VulnSocial

CVE-2026-108586

LOWCVSS 5.3 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

1MCP Agent (@1mcp/agent) 0.20.0 through 0.39.0 contains an incorrect authorization vulnerability that allows authenticated clients to bypass OAuth tag-scope enforcement using negated advanced tag-filter expressions. Attackers holding a single-tag token can send a filter like not <granted-tag> to list and invoke tools on backend MCP servers outside their granted scopes.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-863

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-10-12: 210-12
Referenced assets1 URL
By indicator
Full discourse2 posts
  • Ayyaz@ayyazdev

    If you gate MCP tools by tags, read CVE-2026-108586 (1MCP Agent, published Oct 10, CVSS 5.3). 1MCP puts many backend MCP servers behind one HTTP API and tags each one. An OAuth token gets tags, say tag:internal. The API also accepts boolean tag-filter expressions. The scope check pulls out the tag names an expression mentions and confirms each one is granted. It never checks what the expression selects. So a token scoped to internal sends tag-filter=not internal, passes, and gets every backend it was never granted, with tools listed and callable. Affected: @1mcp/agent 0.20.0 through 0.39.0. The latest GitHub release is still 0.39.0, so there's no fixed version yet. If you build authz on top of a filter language, check the set the query returns against the grant. https://www.cve.org/CVERecord?id=CVE-2026-108586

    0011047
    85 followersView on X
  • Hazem Omier@hazemomier

    CVE-2026-108586 on 1MCP: token tagged internal + tag-filter=not internal passes the scope check and reaches every backend it was never granted. The check confirms tag names in the expression — not what it selects. Do you assert the returned set against the grant before tools run?

    0000016
    475 followersView on X

Explore more

Back to dashboard