ssh-mcp-server CVE-2026-19039

Q: What is the CVSS score of CVE-2026-19039?

CVE-2026-19039 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.8%.

EUVD-2026-53877 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-08-06 cna@vuldb.com

GHSA-26qx-2c8w-xjfx

Command Injection

1.9

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

1.9 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Local access and low privileges required to invoke ssh_exec; no user interaction; limited and unchanged-scope impact across C/I/A.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 13:34 vuln.today

DescriptionCVE.org

A vulnerability was detected in Kino-Kafkaesque ssh-mcp-server up to 8ebbbb99b26f80ff6162fe00957c6dec73fbc5a5. Impacted is the function ssh_exec of the file src/index.ts of the component SSH Command Handler. Performing a manipulation of the argument host/username results in command injection. The attack requires a local approach. The actual existence of this vulnerability is currently in question. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project maintainer explains: "The intended threat model is that this MCP server is a local/trusted tool for an agent to execute commands over SSH, so callers already have meaningful execution capability through the exposed shell."

AnalysisAI

Command injection in Kino-Kafkaesque ssh-mcp-server's SSH Command Handler allows a local low-privilege attacker to execute arbitrary commands by manipulating the host or username arguments passed to the ssh_exec function in src/index.ts up to commit 8ebbbb99b26f80ff6162fe00957c6dec73fbc5a5. Proof-of-concept code exists (CVSS E:P), though the maintainer explicitly disputes the severity, stating the tool's intended threat model assumes fully trusted local callers who already possess meaningful shell execution capability via the MCP interface. The actual existence of this vulnerability is formally in question per the CVE description, and no CISA KEV listing is present.

Technical ContextAI

The ssh-mcp-server is a Model Context Protocol (MCP) server written in TypeScript that exposes SSH command execution to AI agents or local callers. The vulnerable function ssh_exec in src/index.ts constructs SSH command strings using unsanitized user-supplied host and username parameters, falling under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), the parent class covering injection weaknesses including command injection. The local attack vector (AV:L in both CVSS 3.x and 4.0) is architecturally consistent with the tool's design: it is intended to run on a local machine and be invoked by a trusted agent rather than exposed over a network. No CPE string was provided by the reporter; the affected codebase boundary is the GitHub commit hash 8ebbbb99b26f80ff6162fe00957c6dec73fbc5a5. The project uses a rolling release model, making version-based tracking impossible.

RemediationAI

No vendor-released patch version is identifiable due to the rolling release model; a fixed commit boundary has not been confirmed in available intelligence. Organizations deploying this tool should review the GitHub issue at https://github.com/KinoThe-Kafkaesque/ssh-mcp-server/issues/3 and compare their deployed commit against any upstream changes. As a primary compensating control, restrict MCP server access strictly to fully trusted callers and do not expose the ssh_exec interface to semi-trusted agents, scripts, or users - this aligns with the maintainer's stated threat model and eliminates the practical attack surface. As a code-level fix, replace dynamic shell-string construction with a parameterized SSH library (e.g., ssh2 for Node.js) that passes host and username as discrete typed arguments rather than interpolated strings, directly eliminating the CWE-74 root cause without side effects. Input allowlisting on host (RFC-1123 hostname or IPv4/IPv6 only) and username (alphanumeric plus limited special characters) is a lower-effort interim control but carries the trade-off of potential breakage for legitimate edge-case inputs.