CVE-2026-26015 is a critical remote code execution flaw (CVSS 9.8) in DocsGPT, the documentation chat application. A crafted request to the MCP test endpoint can make the server run a command. Upgrade to DocsGPT 0.16.0. The record does not list it in CISA's KEV catalog, and the advisory we read does not report exploitation.
What's affected
- DocsGPT 0.15.0 up to, but not including, 0.16.0
- Fixed in 0.16.0
The advisory says any deployment is affected, local or public, and the project's website too. It lists no workaround.
How to check if you're exposed
Find the version of every DocsGPT deployment. If you run it from a container image, check the image tag; if you built from source, check the checkout against the 0.16.0 release tag. Then find out who can reach the backend. The record's vector needs no account, so a deployment that is reachable is a deployment that is exposed.
Look at logs for requests to the MCP test endpoint from addresses you do not recognize.
What to do now
- Upgrade to DocsGPT 0.16.0 and redeploy.
- Until then, limit network access to the backend to trusted users. The advisory does not say this, it is our general advice.
- Run the application as an unprivileged user in a container with no access to secrets it does not need.
- Rotate any API keys or tokens stored on a host that ran an affected version and was reachable.
- Review other MCP related features in your stack for the same pattern of trusting client input.
Why it matters
The class is CWE-77, command injection. The advisory explains the mechanism at a high level: the MCP test endpoint accepts a transport type chosen by the client. The web interface only offers HTTP based servers, but the server side reads the transport value from the request itself, so a request can ask for a transport that runs a local command. The interface limited the choices, and the server did not.
That gap is the oldest lesson in web security. Controls in the user interface are not controls. Anything a client sends has to be checked on the server against what the server allows.
The advisory also gives the issue a top score under CVSS 4.0, and the record shows 9.8 under 3.1. Either way, it is unauthenticated and remote.
MCP servers connect tools to AI applications, and many of them can run programs or reach files by design. That makes the endpoints that test or register servers a sensitive surface.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does the web interface prevent this?
No. The advisory says the interface only offers HTTP servers, but the server still reads the transport type from the request.
Is it exploited in the wild?
The record's KEV flag is false and the advisory does not say so.
Sources
Last reviewed: 19 October 2026.
