CVE-2026-30618
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
A remote code execution vulnerability was found in xszyou Fay 4.3.1 in its MCP STDIO server management and command execution handling. A remote attacker can access the publicly exposed MCP management interface and configure an MCP STDIO server with attacker-controlled commands and parameters, resulting in arbitrary command execution on the server.
Risk Assessment
Successful exploitation allows arbitrary command execution within the context of the Fay service, which could lead to server compromise, data theft, or further attacks on the infrastructure.
Recommendation
Immediately update xszyou Fay to the latest version, or if not possible, restrict access to the MCP management interface to trusted networks or disable it.
Original NVD description (English source)
xszyou Fay 4.3.1 contains a remote code execution vulnerability in its MCP STDIO server management and command execution handling. A remote attacker can access the publicly exposed MCP management interface and configure an MCP STDIO server with attacker-controlled commands and parameters, resulting in execution of arbitrary commands on the server. Successful exploitation allows arbitrary command execution within the context of the Fay service.