High nvd · CVE-2026-88755

CVE-2026-88755: Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a reposit

Published Oct 16, 2026 CVSS 7.8

Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers to execute arbitrary code via opening a crafted repository.

Agentic / MCP

Affected AI Products

mcp server

View original source

Get the weekly digest. Every Monday: top AI security stories of the week. Free.