Command Injection via Host/Username Parameters in ssh-mcp-server
First seen Aug 7, 2026 · Updated Aug 7, 2026 · CVSS 5.3
A reported command injection flaw in the ssh_exec function of the ssh-mcp-server project involves unsanitized host/username parameters, but exploitation requires local access and the maintainer disputes it represents a real security boundary violation. Since the tool is explicitly designed as a trusted local component granting the calling agent shell-level execution capability, this does not constitute a meaningful privilege escalation. Severity is assessed as low given the disputed status, local-only attack vector, and lack of a genuine trust boundary crossing.
Technical Analysis
The ssh_exec function in src/index.ts of ssh-mcp-server's SSH Command Handler fails to properly sanitize the host and username arguments before constructing SSH commands, theoretically allowing command injection through crafted input. The entry point is the MCP tool interface exposed to an AI agent, meaning any caller invoking this tool could inject shell metacharacters into these fields. However, the maintainer's threat model explicitly treats this MCP server as a local, trusted tool that already grants callers shell execution capability via SSH, so the injection does not grant new privileges beyond what is already exposed. The lack of a versioned release (rolling release model) and disputed existence further weaken the practical impact, and no cross-agent or remote trust boundary is crossed.
Affected Systems
ssh-mcp-server (Kino-Kafkaesque); protocols: MCP
Detection Signatures
- Monitor MCP tool calls to ssh_exec for shell metacharacters (;, |, &&, $(), backticks) in host or username parameters
- Log and alert on SSH command construction using unsanitized string concatenation
- Review MCP server tool descriptions for missing input validation on host/username fields
- Audit local MCP server configurations granting SSH execution capability to agents
Remediation Steps
- 1
Sanitize SSH command inputs
Apply strict allowlisting or parameterized command construction for host and username fields in ssh_exec to prevent shell metacharacter injection.
- 2
Enforce least-privilege SSH credentials
Ensure the SSH credentials used by the MCP server have minimal permissions on target systems to limit blast radius even if injection succeeds.
- 3
Clarify and document trust boundaries
Explicitly document that this MCP server assumes callers are trusted, and avoid exposing it to untrusted or multi-tenant agent environments.
- 4
Pin and audit server versions
Since the project uses rolling releases, pin to specific commits and audit changes to src/index.ts before deployment.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.