Z.ai ZCode: Automatic connection to MCP servers from workspace configuration
Summary
Z.ai ZCode v3.11.2.6792 automatically connects to MCP servers declared in a repository's workspace configuration. An attacker can provide a crafted repository that causes the application to start or connect to attacker-defined servers, which may allow arbitrary code execution. The attack requires that a user opens the crafted repository in ZCode, and a public proof of concept is referenced.
Affected
- ZCode v3.11.2.6792 (as described in the CVE record; the NVD record contains no vendor-confirmed version fields)
- Third-party research reports the same auto-connect behaviour in versions 3.14.0, 3.14.3 and 3.15.1. This is unverified, so the affected scope may be wider than the CVE text.
Fixed in
Unknown. No vendor advisory, fixed version or patch was found.
Workaround
- No vendor-confirmed mitigation is known.
- Do not open untrusted or third-party repositories in ZCode.
- Review .zcode/config.json and similar files for declared MCP servers before opening a repository.
- Ask Z.ai whether a supported setting exists to require approval for workspace MCP servers.
Exploitation
- A public proof of concept is referenced in the NVD record.
- CISA SSVC assessment: exploitation 'poc', automatable 'no', technical impact 'total'.
Our recommendation
- Inventory where ZCode is installed.
- Treat cloned or third-party repositories as untrusted and inspect their MCP configuration before opening them.
- Monitor for unexpected child processes started by ZCode.
- Check with Z.ai for a fixed version and install it as soon as it is available.
- Restrict ZCode use on systems that handle sensitive data until a fix is confirmed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-88755 Proof of Concept repository github.com
- CVE-2026-88755 gist gist.github.com
- CVE-2026-88755 on OpenCVE app.opencve.io
- Z.ai ZCode vendor site (reference in CVE record) zcode.com
- agent-audit-kit issue 1018 (third-party report on auto-connect) github.com
- mcp-manager issue 59 (workspace config load order) github.com
- zcode-acp issue 16 (ZCode 3.11.2 MCP connection fixes) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 23:52.
Original description (NVD)
Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers to execute arbitrary code via opening a crafted repository.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.