CVE-2026-44717: MCP Calculate Server RCE

Detection Guidance

Start with asset discovery. Search source repositories, Python environments, dependency manifests, container build files, orchestration definitions, and MCP client configurations for MCP Calculate Server or server.py. Establish the deployed version and exposure path, including direct network listeners, reverse proxies, local stdio integrations, and LLM agent tool registrations.

A vulnerable service may be exposed indirectly. For example, an internet-facing application may accept prompts, pass tool calls to an internal MCP server, and return the result. In that design, the MCP server may not have a public IP address but remains reachable through an attacker-controlled application workflow. Review tool routing and authorization, not only firewall rules.

Technical Notes

If HTTP request logging is enabled, search for calculation requests containing Python metacharacters or known execution indicators. Adapt the field names to the deployed API format:

jq -r '
  select(
    tostring
    | test("__import__|importlib|os\\.|subprocess|Popen|system\\(|getuid|socket|/bin/sh|/bin/bash";
           "i")
  )
  | [.timestamp, .client_ip, .path, .request_body]
  | @tsv
' /var/log/mcp/*.json 2>/dev/null

For reverse-proxy logs that record raw request lines, use:

grep -Ei \
  '(__import__|importlib|os%2e|subprocess|Popen|getuid|/bin/(ba)?sh|socket)' \
  /var/log/nginx/access.log /var/log/apache2/access.log 2>/dev/null

Network monitoring should also look for unexpected outbound connections from the MCP process, particularly soon after a suspicious calculation request. A process-level rule can be more reliable than a payload signature:

Alert when:
  process.name in ("python", "python3")
  AND process.parent.name matches ("mcp", "server", "uvicorn", "gunicorn")
  AND child_process.name in ("sh", "bash", "curl", "wget", "nc", "ncat", "socat")

These indicators are generic and may produce false positives. Investigators should compare the event time with MCP requests, inspect the service account’s file and network access, and preserve the process command line and environment before restarting a potentially compromised instance.

Remediation and Patching

The primary remediation is to upgrade MCP Calculate Server to 0.1.1 or later. Because the supplied research does not specify a universal package name or installation method, use the project’s documented installation workflow and confirm that the deployed artifact resolves to the fixed version. For a source checkout, verify the checked-out release or commit; for a Python package, verify the installed distribution metadata.

A generic verification workflow is:

python -m pip show mcp-calculate-server
python -m pip install --upgrade "mcp-calculate-server>=0.1.1"
python -m pip check

The exact package name may differ in a local or repository-based deployment. Do not run the command blindly if the service is installed from a Git checkout, a private package index, or a container image. In those cases, rebuild from the patched 0.1.1 release or later, redeploy, and verify the running image or source tree.

After upgrading, restart the service and validate the actual runtime version:

python -c 'import importlib.metadata as m; print(m.version("mcp-calculate-server"))'

If the distribution name is different, inspect the project metadata or image contents. Confirm that no old worker processes remain and that health checks are reaching the newly deployed instance.

Temporary Mitigations

If immediate patching is impossible, the safest workaround is to disable or remove the vulnerable MCP Calculate Server. If it must remain operational temporarily, apply layered controls:

• Block untrusted network access with firewall or security-group rules.
• Require authentication at a trusted gateway where feasible.
• Prevent untrusted prompts and tool arguments from reaching the calculation endpoint.
• Replace unrestricted eval() with a safe mathematical-expression parser.
• Enforce an allowlist of operators, functions, symbols, and input formats.
• Run the service under a dedicated, unprivileged account.
• Remove cloud credentials and unnecessary filesystem access.
• Use container or VM isolation, read-only filesystems, and restricted egress.
• Monitor process creation and outbound network activity.

A temporary network restriction might look like this on a Linux host using ufw, although the correct rule depends on the deployment’s interface and source ranges:

sudo ufw deny to any port 8000 proto tcp
sudo systemctl stop mcp-calculate-server
sudo systemctl disable mcp-calculate-server

Do not treat network blocking as a code fix. Any trusted application or LLM workflow that can still submit attacker-influenced expressions remains a risk. If a workaround relies on input filtering, block Python-specific constructs such as __import__, attribute traversal, builtins access, and process or filesystem APIs, but prefer replacing eval() entirely because blacklist filtering is fragile.

For organizations reviewing broader security controls, a security architecture review FAQ can help structure assessment of trust boundaries, service exposure, and compensating controls.

For potentially exposed instances, investigate before redeployment. Review authentication and proxy logs, MCP request histories, child processes spawned by the service account, shell history where available, unexpected files, modified application code, cloud audit logs, and outbound DNS or network connections. Rotate credentials accessible to the service if compromise cannot be ruled out.

References

The following sources provide the vulnerability record, advisory details, exploitation examples, and remediation context:

1. NVD: CVE-2026-44717
2. GitHub Security Advisory: GHSA-2mgq-7rfg-rwpj
3. GitHub Advisory API record
4. CISA Known Exploited Vulnerabilities Catalog

The first response should be version verification and upgrade. MCP Calculate Server versions before 0.1.1 should be considered vulnerable, and deployments should be upgraded to 0.1.1 or later or removed from service. The public PoC supports prompt action even though confirmed in-the-wild exploitation has not been established.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.