{"id":"CVE-2026-9764","kind":"vulnerability","aliases":["CVE-2026-9764"],"related":[],"title":"IBM Bob Shell runs MCP servers from an untrusted repository without consent (code execution)","description":"IBM Bob 1.0.4 through 2.0.1 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code.","summary":"Per IBM's bulletin, opening an untrusted repository in IBM Bob Shell 1.0.4 to 2.0.1 could automatically run MCP servers defined in the repository's workspace configuration without explicit user consent, giving the attacker code execution. IBM fixed it in 2.0.2 with a Workspace Folder Trust feature that blocks workspace-defined MCP servers and other workspace configuration until the user trusts the repository.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM Bob Shell","fixed":["2.0.2"],"affected":">= 1.0.4, <= 2.0.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["ai-tooling","bob-shell","ibm-bob","mcp","untrusted-repository"],"not_affected_if":["only-trusted-repos"],"how_to_check":"Run Bob Shell's version command (or check your installed package). Versions 1.0.4 through 2.0.1 are affected. Also check whether any repositories you opened in Bob Shell contain a .bob/mcp.json that defines MCP servers you did not write.","fix":"Upgrade IBM Bob Shell to 2.0.2 or later (Workspace Folder Trust blocks workspace-defined MCP servers until the repo is trusted).","status":"open","published_at":"2026-11-08T19:17:54+00:00","first_seen_at":"2026-11-08T19:22:35+00:00","triaged_at":"2026-11-08T19:23:06+00:00","updated_at":"2026-11-08T19:23:48+00:00","category":"ai-tooling","confidence":0.9,"triage":{"at":"2026-11-08T19:23:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM Bob: remote attacker can inject arbitrary code on the system","impact":"high","summary":"IBM Bob versions 1.0.4 through 2.0.1 fail to properly control user-supplied input that is executed as code. A remote attacker can use this to inject and run arbitrary code on the affected system.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["ibm-bob"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs arbitrary code on the affected system remotely","analyst_note":"Find the IBM security bulletin for CVE-2026-9764 to confirm the fixed version, the affected component and the attack preconditions.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"IBM Bob 1.0.4 through 2.0.1 is named in the advisory; the sources do not describe the deployment path, configuration, or which users are exposed. unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000661,"input_tokens":4516,"output_tokens":418,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the IBM security bulletin for CVE-2026-9764 to confirm the fixed version, the affected component and the attack preconditions.","search":"'-2026':16A,19A '-9764':17A,20A '1.0.4':49B,103C '2.0.1':51B,105C '2.0.2':77B 'ai':25B 'ai-tool':24B 'allow':107C 'arbitrari':113C 'attack':70B,110C 'automat':53B 'block':85B 'bob':2A,22A,28B,32B,47B,102C 'bob-shel':27B 'bulletin':40B 'code':13A,71B,114C,126C 'configur':63B,94B 'consent':12A,67B 'control':122C 'could':52B,106C 'cve':15A,18A 'defin':57B,88B 'due':118C 'execut':14A,72B 'explicit':65B 'featur':83B 'fix':74B 'folder':81B 'give':68B 'ibm':1A,21A,31B,38B,46B,73B,101C 'ibm-bob':30B 'improp':121C 'inject':112C 'input':125C 'mcp':5A,33B,55B,89B 'open':41B 'per':37B 'remot':109C 'repositori':10A,36B,44B,60B,100B 'run':4A,54B 'server':6A,56B,90B 'shell':3A,23A,29B,48B 'system':117C 'tool':26B 'trust':82B,98B 'untrust':9A,35B,43B 'untrusted-repositori':34B 'user':66B,97B,124C 'without':11A,64B 'workspac':62B,80B,87B,93B 'workspace-defin':86B","nicknames":[],"mitigations":[],"who_affected":"Anyone running IBM Bob Shell 1.0.4 through 2.0.1 who opens a repository from an outside or untrusted source. The repository's workspace-defined MCP server configuration is started without explicit consent, so the attacker's code runs on the developer's machine. Teams that open only repositories they trust, or that run 2.0.2 or later, can skip it. IBM lists Bob Shell only; the bulletin does not name the Bob IDE.","tier":"B","verified":{"fix":{"at":"2026-11-08T19:23:48Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7291535","run_id":2213},"products":{"at":"2026-11-08T19:23:48Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7291535","run_id":2213},"workarounds":{"at":"2026-11-08T19:23:48Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7291535","run_id":2213},"how_to_check":{"at":"2026-11-08T19:23:48Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7291535","run_id":2213},"who_affected":{"at":"2026-11-08T19:23:48Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7291535","run_id":2213}},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["bobshell","ibmbobshell"],"ptokens":["bob","ibm","shell"],"labels":["aitooling","bobshell","high","ibmbob","mcp","untrustedrepository"],"campaign_type":null,"search_a":"'-2026':16A,19A '-9764':17A,20A 'bob':2A,22A 'code':13A 'consent':12A 'cve':15A,18A 'execut':14A 'ibm':1A,21A 'mcp':5A 'repositori':10A 'run':4A 'server':6A 'shell':3A,23A 'untrust':9A 'without':11A","search_b":"'1.0.4':49B '2.0.1':51B '2.0.2':77B 'ai':25B 'ai-tool':24B 'attack':70B 'automat':53B 'block':85B 'bob':28B,32B,47B 'bob-shel':27B 'bulletin':40B 'code':71B 'configur':63B,94B 'consent':67B 'could':52B 'defin':57B,88B 'execut':72B 'explicit':65B 'featur':83B 'fix':74B 'folder':81B 'give':68B 'ibm':31B,38B,46B,73B 'ibm-bob':30B 'mcp':33B,55B,89B 'open':41B 'per':37B 'repositori':36B,44B,60B,100B 'run':54B 'server':56B,90B 'shell':29B,48B 'tool':26B 'trust':82B,98B 'untrust':35B,43B 'untrusted-repositori':34B 'user':66B,97B 'without':64B 'workspac':62B,80B,87B,93B 'workspace-defin':86B","search_c":"'1.0.4':103C '2.0.1':105C 'allow':107C 'arbitrari':113C 'attack':110C 'bob':102C 'code':114C,126C 'control':122C 'could':106C 'due':118C 'ibm':101C 'improp':121C 'inject':112C 'input':125C 'remot':109C 'system':117C 'user':124C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T19:17:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-9764","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9764","severity":null,"published_at":"2026-11-08T19:17:54+00:00","modified_at":"2026-11-08T19:17:54+00:00","first_seen_at":"2026-11-08T19:22:35+00:00","fetched_at":"2026-11-08T19:22:35+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-9764:2213","url":"https://www.ibm.com/support/pages/node/7291535","severity":null,"published_at":"2026-11-08T19:23:48+00:00","modified_at":"2026-11-08T19:23:48+00:00","first_seen_at":"2026-11-08T19:23:48+00:00","fetched_at":"2026-11-08T19:23:48+00:00","note":"Read IBM bulletin node/7291535: affected Bob Shell 1.0.4-2.0.1, fixed 2.0.2 via Workspace Folder Trust; user interaction required (open untrusted repo). No exploitation or PoC found; did not search X. IBM workarounds are weak precautions: trusted repos only.","cites":["https://www.ibm.com/support/pages/node/7291535"]}],"documents":[{"id":103194,"url":"https://www.ibm.com/support/pages/node/7291535","title":"IBM Security Bulletin: IBM Bob RCE via workspace-defined MCP server (CVE-2026-9764)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}