CVE-2026-30624

Agent Zero version 0.9.8 contains a critical remote code execution vulnerability in its External MCP Servers configuration feature. The flaw allows attackers to execute arbitrary operating system commands through maliciously crafted JSON configurations containing unsanitized command and argument values, potentially compromising systems running the affected application with the privileges of the Agent Zero process. The vulnerability presents a HIGH severity risk with a CVSS score of 8.6, featuring a network-based attack vector that requires no authentication or user interaction, making it trivial for remote exploitation. The impact spans multiple security dimensions, including confidentiality loss, integrity compromise, and availability disruption through command execution capabilities. The vulnerability currently shows no active exploitation in the wild, with no public exploit code available and minimal community attention reflected in its low EPSS score of 0.002960000. The vulnerability has not been added to the Known Exploited Vulnerabilities catalog and remains inactive on threat tracking lists, suggesting limited immediate risk in operational environments at this time.