ssh-mcp discloses a critical bypass of the gate that enforces its read-only mode, and groups it with four earlier ones as the same defect

The maintainer of ssh-mcp published GHSA-qvx5-rxrj-9vfh on 2026-09-02 and rated it critical, CVSS 9.9. The server exists to give agents SSH access under policy: commands are classified as safe, destructive or privileged, roles are bound to environment tiers, and destructive or privileged commands raise an approval prompt through MCP elicitation. The advisory concerns the function all of that rests on. As it puts it, classifyCommand() "is the single authority deciding whether a command may run and whether the human approval gate fires," and "four independent ways exist to make it read a different command than the remote shell executes. All four are reachable from a default configuration."

The mechanism in the most severe case is shell quoting. A POSIX shell strips quotes before resolving a command name, so a privileged command written with quotation marks inside it runs as the privileged command while the classifier, which never performs that step, reads it as something benign. The advisory documents profiles with readOnly = true allowing commands that reach sudo, and operator profiles running them with no prompt at all. Every classification in it was produced against the shipped 2.5.1 build.

What makes this more than a single bug is how the advisory frames it. It names four earlier advisories, all high severity and all published in the preceding three weeks, and states that this is "the same underlying defect," which each of them addressed by teaching the classifier about one more carrier. Its stated reason for grouping them: "fixing carriers individually is what produced this history." Six advisories in total now sit against the project, from 2026-08-09 to 2026-09-02, and only the first carries a CVE identifier.

The fix shipped in 2.6.0 on the day of disclosure, with 2.7.0 following the same day; the project's own changelog for 2.7.0 records that some classifier-evasion spellings remain unaddressed by design, on the reasoning that classifying harder cannot reach them. The server is cataloged and ranked 38th in the MCP 500, and its documentation is candid that its controls "narrow the blast radius" without removing the risk.