---
id: "CVE-2026-9764"
page: "https://infrastack.ai/live/CVE-2026-9764"
kind: "vulnerability"
aliases: ["CVE-2026-9764"]
title: "IBM Bob Shell runs MCP servers from an untrusted repository without consent (code execution)"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "IBM Bob Shell", "fixed": ["2.0.2"], "affected": ">= 1.0.4, <= 2.0.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ai-tooling", "bob-shell", "ibm-bob", "mcp", "untrusted-repository"]
not_affected_if: ["only-trusted-repos"]
published_at: "2026-11-08T19:17:54+00:00"
first_seen_at: "2026-11-08T19:22:35+00:00"
updated_at: "2026-11-08T19:23:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9764", "first_seen_at": "2026-11-08T19:22:35+00:00"}, {"source": "analyst", "url": "https://www.ibm.com/support/pages/node/7291535", "first_seen_at": "2026-11-08T19:23:48+00:00", "cites": ["https://www.ibm.com/support/pages/node/7291535"]}]
exploit_sources: []
---

# IBM Bob Shell runs MCP servers from an untrusted repository without consent (code execution)

Link for people: https://infrastack.ai/live/CVE-2026-9764 (this .md is for agents)

Per IBM's bulletin, opening an untrusted repository in IBM Bob Shell 1.0.4 to 2.0.1 could automatically run MCP servers defined in the repository's workspace configuration without explicit user consent, giving the attacker code execution. IBM fixed it in 2.0.2 with a Workspace Folder Trust feature that blocks workspace-defined MCP servers and other workspace configuration until the user trusts the repository.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:IBM Bob Shell affected >= 1.0.4, <= 2.0.1 fixed 2.0.2

## How to check

Run Bob Shell's version command (or check your installed package). Versions 1.0.4 through 2.0.1 are affected. Also check whether any repositories you opened in Bob Shell contain a .bob/mcp.json that defines MCP servers you did not write.

## Fix

Upgrade IBM Bob Shell to 2.0.2 or later (Workspace Folder Trust blocks workspace-defined MCP servers until the repo is trusted).

## Timeline

- 2026-11-08T19:22:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-9764
- 2026-11-08T19:23:48+00:00 analyst https://www.ibm.com/support/pages/node/7291535 — Read IBM bulletin node/7291535: affected Bob Shell 1.0.4-2.0.1, fixed 2.0.2 via Workspace Folder Trust; user interaction required (open untrusted repo). No exploitation or PoC found; did not search X. IBM workarounds are weak precautions: trusted repos only.

## Documents

- [advisory] IBM Security Bulletin: IBM Bob RCE via workspace-defined MCP server (CVE-2026-9764) https://www.ibm.com/support/pages/node/7291535

## From the sources

IBM Bob 1.0.4 through 2.0.1 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_