Fay MCP STDIO Server Unauthenticated Remote Code Execution

Technical Analysis

The vulnerability lies in how Fay manages MCP (Model Context Protocol) STDIO server configurations: the management interface accepts new server definitions, including the command and parameters used to spawn the STDIO process, without verifying that the request originates from a trusted, authenticated operator. An attacker with network access to this management interface can submit a crafted MCP server configuration whose 'command' field points to an arbitrary OS command or script. When Fay's agent runtime instantiates this MCP server to fulfill tool-calling requests, it spawns the attacker-supplied command with the privileges of the Fay service process, achieving remote code execution. This crosses the trust boundary between the agent orchestration layer and the underlying OS, effectively turning a tool-registration feature into a direct code execution primitive. No prompt injection or model reasoning is required — the flaw is a classic missing-authentication/insecure-deserialization-style issue in the MCP tool provisioning path rather than an LLM-manipulation attack.

Affected Systems

xszyou Fay; protocols: MCP

Detection Signatures

• Unauthenticated or unauthorized POST/PUT requests to Fay's MCP server management/config endpoints
• Newly registered MCP STDIO server entries with unexpected or suspicious 'command'/'args' values (e.g., shell interpreters, curl/wget, base64-encoded payloads)
• Unexpected child processes spawned by the Fay service (e.g., /bin/sh, cmd.exe, powershell) shortly after MCP config changes
• Outbound network connections initiated by Fay-spawned MCP processes to unfamiliar hosts
• Log entries showing MCP server creation/update API calls from unfamiliar or external source IPs

Remediation Steps

1. 1

   Upgrade Fay

   Apply the vendor patch or upgrade beyond 4.3.1 once available; monitor xszyou/Fay repository for a fix addressing MCP management authentication.

2. 2

   Restrict network exposure

   Ensure the MCP management interface is bound to localhost or an internal management network only, never exposed to the public internet.

3. 3

   Add authentication/authorization

   Require strong authentication (API keys, mTLS, or session tokens) and role-based access control before allowing MCP server registration or modification.

4. 4

   Allow-list MCP server commands

   Implement a strict allow-list of permitted executables/paths for MCP STDIO servers, rejecting arbitrary command strings supplied via the API.

5. 5

   Sandbox MCP process execution

   Run MCP STDIO server processes in a restricted sandbox (containers, seccomp, minimal-privilege service accounts) to limit blast radius if abused.

6. 6

   Monitor and alert

   Deploy detection for anomalous MCP configuration changes and unexpected child process creation from the Fay service.