CVE-2026-58195 | CyberRota

CyberRota Analysis

AI-Generated

The Agentic-Flow AI agent orchestration platform prior to version 2.0.14 is vulnerable to arbitrary OS command execution due to improper handling of user-supplied parameters in several server and tool scripts. This flaw allows attackers to execute commands with the privileges of the MCP server user, potentially leading to full system compromise. Organizations using affected versions should prioritize upgrading to version 2.0.14 to mitigate this high-severity risk.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals

poc

GitHub PoC Links

github.com ↗ github.com ↗ github.com ↗ github.com ↗ github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE

CVE-2026-58195

Severity

HIGH

CVSS

8.8

EPSS

0.46%

Original NVD Description

Agentic-Flow is an AI agent orchestration platform. Prior to 2.0.14, agentic-flow MCP server tools in src/mcp/standalone-stdio.ts, src/mcp/fastmcp/servers/claude-flow-sdk.ts, src/mcp/fastmcp/servers/stdio-full.ts, src/mcp/fastmcp/servers/http-streaming-updated.ts, src/mcp/fastmcp/servers/http-sse.ts, src/mcp/fastmcp/servers/poc-stdio.ts, src/mcp/fastmcp/tools/agent/{execute,list,parallel}.ts, src/mcp/fastmcp/tools/swarm/orchestrate.ts, and src/mcp/fastmcp/tools/hooks/pretrain.ts interpolated attacker-influenceable tool parameters such as agent, task, name, language, and agentdb directly into shell command strings passed to execSync(), allowing arbitrary OS command execution with the privileges of the MCP server user. This issue is fixed in version 2.0.14.