CVE-2026-67531

CVE-2026-67531 is a Zod v4 proxy escape that allows JavaScript code to break out of the schema validation sandbox and reach Function.constructor, enabling arbitrary code execution. However, the vulnerability's real danger comes from how the MCP SDK ships by default. The DEFAULT_AUTH_OPTIONS configuration defaults to unauthenticated access on the /tools/call endpoint. This means any server deploying the MCP SDK with default settings is immediately exposed to unauthenticated RCE — attackers don't need valid credentials, they just need to hit the endpoint. The Zod proxy invariant becomes trivial to exploit because there's no authentication gate to bypass. The 1.5.7 patch reportedly changes this default to authentication-required, which closes the mass-exploitation vector. However, this is a configuration change, not a code fix. The underlying Zod proxy issue persists, and the CVSS 9.3 rating assumes unauthenticated access — servers that enable authentication may still be vulnerable through indirect paths: — Internal service calls: any authenticated endpoint or internal service that invokes tools/call can trigger the proxy escape — Indirect prompt injection: tool outputs fed to an LLM can cause re-injection, where the LLM invokes tools/call with maliciously crafted payloads — this bypasses human-gated access entirely — HTTP-level bypass: if authentication middleware executes after other middleware (logging, CORS, metrics), HTTP smuggling or timing oracles may allow attackers to reach the unauthenticated code path For defenders: upgrade to 1.5.7+, but don't stop there. Audit whether any internal code paths call tools/call — these remain exploitable. Treat tool outputs as untrusted input to LLMs, as indirect prompt injection can turn a legitimate tool into an exploitation vector. Review middleware ordering to ensure authentication actually gates the endpoint before any other processing. The correct remediation is two-layer: enforce auth at the route registration level as a non-optional guard, not just a configuration flag, and consider whether tools/call should ever expose live Zod instances to caller code at all.

Reviewed through automated stages and approved by a human before publication.