Code Runner MCP Server RCE via unauthenticated endpoint

CVE-2026-5029 allows unauthenticated remote code execution in Code Runner MCP Server via exposed JSON-RPC endpoint on port 3088; vulnerability remains unpatched.

CERT Polska disclosed CVE-2026-5029, a critical remote code execution vulnerability in Code Runner MCP Server. When the server runs with the --transport http option, it exposes an unauthenticated /mcp JSON-RPC endpoint on port 3088. An attacker can invoke the run-code MCP tool through this endpoint to supply arbitrary source code, which the server executes via child_process.exec() using the specified language interpreter.

The vulnerability allows complete code execution with the privileges of the user running the server process, requiring no authentication or prior access. CERT Polska coordinated disclosure after receiving a report from researcher Eryk Winiarz.

As of this advisory, the vulnerability remains unpatched and affects all versions of the project where the HTTP transport option is enabled. Organizations running Code Runner MCP Server with --transport http should consider disabling this option or restricting network access to port 3088 until a fix becomes available.

title: Suspicious Child Process Spawned by Node.js MCP Server
id: bbd89ff3-5123-560e-ba93-33859375f260
status: experimental
description: 'Detects command/script interpreters (cmd, powershell, sh, bash, python,
  perl, ruby, node -e) spawned as a

  direct child of a Node.js process. Code Runner MCP Server executes attacker-supplied
  source code via

  child_process.exec() when its unauthenticated /mcp HTTP endpoint (CVE-2026-5029)
  is invoked with the

  run-code tool, resulting in an interpreter process being launched by the Node.js
  server process.

  '
references:
- CVE-2026-5029
author: Vorant
tags:
- attack.t1059
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \node.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \sh.exe
    - \bash.exe
    - \python.exe
    - \python3.exe
    - \perl.exe
    - \ruby.exe
    - \wscript.exe
    - \cscript.exe
  filter_dev_tools:
    ParentCommandLine|contains:
    - npm run
    - npm install
    - 'yarn '
    - webpack
    - jest
    - eslint
  condition: selection_parent and selection_child and not filter_dev_tools
falsepositives:
- Legitimate Node.js build/test tooling (npm scripts, yarn, webpack, jest) that spawns
  shells as part of normal development workflows
- Node-based CI/CD runners that legitimately invoke shell commands
level: high

title: Inbound Connection to Code Runner MCP Server Port 3088
id: f502538e-f427-5163-9dc7-9bbb4893ded9
status: experimental
description: 'Detects network connections to TCP port 3088, the default listening
  port exposed by Code Runner MCP Server

  when started with --transport http. This endpoint is unauthenticated (CVE-2026-5029)
  and allows remote

  invocation of the run-code tool for arbitrary code execution. Any external or unexpected
  internal access

  to this port on a host running the vulnerable server warrants investigation.

  '
references:
- CVE-2026-5029
author: Vorant
tags:
- attack.t1190
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 3088
  filter_local:
    DestinationIp|cidr:
    - 127.0.0.0/8
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
  condition: selection and not filter_local
falsepositives:
- Legitimate internal clients (e.g., IDE plugins) intentionally connecting to a properly
  firewalled Code Runner MCP Server instance
- Port scanning or asset discovery tools not related to active exploitation
level: medium

title: Code Runner MCP Server Launched with HTTP Transport Enabled
id: b5918ce9-76d8-5784-8177-d991eb22a60a
status: experimental
description: 'Detects the Code Runner MCP Server process being started with the --transport
  http command-line option.

  This configuration exposes an unauthenticated /mcp JSON-RPC endpoint on port 3088
  that allows remote

  attackers to invoke the run-code tool for arbitrary code execution (CVE-2026-5029).
  Identifying this

  startup configuration helps flag hosts at risk before exploitation occurs.

  '
references:
- CVE-2026-5029
author: Vorant
tags:
- attack.t1190
- attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
    - transport
    - http
    CommandLine|contains:
    - code-runner
    - run-code
    - mcp
  condition: selection
falsepositives:
- Intentional administrative deployment of Code Runner MCP Server with HTTP transport
  for internal automated tooling, which should still be reviewed for exposure and
  authentication
level: low

Source reporting: https://cert.pl/en/posts/2026/05/CVE-2026-5029