CVE-2026-5802

CVE-2026-5802 is an OS command injection vulnerability affecting idachev mcp-javadc versions up to 1.2.4, specifically in the HTTP Interface component where the jarFilePath argument can be manipulated to execute arbitrary commands. This vulnerability has a CVSS severity score of 7.3 (HIGH), indicating moderate risk with potential impacts to confidentiality, integrity, and availability. The attack requires no authentication or user interaction and can be executed remotely over the network via a simple HTTP request, making it relatively straightforward to exploit. While public exploit code is reportedly available, the vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and shows low exploitation activity with an EPSS score of 0.018, indicating minimal real-world exploitation to date. The vendor was notified early through an issue report but has not yet responded or released a patch, leaving affected systems vulnerable if the public exploits are leveraged by threat actors. Organizations running idachev mcp-javadc should apply updates when available or implement network controls to restrict HTTP Interface access pending remediation.