CVE-2026-117570
Medium · 5.2CVSS
5.2
EPSS
0.2%
Published
Oct 27, 2026
CISA due date
—
The record
Vorota-ai nmap-mcp through commit 3636afa contains an improper allowlist validation vulnerability in the scan_vulnerabilities tool that lets callers run blocked NSE script categories. MCP clients or prompt-injected agents can pass categories like exploit, dos, brute, or intrusive to nmap --script, running intrusive, brute-force, exploit, or denial-of-service scripts against scan targets.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-115915 vLLM is an inference and serving engine for large language models. CWE-183
- CVE-2026-113786 pypdf is a free and open-source pure-python PDF library. CWE-183
- CVE-2026-54694 SkillTree is a micro-learning gamification platform. CWE-183
- CVE-2026-55581 mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. CWE-183
- CVE-2026-63649 The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7_alpha1 through… CWE-183
- CVE-2026-67315 axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as… CWE-183
- CVE-2026-67345 MaxKey through 4.1.12, fixed in commit ddbb72f, contains an insufficient redirect URI… CWE-183
- CVE-2026-66005 Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration… CWE-183