CVE-2026-37751: Critical Command Injection in AI Maestro

Overview

A critical OS command injection vulnerability has been disclosed in AI Maestro, an open-source AI agent orchestration platform published by 23blocks-OS that lets teams manage and coordinate multiple terminal-based AI agents (Claude Code, Codex, Aider, Cursor, and others) from a single dashboard across local machines, Docker, and AWS deployments. Tracked as CVE-2026-37751 and rated CVSS 9.8 (Critical), the flaw sits in the killSessionSync function inside lib/agent-runtime.ts and allows an attacker to execute arbitrary operating system commands by supplying crafted input to that code path.

AI Maestro is self-hosted software — there is no vendor-run SaaS version — and it is designed to run with broad reach across a user's environment: killing and spawning agent sessions, moving agents between machines over its peer-to-peer Agent Messaging Protocol (AMP), and bridging out to Slack, Discord, email, and WhatsApp gateways. A command-injection bug in the session-management layer of a tool built specifically to control processes on a host is a high-value target, since the orchestrator process itself typically already has the privileges needed to spawn and terminate arbitrary local processes.

The CVSS 9.8 score — one of the highest possible ratings — reflects a vulnerability class (unauthenticated or low-friction, network-reachable, full-impact remote code execution) that removes most of the barriers an attacker would otherwise need to clear.

Technical Details

How It Works

The published description credits the flaw to the killSessionSync function, which is responsible for terminating an active AI agent session. Session-kill routines in orchestration tools like this typically need to identify a specific process to stop — usually by session ID, process ID, or agent name — and translate that identifier into a system-level call to end the process. If that identifier is passed into a shell command or child_process call without proper sanitization or without using a parameterized (non-shell) execution API, an attacker who can influence the value passed to killSessionSync can append shell metacharacters (;, &&, |, `, $()) to smuggle in additional, attacker-chosen commands.

Because AI Maestro exposes its dashboard and Agent Messaging Protocol as network-facing interfaces (the dashboard listens on localhost:23000 by default, with gateway integrations extending reach further), the exact exploitability depends on how a given deployment exposes those interfaces — a default localhost-only binding is far less exposed than a Docker/EC2/ECS deployment where the dashboard or AMP port has been made reachable across a network. The NVD entry does not publish a full CVSS vector string or a proof-of-concept, so the precise authentication and network-reachability requirements for exploitation should be confirmed against the vendor's own advisory before drawing firm conclusions about internet-facing risk.

As of publication, no public exploit code or evidence of in-the-wild exploitation has been identified.

Impact Assessment

Recommendations

For AI Maestro Operators

• Upgrade past v0.24.17 as soon as a patched release is available from 23blocks-OS; check the project's GitHub repository and release notes directly, since this advisory does not yet list a fixed version.
• Restrict network exposure of the dashboard (:23000) and Agent Messaging Protocol to trusted hosts only — do not expose either directly to the internet.
• Audit session-kill and process-management code paths if you run a fork or have modified lib/agent-runtime.ts, and apply input validation/allowlisting on any identifier that reaches a shell invocation.
• Rotate credentials stored on or accessible from the orchestrator host (agent API keys, gateway tokens) if there is any indication the host was exposed to untrusted input before patching.

For Security Teams

• Treat any self-hosted AI agent orchestration tooling as high-value infrastructure — these platforms are increasingly designed to hold broad process-management and credential-bridging privileges by nature of what they orchestrate.
• Monitor orchestrator hosts for unexpected child processes, shell invocations, or outbound connections that don't match normal agent lifecycle activity.
• Track this CVE for an updated advisory with a full CVSS vector and fixed-version number, since the current NVD record is thin on remediation detail.

Key Takeaways

1. CVE-2026-37751 is a CVSS 9.8 critical OS command injection in AI Maestro's killSessionSync function, located in lib/agent-runtime.ts.
2. The bug lets an attacker who can reach the vulnerable code path execute arbitrary commands on the host running the orchestrator.
3. AI Maestro is self-hosted software used to manage and coordinate multiple AI coding agents (Claude Code, Codex, Aider, Cursor) across machines — a compromise here can cascade into every agent and credential it manages.
4. Exposure depends heavily on deployment mode — local tmux setups carry lower network risk than Docker/AWS deployments with the dashboard or AMP port exposed.
5. No fixed version or public PoC has been published yet; operators should watch the 23blocks-OS repository directly and restrict network access to the dashboard in the meantime.
6. No evidence of active exploitation has been reported as of publication.

References

• NVD — CVE-2026-37751
• GitHub — 23blocks-OS/ai-maestro