Summary
Zuke's MCP registry mode can execute a command-form registry descriptor without applying the authorization checks used for remote module descriptors. If a run-capable caller uses a registry that another party can modify, that party may select the program and arguments executed with the caller's environment and workspace access.
Zuke's MCP registry mode can execute a command-form registry descriptor without applying the authorization checks used for remote module descriptors. If a run-capable caller uses a registry that another party can modify, that party may select the program and arguments executed with the caller's environment and workspace access.
Affected context
The issue occurs in Zuke's MCP registry mode when command-form descriptors are read from a registry writable by an untrusted or insufficiently trusted party. It requires the caller to use the run-enabled workflow and does not generally affect the local default registry populated only through the module-form descriptors written by zuke register. Authorization controls intended for remote module descriptors are not consistently applied to command descriptors.
The issue occurs in Zuke's MCP registry mode when command-form descriptors are read from a registry writable by an untrusted or insufficiently trusted party. It requires the caller to use the run-enabled workflow and does not generally affect the local default registry populated only through the module-form descriptors written by zuke register. Authorization controls intended for remote module descriptors are not consistently applied to command descriptors.
Exploit preconditions
- Attack surface: Zuke MCP registry processing and tool execution
- Required access: Ability to modify or supply a registry consumed by the operator
- Trigger point: A run-capable caller invokes an affected tool through
zuke mcp --registry --allow-run - Required condition: The registry contains a command-form descriptor that is accepted for execution
- Why exploitation is possible: Authorization is not enforced consistently for this descriptor type, while execution policy names and confirmation text can be influenced by the registry writer
- Attack surface: Zuke MCP registry processing and tool execution
- Required access: Ability to modify or supply a registry consumed by the operator
- Trigger point: A run-capable caller invokes an affected tool through
zuke mcp --registry --allow-run - Required condition: The registry contains a command-form descriptor that is accepted for execution
- Why exploitation is possible: Authorization is not enforced consistently for this descriptor type, while execution policy names and confirmation text can be influenced by the registry writer
Why this happens
The underlying defect is an authorization gap in registry descriptor handling. Zuke applies the ZUKE_REGISTRY_LAUNCH_HOSTS authorization policy to remote module descriptors but permits command-form descriptors to proceed without the equivalent check. This behavior maps to CWE-862, Missing Authorization, because an operation capable of launching a program is reachable without consistently verifying that the descriptor and its execution target are authorized.
The underlying defect is an authorization gap in registry descriptor handling. Zuke applies the ZUKE_REGISTRY_LAUNCH_HOSTS authorization policy to remote module descriptors but permits command-form descriptors to proceed without the equivalent check. This behavior maps to CWE-862, Missing Authorization, because an operation capable of launching a program is reachable without consistently verifying that the descriptor and its execution target are authorized.
Potential impact
- An attacker may cause arbitrary programs to run with the operator's available permissions.
- Sensitive environment variables, workspace files, or credentials could be exposed.
- Source code or build artifacts could be modified or destroyed.
- Build integrity, release artifacts, or downstream systems could be compromised.
- A compromised workspace may enable further lateral movement depending on granted access.
- An attacker may cause arbitrary programs to run with the operator's available permissions.
- Sensitive environment variables, workspace files, or credentials could be exposed.
- Source code or build artifacts could be modified or destroyed.
- Build integrity, release artifacts, or downstream systems could be compromised.
- A compromised workspace may enable further lateral movement depending on granted access.
General mitigation guidance
Mitigation generally centers on enforcing authorization uniformly across every
registry descriptor type before any command resolution or execution occurs.
Common defensive patterns include:
- Applying host, source, and command authorization checks to command-form and module-form descriptors alike.
- Treating registries as untrusted by default unless their integrity and ownership are established.
- Separating display metadata from executable policy decisions and avoiding confirmations based solely on attacker-controlled descriptions.
- Requiring explicit, independently configured approval for executable tools rather than trusting descriptor-supplied names or arguments.
- Restricting registry write access and protecting registry contents with appropriate integrity controls.
- Running build and MCP operations with least privilege, isolated workspaces, minimal environment exposure, and narrowly scoped filesystem access.
- Using non-executing or read-only modes by default where command execution is not required.
Mitigation generally centers on enforcing authorization uniformly across every
registry descriptor type before any command resolution or execution occurs.
Common defensive patterns include:
- Applying host, source, and command authorization checks to command-form and module-form descriptors alike.
- Treating registries as untrusted by default unless their integrity and ownership are established.
- Separating display metadata from executable policy decisions and avoiding confirmations based solely on attacker-controlled descriptions.
- Requiring explicit, independently configured approval for executable tools rather than trusting descriptor-supplied names or arguments.
- Restricting registry write access and protecting registry contents with appropriate integrity controls.
- Running build and MCP operations with least privilege, isolated workspaces, minimal environment exposure, and narrowly scoped filesystem access.
- Using non-executing or read-only modes by default where command execution is not required.
How teams detect issues like this
Detection can focus on both authorization consistency and registry integrity:
- Use static analysis and code review to identify execution paths that accept command descriptors without a shared authorization gate.
- Look for policy checks applied to one descriptor format but omitted from equivalent formats.
- Review whether allowlists, protection globs, and confirmation prompts derive their decisions from attacker-controlled descriptor fields.
- Monitor registry write events, descriptor changes, and unexpected executable tool registrations.
- Enforce repository and deployment policies requiring trusted ownership, integrity verification, and review for executable registry content.
- Use automated security review tools to flag command execution reached through untrusted configuration or registry inputs.
Detection can focus on both authorization consistency and registry integrity:
- Use static analysis and code review to identify execution paths that accept command descriptors without a shared authorization gate.
- Look for policy checks applied to one descriptor format but omitted from equivalent formats.
- Review whether allowlists, protection globs, and confirmation prompts derive their decisions from attacker-controlled descriptor fields.
- Monitor registry write events, descriptor changes, and unexpected executable tool registrations.
- Enforce repository and deployment policies requiring trusted ownership, integrity verification, and review for executable registry content.
- Use automated security review tools to flag command execution reached through untrusted configuration or registry inputs.
