Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A security flaw has been discovered in TimBroddin astro-mcp-server up to 1.1.1. The impacted element is an unknown function of the file src/index.ts of the component MCP Tool Query Construction. Performing a manipulation of the argument request.params.arguments results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-05-01 | 2 | Disclosure1General1 |
| 2026-05-02 | 1 | Disclosure1 |
CVE-2026-7591 A security flaw has been discovered in TimBroddin astro-mcp-server up to 1.1.1. The impacted element is an unknown function of the file src/index.ts of the component MC… https://www.cve.org/CVERecord?id=CVE-2026-7591
Post summary
A security flaw in TimBroddin astro-mcp-server up to 1.1.1 has been revealed, affecting an unspecified function in src/index.ts, but no PoC, exploit or patch details are provided.
⚠️ New MCP Vulnerability: CVE-2026-7591 (astro-mcp-server < 1.1.2). Another case where implicit trust in server-side logic can lead to flaws. As the MCP ecosystem grows, 'install and pray' isn't a strategy. Continuous scanning is vital. 🛡️ #MCPSecurity #MCP
Post summary
The post announces CVE‑2026‑7591 affecting astro‑mcp‑server versions below 1.1.2, warns about implicit server‑side trust, and urges continuous scanning.
🚨*CVE* CVE-2026-7591 A security flaw has been discovered in TimBroddin astro-mcp-server up to 1.1.1. The impacted element is an unknown function of the file src/index.ts of the component MC… https://www.cve.org/CVERecord?id=CVE-2026-7591 ----- Traducción: CVE-2026-7591 Se … http://infoflow.cloud`
Post summary
The tweet simply announces the existence of CVE-2026-7591 with a brief description and links to the CVE record, but provides no further technical, exploit, or mitigation details.