🤖🔐 NEW LINKEDIN ADS MCP FLAW CAN EXPOSE FILES FROM THE HOST SYSTEM CVE-2026-81485 affects linkedin-ads-mcp 1.0.0 and allows a remote attacker to manipulate the Media Upload file path and read files outside its intended directory. CyberSignal Priority: 🟡 MEDIUM 📅 August 27, 2026 🆔 CVE-2026-81485 🏷️ MCP · Path Traversal · Data Exposure The problem exists in: campaign-management.ts inside the Media Upload functionality. The vulnerable operation eventually reaches: fs.readFileSync(filePath) without sufficiently restricting where filePath can point. Attack chain: remote-controlled path ↓ path traversal ↓ filesystem escape ↓ unauthorized file read The vulnerability requires: NO authentication and: NO user interaction. CVSS 3.1: 5.3 — MEDIUM The rating is moderate because the documented direct impact is primarily confidentiality rather than full host compromise. But filesystem reads become much more interesting when an MCP process can access: .env files API keys configuration files tokens application secrets cloud credentials. Public exploit information is already available. The CVE record also says the project was notified but had not responded at publication time. 🛡️ Defender lesson Do not let MCP servers inherit unrestricted access to the host filesystem. Use: • dedicated service accounts • container isolation • explicit directory allowlists • read-only mounts where possible • secret separation MCP connects AI to tools. That makes every tool permission part of the AI security boundary. THE MODEL MAY ONLY ASK FOR A FILE. THE MCP SERVER DECIDES WHICH FILES IT CAN ACTUALLY TOUCH. Sources: CVE · NVD · VulDB
Post summary
A new CVE-2026-81485, a path traversal flaw in LinkedIn Ads MCP, enables file reads without authentication. Public PoC exists and mitigations such as isolation and read‑only mounts are recommended.
