Skip to content
Hermes Codex

CVE-2026-30615: Windsurf MCP Prompt Injection RCE

Root Cause Analysis

Section titled “Root Cause Analysis”

Analysis indicates that the vulnerability originates from insecure processing of MCP configurations. The application fails to sanitize inputs provided in JSON format, allowing command injection.

Exploit Analysis

Section titled “Exploit Analysis”

The attack vector leverages the MCP adapter configuration logic. By injecting a malicious JSON configuration containing arbitrary command and argument values, the LiteLLM process executes these inputs on the host system.

Detection Rules

Section titled “Detection Rules”
title: Windsurf MCP Prompt Injection RCE Detection
logsource:
  category: process_creation
detection:
  selection:
    CommandLine: '*mcp*register*'
  condition: selection