2026-10-16 · 2026-Q4
Claude Agent SDK: A Crafted Session ID Injects an MCP Server and Runs Commands Past SDK Permissions (CVE-2026-96620)
PrimaryL5Config
- Fixable:
- Yes, vendor patch
- Vendor response:
- Patched
- In the wild:
- No
- Actor:
- Attacker
Target
`claude-agent-sdk` (Python) before 0.2.121
Impact
The SDK passed the `resume` option to the Claude CLI unvalidated, so a value beginning with `-` was read as a separate flag. An attacker controlling it could inject `--mcp-config` defining a stdio MCP server and get command execution at CLI startup that bypassed the SDK's permission controls. Exploitation requires an application that passes untrusted input as the session ID. CVSS v4 9.2
Root Cause
Argument injection from an unvalidated string into a CLI whose flags can load executable configuration