# CVE-2026-111091: CVE-2026-111091 and CVE-2026-88755: JetBrains Junie CLI and Z.ai ZCode Started the MCP Servers a Cloned Repository Declared (CVSS 7.8)

> CVE-2026-111091 is a high-severity remote code execution issue (CVSS 7.8) in JetBrains Junie CLI, a MCP server. Affected: JetBrains Junie CLI before 26.8.3; Z.ai ZCode 3.11.2.6792 (Windows desktop client), no fixed version known.. Fixed in 26.8.3.

- **Canonical URL:** https://catalog.anomity.ai/vuln/cve-2026-111091
- **Aliases:** ti-141
- **Severity:** high
- **CVSS:** 7.8
- **Attack type:** Remote code execution
- **Component:** JetBrains Junie CLI (MCP server)
- **Catalog entry:** https://catalog.anomity.ai/agent/junie-cli
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-10-15
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/cve-2026-111091

## Summary

Two coding agents received CVEs a day apart for starting MCP servers declared inside an untrusted project. JetBrains, acting as its own CNA, published CVE-2026-111091 on 15 October 2026: in Junie CLI before 26.8.3, code execution was possible through an untrusted project's MCP server configuration (CVSS 3.1 7.8). The record gives no further detail, and its only reference is JetBrains' fixed-issues page. MITRE published CVE-2026-88755 on 16 October for Z.ai ZCode 3.11.2.6792 (CVSS 3.1 7.8, NVD status Deferred). According to the reporter, lkloliver, the Windows desktop client merges a repository's .zcode/config.json into its MCP server table and connects to every declared server when the workspace opens, without asking, so a stdio entry is a command that runs as soon as the repository is opened. ZCode applies a trust state machine to workspace hooks but not to MCP servers. The reporter also showed a poisoned tool description from the auto-connected server getting the agent to send ~/.zcode/v2/credentials.json, which holds API keys, a JWT and SSH workspace passwords, as a tool argument. A proof of concept is public, and no ZCode fix or vendor statement has been found.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| JetBrains Junie CLI before 26.8.3; Z.ai ZCode 3.11.2.6792 (Windows desktop client), no fixed version known. | 26.8.3 |

## Am I affected by CVE-2026-111091?

You are affected if you run JetBrains Junie CLI before 26.8.3; Z.ai ZCode 3.11.2.6792 (Windows desktop client), no fixed version known.. Versions 26.8.3 and later include the fix.

## How do I fix CVE-2026-111091?

Upgrade Junie CLI to 26.8.3 or later. ZCode has no fix: do not open untrusted repositories in it, check cloned repositories for a .zcode/config.json before opening them, remove repository-level MCP server entries you did not add, and rotate the credentials in ~/.zcode/v2/credentials.json on machines that opened untrusted projects. For every agent, treat project-level MCP configuration (.mcp.json, .zcode/, .cursor/, .vscode/ and similar) as executable code: review it in pull requests, and prefer agents that ask for explicit approval before starting a server a project declares.

## How do I find every machine running JetBrains Junie CLI?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run JetBrains Junie CLI and which version, then enforce a policy on it.

## References

- cve: https://nvd.nist.gov/vuln/detail/CVE-2026-111091

## Related vulnerabilities

- [CVE-2026-114090](https://catalog.anomity.ai/vuln/cve-2026-114090) — high
- [CVE-2026-114612](https://catalog.anomity.ai/vuln/cve-2026-114612) — critical
- [CVE-2025-49596](https://catalog.anomity.ai/vuln/cve-2025-49596) — critical
- [CVE-2026-32871](https://catalog.anomity.ai/vuln/cve-2026-32871) — critical
- [CVE-2026-96620](https://catalog.anomity.ai/vuln/cve-2026-96620) — critical
- [CVE-2026-105740](https://catalog.anomity.ai/vuln/cve-2026-105740) — critical

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=cve-2026-111091