CVE-2026-117570: falha de média gravidade em Vorota-ai nmap-mcp
nmap-mcp through commit 3636afa Permissive NSE Script Allowlist in scan_vulnerabilities
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.8epss 0.2%
Vorota-ai nmap-mcp through commit 3636afa contains an improper allowlist validation vulnerability in the scan_vulnerabilities tool that lets callers run blocked NSE script categories. MCP clients or prompt-injected agents can pass categories like exploit, dos, brute, or intrusive to nmap --script, running intrusive, brute-force, exploit, or denial-of-service scripts against scan targets.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:L
Produtos afetados
Vorota-ai · nmap-mcpReferências
https://github.com/Vorota-ai/nmap-mcphttps://github.com/Vorota-ai/nmap-mcp/blob/3636afa6ad4e159c7ad07ca35ede644f37db9c5e/nmap_mcp/server.py#L440-L446https://github.com/Vorota-ai/nmap-mcp/issues/3https://www.vulncheck.com/advisories/nmap-mcp-through-commit-3636afa-permissive-nse-script-allowlist-in-scan-vulnerabilities