CVE-2026-7038

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

A weakness has been identified in tufantunc ssh-mcp up to 1.5.0. Impacted is an unknown function of the file src/index.ts of the component Command Line Handler. This manipulation causes insufficiently protected credentials. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-522

Affected software

No affected versions have been published.

Timeline

Published: Apr 26, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-703838.4Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Estonian Information System Authority (RIA) CVE-2026-703868.5Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlu CVE-2026-703878.4Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes CVE-2026-70397.8A security vulnerability has been detected in tufantunc ssh-mcp up to 1.5.0. The affected element is the function shell.write of the file sr CVE-2026-703952.1Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash allows an attacker to forge a relationship CVE-2026-703965.4Gitea's organization repository-creation API requires write:organization but omits the write:repository token scope enforced by other reposi CVE-2026-703989.6A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows an authen CVE-2026-703998.7Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to ca CVE-2026-70407.5Text::Minify::XS versions from 0.3.0 before 0.7.8 for Perl have a heap overflow when processing some malformed UTF-8 characters. The minify CVE-2026-704005.4Gitea's repository migration API accepts a public-only token when the request specifies creation of a private repository. A delegated token CVE-2026-704025.8Gitea creates server-side Git hook directories and scripts with mode 0777 and relies on the process umask to restrict access. With a permiss CVE-2026-704039.3XING CPTrans-ME-X contains a Use of Hard-coded Password (CWE-259). Anyone with the knowledge of the credential may log in to the affected de