# CVE-2026-96620: CVE-2026-96620: A Dash-Leading Resume ID in the Claude Agent SDK for Python Became a CLI Flag That Defined a Command-Running MCP Server (CVSS 9.2)

> CVE-2026-96620 is a critical-severity remote code execution issue (CVSS 9.2) in claude-agent-sdk, a MCP server. Affected: <0.2.121. Fixed in 0.2.121.

- **Canonical URL:** https://catalog.anomity.ai/vuln/cve-2026-96620
- **Aliases:** ti-137, GHSA-h4mw-j7qp-8mwm
- **Severity:** critical
- **CVSS:** 9.2
- **Attack type:** Remote code execution
- **Component:** claude-agent-sdk (MCP server)
- **Package:** claude-agent-sdk
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-10-16
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/cve-2026-96620

## Summary

Anthropic published GHSA-h4mw-j7qp-8mwm for the Claude Agent SDK for Python (claude-agent-sdk on PyPI) on 12 September 2026, rated critical, and NVD published it as CVE-2026-96620 on 16 October with GitHub as CNA and a CVSS 4.0 score of 9.2. Before 0.2.121 the SDK passed its resume option to the Claude Code CLI as a separate argument without validating it, so a session ID that began with a dash was read as a flag of its own. An attacker who controls that value can inject --mcp-config to define a stdio MCP server, and the CLI runs that server's command at startup, outside the SDK's permission controls. It can only be exploited where an application passes untrusted input, such as a session ID taken from a request or a URL, as the resume value. The fix is in 0.2.121 (PR 1123). No exploitation has been reported. Scanners keyed on the CVE will only have flagged it since October, about a month after the advisory.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| <0.2.121 | 0.2.121 |

## Am I affected by CVE-2026-96620?

You are affected if you run claude-agent-sdk <0.2.121. Versions 0.2.121 and later include the fix.

## How do I fix CVE-2026-96620?

Upgrade claude-agent-sdk to 0.2.121 or later (0.2.168 was current on 19 October 2026). In applications built on the SDK, never pass user-supplied values straight to resume: accept only session IDs your application issued, check them against the expected format and reject anything that starts with a dash, and look the real ID up server-side. On hosts that run SDK-based services, review for unexpected --mcp-config arguments, MCP server definitions or child processes started by the Claude CLI.

## How do I find every machine running claude-agent-sdk?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run claude-agent-sdk and which version, then enforce a policy on it.

## References

- advisory: https://github.com/anthropics/claude-agent-sdk-python/security/advisories/GHSA-h4mw-j7qp-8mwm
- cve: https://nvd.nist.gov/vuln/detail/CVE-2026-96620

## Related vulnerabilities

- [CVE-2026-114090](https://catalog.anomity.ai/vuln/cve-2026-114090) — high
- [CVE-2026-114612](https://catalog.anomity.ai/vuln/cve-2026-114612) — critical
- [CVE-2025-49596](https://catalog.anomity.ai/vuln/cve-2025-49596) — critical
- [CVE-2026-32871](https://catalog.anomity.ai/vuln/cve-2026-32871) — critical
- [CVE-2026-105740](https://catalog.anomity.ai/vuln/cve-2026-105740) — critical
- [CVE-2026-111091](https://catalog.anomity.ai/vuln/cve-2026-111091) — high

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=cve-2026-96620