, so a value beginning with `-` was read as a separate flag. An attacker controlling it could inject `--mcp-config` defining a stdio MCP server and get command execution at CLI startup that bypassed the SDK's permission controls. Exploitation requires an application that passes untrusted input as the session ID. CVSS v4 9.2

Root cause

Argument injection from an unvalidated string into a CLI whose flags can load executable configuration

CVE

Sources

Catalog

View this entry in the catalog

Cite this: AgentProv incident record: Claude Agent SDK: A Crafted Session ID Injects an MCP Server and Runs Commands Past SDK Permissions (CVE-2026-96620) (2026-10-16). https://agentprov.com/incidents/2026-10-16-claude-agent-sdk-a-crafted-session-id-injects-an-mcp-server-and-runs-commands

Related