MCP server manager UI let attackers run shell commands

SxDevOps 1.0 and 1.1 shipped an MCP management panel that hands a server command string straight to Python's subprocess call. The flaw, tracked as CVE-2026-93965, sits in backend/aiops/services.py, where the component managing MCP STDIO servers passes an endpoint_or_command argument into subprocess.Popen. NVD scores it 5.8 on CVSS v2. The fix is one commit, 2b4bf85.

The stakes are narrow but real. Anyone who can reach that admin endpoint, whether through weak auth, an exposed panel, or a compromised teammate account, gets to run arbitrary commands on the box hosting the MCP server manager. A config screen becomes a shell.

The CVSS score isn't the part that matters here. The shape is. STDIO MCP config is a command line by definition, since it tells a host process what binary to launch and what arguments to hand it. Any UI that takes that string from a user and passes it to a shell, rather than validating it against an allowlist or running it in a sandboxed subprocess with fixed arguments, builds an RCE into the product without meaning to.

NVD's advisory doesn't say whether other MCP management tools share the same pattern. It doesn't need to. If you're building or auditing an MCP server manager, the question isn't whether this specific CVE affects you. It's whether your own STDIO config path ever touches Popen, exec, or a shell call with user-controlled arguments. If it does, you have the same bug with a different vendor name on it.