CVE-2026-54140 in OpenHuman
Summary
by MITRE • 11/05/2026
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.57.13, OpenHuman places names, descriptions, titles, and parameter definitions returned by configured external MCP servers into the agent model context without neutralizing instructions or bounding the descriptive fields. The McpRemoteTool records produced by list_tools preserve this remote content, while tool filtering considers the tool name and the prompt-injection detector screens user messages rather than MCP definitions. A malicious or compromised MCP server can therefore return a poisoned description that is evaluated on every agent turn and may direct the model to invoke other available tools, disclose accessible data, or perform unauthorized actions without a separate malicious user message. The issue affects users who configure an attacker-controlled or compromised MCP server. This issue is fixed in version 0.57.13.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified in OpenHuman prior to version 0.57.13 represents a critical failure in input validation and context sanitization within the agent harness architecture, specifically concerning how external Model Context Protocol servers are integrated into the system's operational flow. As an open-source agent harness available as both a desktop application and a Rust library, OpenHuman relies on MCP servers to provide tools and capabilities that extend its functionality. The core technical flaw lies in the mechanism by which metadata from these configured external MCP servers—including names, descriptions, titles, and parameter definitions—is ingested directly into the agent model context without any neutralization of potential instruction sequences or bounding of descriptive fields. This design choice assumes that content provided by remote tools is inherently trustworthy, a assumption that fails when dealing with untrusted or compromised third-party services.
From a technical perspective, the vulnerability manifests because the McpRemoteTool records generated during the list_tools operation preserve all raw remote content verbatim. When these records are passed to the large language model for context, they become part of the prompt instructions evaluated on every agent turn. Crucially, while OpenHuman employs a prompt-injection detector, this security control is misaligned with the threat vector; it screens only user messages rather than the MCP definitions themselves. Consequently, an attacker controlling or compromising an MCP server can inject malicious payloads disguised as tool descriptions or parameter metadata. These poisoned descriptions are not filtered out and remain active within the context window, allowing them to influence the model's decision-making process directly without requiring any separate malicious input from a human user.
The operational impact of this vulnerability is severe, enabling what is effectively an automated prompt injection attack that bypasses standard user-input defenses. A compromised MCP server can return descriptions designed to manipulate the agent into invoking other available tools, disclosing sensitive accessible data, or performing unauthorized actions within its environment. Because the malicious content is embedded in the tool definitions themselves, it persists across multiple turns and interactions, potentially leading to persistent compromise of the agent's behavior. This affects all users who configure an attacker-controlled or compromised MCP server, as the trust boundary between local configuration and remote execution is effectively breached through this indirect injection channel.
In terms of industry standards classification, this vulnerability aligns with CWE-79, which covers Improper Neutralization of Input During Web Page Generation known commonly as Cross-site Scripting, but in this context it applies to prompt injection within AI systems rather than web pages. It also maps closely to CWE-1321 where untrusted data is used in a security-critical decision without proper validation or sanitization. Furthermore, the attack vector corresponds to MITRE ATT&CK technique T1608, specifically leveraging Supply Chain Compromise to inject malicious instructions into an AI agent's context through trusted-looking but compromised external services. The lack of filtering on tool definitions rather than just user input creates a blind spot that attackers can exploit to hijack autonomous agents.
To mitigate this risk, users must upgrade immediately to version 0.57.13 or later where the issue has been resolved by implementing proper sanitization and neutralization of content from external MCP servers before it enters the model context. Security best practices for systems utilizing similar architectures include validating all inputs from untrusted sources against a strict allowlist, employing robust prompt-injection detection that covers not only user messages but also system-generated metadata such as tool definitions, and isolating execution environments to limit the blast radius of any successful injection attempt. Organizations should audit their MCP server configurations regularly to ensure they are sourced from trusted providers and consider implementing additional layers of defense such as output filtering and behavioral monitoring to detect anomalous agent actions that may indicate a compromise.