CVE-2026-88755: Z.ai ZCode starts MCP servers from a repo's config the moment you open it

What it is

The researcher's write-up: ZCode merges the repo-local .zcode/config.json into its MCP server list and connects to each server immediately. For stdio servers it spawns the configured command directly, so opening a repository runs whatever command the repository declares.

In their test on Windows 11, opening a crafted repo started an MCP handshake with no consent dialog and launched calc.exe automatically.

The auto-connected server's tool descriptions also go straight into the agent's context. A poisoned description got the agent to send the contents of ~/.zcode/v2/credentials.json (API keys, a JWT token and SSH workspace passwords) to the attacker's server with no warning.

The same researcher points to a similar earlier bug in OpenAI's Codex CLI (CVE-2025-61260). NVD lists this CVE as deferred, and we haven't found a vendor advisory yet.

How to check

1. Affected: ZCode desktop client 3.11.2.6792 (tested on Windows x64). Other versions weren't listed.
2. Before opening a cloned repo in ZCode, look for a .zcode/config.json file and read any MCP servers it declares.

How to fix

1. No fixed version is listed yet. Watch Z.ai's release notes for one.
2. Don't open untrusted repositories or pull requests in ZCode. Remove or review .zcode/config.json first.
3. If you opened an untrusted repo, rotate the API keys and tokens stored in ~/.zcode/v2/credentials.json.

# before opening a cloned repo in ZCode
cat .zcode/config.json 2>/dev/null

Sources

• Researcher write-up for CVE-2026-88755 (lkloliver) ↗
• NVD: CVE-2026-88755 ↗