An unauthenticated OS command injection vulnerability in simple-openstack-mcp allows remote attackers to execute arbitrary code on the underlying host, posing a critical security risk.

The application fails to properly sanitize input in the exec_openstack function, which only verifies that the command starts with the string "openstack" before passing it to a shell environment. This allows an unauthenticated attacker to inject shell metacharacters, such as semicolons, to execute arbitrary OS commands with the privileges of the service account.

Successful exploitation of this vulnerability grants an attacker full control over the host system, leading to potential data exfiltration, unauthorized modification of system files, and complete service disruption. While the provided CVSS score is 7.3, the ability for an unauthenticated remote attacker to achieve command injection typically results in a higher actual impact, including the compromise of sensitive credentials and internal infrastructure access.

Immediate Action: As no official patch is currently available, administrators should immediately restrict network access to the affected interface using firewalls or network access control lists to prevent external reachability.

Proactive Monitoring: Review server and application logs for anomalous command execution patterns or unauthorized shell activity originating from the MCP tool interface.

Compensating Controls: Implement strict mTLS or authentication layers in front of the MCP tool to ensure only trusted users can interact with the vulnerable endpoint.

Public Exploit Available: Yes, a proof-of-concept is documented in the researcher's GitHub issue report.

Given the ease of exploitation and the lack of an available vendor patch, immediate defensive action is required. Organizations using simple-openstack-mcp must isolate the service from untrusted networks and implement rigorous access controls until the vendor releases a version that replaces shell-based execution with safe, parameterized command APIs.