Is there a public PoC exploit available for CVE-2026-19268?

Yes, a public proof-of-concept exploit is available for CVE-2026-19268. Prioritise patching immediately. EPSS: 1.1%.

Mcpgateway CVE-2026-19268

Q: What is the CVSS score of CVE-2026-19268?

CVE-2026-19268 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.1%.

EUVD-2026-54768 LOW

Command Injection (CWE-77)

2026-08-08 VulDB

GHSA-8cv7-xjpc-f5hw

Command Injection Mcpgateway

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Aug 08, 2026 - 08:22 NVD

MEDIUM LOW

CVSS changed

Aug 08, 2026 - 08:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Aug 08, 2026 - 08:15 vuln.today

CVE Published

Aug 08, 2026 - 07:30 cve.org

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was identified in abdullah1854 MCPGateway up to 549f494a9e363f40530149de324b8097de424230. This impacts the function getUsageByDateRange of the file src/services/claude-usage.ts of the component Claude Usage Range Endpoint. The manipulation of the argument since leads to command injection. The attack can be initiated remotely. The exploit is publicly available and might be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Command injection in MCPGateway's Claude Usage Range Endpoint allows authenticated remote attackers to execute arbitrary OS commands by manipulating the since date argument passed to getUsageByDateRange in src/services/claude-usage.ts. All versions up to commit 549f494a9e363f40530149de324b8097de424230 are affected, with a proof-of-concept exploit publicly available via the project's GitHub issue tracker. No patch has been released; the maintainer has not responded to the coordinated disclosure despite early notification, leaving deployments with no vendor-supported remediation path.