Remote Code Execution Vulnerability in FrontMCP Framework by Agentfront
CVE-2026-67531

9.3CRITICAL

Key Information:

Vendor

Agentfront

Status
Frontmcp
Vendor
CVE Published:
5 August 2026

What is CVE-2026-67531?

The FrontMCP framework, utilized for the Model Context Protocol, harbors a severe vulnerability that allows scripts to escape its sandbox environment. This issue, present in versions prior to 1.5.7, permits unauthorized access to sensitive server data, including OAuth client secrets and database credentials. The flaw arises from the improper handling of live host Zod schema instances, exposing critical security controls to potential exploitation. Unauthenticated requests on a default configuration can exploit this vulnerability, making it imperative for users to upgrade to the latest version to safeguard their systems.

Affected Version(s)

frontmcp < 1.5.7

References

https://github.com/agentfront/frontmcp/security/advisorie...
x_refsource_CONFIRM
https://github.com/agentfront/frontmcp/commit/209cddd19a8...
x_refsource_MISC

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.