Skip to content
Critical RCE Flaw in Opencode via MCP OAuth Discovered

Critical RCE Flaw in Opencode via MCP OAuth Discovered

First seen 20 Oct 2026, 05:49 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 20, 2026 at 07:19 UTC
  • •Critical RCE vulnerability in opencode affects versions 1.0.137 to 1.18.32.
  • •Attackers can exploit the flaw via a compromised MCP server during OAuth authentication.
  • •A patch was released on September 28, 2026, but no CVE has been published.

Pillar Security identified a critical remote code execution (RCE) vulnerability in opencode, affecting versions 1.0.137 to 1.18.32 on Windows and Windows Subsystem for Linux (WSL). The flaw allows an attacker-controlled remote Model Context Protocol (MCP) server to execute arbitrary code during the OAuth authentication process without user consent. This vulnerability is significant as it exposes developer machines to remote code execution without requiring malicious software installation or prompt injection. The issue arises from a server-controlled OAuth field that improperly passes an untrusted URL into PowerShell. A patch (version 1.18.33) was released on September 28, 2026, addressing the flaw. Pillar proposed a CVSS score of 9.8, indicating critical severity, but no public CVE has been published. The research highlights that traditional protections, like URL scheme validation, are insufficient against this attack vector.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-09-28
Patch released for opencode
Version 1.18.33 was released to fix the critical RCE vulnerability affecting earlier versions.
Codesprintconsulting
2026-10-19
Vulnerability disclosed by Pillar Security
Pillar Security published research detailing the critical RCE flaw in opencode, affecting Windows and WSL.
Pillar Security

More articles in this cluster (3)

Extracted Entities (7)

1 / 4

Common questions

Which versions of opencode are affected?
Versions 1.0.137 through 1.18.32 are affected by the vulnerability.
Is there a patch available?
Yes, version 1.18.33 was released on September 28, 2026, to address the vulnerability.
What should developers do to protect themselves?
Developers should update to opencode version 1.18.33 to mitigate the risk of exploitation.