CVE-2026-55157: Token Optimizer MCP username reaches a shell

Tracking: CVE-2026-55157
Severity: High

Who is affected

token-optimizer-mcp before 5.1.0. The attacker must be able to invoke smart_user and control its username input.

How the attack works

The tool passes the supplied username into the get-user-info operation without safely separating data from shell syntax. A value intended to identify a user can therefore alter the operating-system command that runs.

The command inherits the MCP server account's permissions. The potential impact includes accessible files and credentials, but the CVE does not establish that every deployment grants broad host access.

What to do

1. Upgrade to 5.1.0 or later and restart affected instances.
2. Until patched, restrict access to smart_user and reject unexpected username values at the application boundary.
3. Review tool calls and child-process activity for unexpected commands. Limit the server's credentials and filesystem access, and rotate secrets if the investigation indicates exposure.

Scope and limits

The security boundary must be enforced where the process is started. A tool name or expected username format is not protection if the supplied value still reaches a shell.

Sources

• Original advisory or incident report