Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A vulnerability has been found in dexhunter kaggle-mcp up to 406127ffcb2b91b8c10e20e6c2ca787fbc1dc92d. This vulnerability affects the function prepare_kaggle_dataset of the file src/kaggle_mcp/server.py. The manipulation of the argument competition_id leads to path traversal. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
CVE-2026-7149 Path Traversal in dexhunter kaggle-mcp via Competition ID Manipulation https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-7149
Post summary
This post announces a path‑traversal flaw in dexhunter's kaggle‑mcp component that can be triggered via manipulated competition IDs, without providing PoC, exploit details, or patch information.
CVE-2026-7149 A vulnerability has been found in dexhunter kaggle-mcp up to 406127ffcb2b91b8c10e20e6c2ca787fbc1dc92d. This vulnerability affects the function prepare_kaggle_dataset of… https://www.cve.org/CVERecord?id=CVE-2026-7149
Post summary
This post announces the discovery of CVE-2026-7149 in the dexhunter kaggle-mcp project, specifying the affected function but providing no further technical or mitigation details.