CVE-2026-7038

LowCVSS 3.3/10Last modified Oct 26, 2026

Description

A weakness has been identified in tufantunc ssh-mcp up to 1.5.0. Impacted is an unknown function of the file src/index.ts of the component Command Line Handler. This manipulation causes insufficiently protected credentials. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-522

Affected software

Vendor	Product	Versions
tufantunc	ssh-mcp	1.0; 1.1; 1.2; 1.3; 1.4; 1.5.0

References

Timeline

Published: Apr 26, 2026
Last modified: Oct 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-703805.3A denial-of-service vulnerability has been identified in the Miracast over Infrastructure Connection Establishment (MICE) service. An unauth CVE-2026-703815.3An access-control vulnerability has been identified in the web server configuration. Some resources intended for on-device use only could be CVE-2026-703824.1Some externally supplied values stored by the device may be rendered in the web interface without sufficient output encoding. An attacker wh CVE-2026-703838.4Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Estonian Information System Authority (RIA) CVE-2026-703868.5Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlu CVE-2026-703878.4Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes CVE-2026-703888.3SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device on the network can send specially crafted messages that cau CVE-2026-70397.8A security vulnerability has been detected in tufantunc ssh-mcp up to 1.5.0. The affected element is the function shell.write of the file sr CVE-2026-703952.1Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash allows an attacker to forge a relationship CVE-2026-703965.4Gitea's organization repository-creation API requires write:organization but omits the write:repository token scope enforced by other reposi CVE-2026-703989.6A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows an authen CVE-2026-703998.7Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to ca