CVE-2026-7038

The record

A weakness has been identified in tufantunc ssh-mcp up to 1.5.0. Impacted is an unknown function of the file src/index.ts of the component Command Line Handler. This manipulation causes insufficiently protected credentials. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Affected packages

Related vulnerabilities

• CVE-2026-104850 MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and… CWE-522
• CVE-2026-91766 When the http:// stream wrapper follows a redirect it forwards the user-supplied… CWE-522
• CVE-2026-64918 Insufficiently protected credentials in Microsoft Office allows an unauthorized attacker… CWE-522
• CVE-2026-86600 In affected Snowflake drivers, WORKLOAD_IDENTITY authentication requests a cloud… CWE-522
• CVE-2026-76969 @sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality… CWE-522
• CVE-2026-86175 NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST… CWE-522
• CVE-2026-53603 nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. CWE-522
• CVE-2026-8862 IBM Netezza Software 11.3.0.3 through Interim Fix 002 has credentials that are hardcoded… CWE-522