Which versions of DeepTutor are affected by CVE-2026-58168?

HKUDS DeepTutor before version 1.4.10 allows authenticated users to invoke Model Context Protocol tools-including filesystem, shell, and browser operations-that they were not explicitly authorized to…. A patch is available.

How to fix or mitigate CVE-2026-58168?

Within 24 hours: Audit all HKUDS DeepTutor instances for version status and identify multi-user deployments. Within 7 days: Upgrade all instances before v1.4.10 to v1.4.10 or later. Within 30 days: Confirm upgrade completion across all systems and review access logs for suspicious MCP tool invocations (shell, filesystem, browser operations) originating from non-admin user sessions during the exposure period.

DeepTutor CVE-2026-58168

Q: What is the CVSS score of CVE-2026-58168?

CVE-2026-58168 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-40375 HIGH

Missing Authorization (CWE-862)

2026-06-30 VulnCheck

GHSA-jg88-rvpc-qvxj

Authentication Bypass Deeptutor Hkuds

7.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable and low-complexity but requires an authenticated low-privilege session (PR:L); abusing shell/filesystem MCP servers yields full host C/I/A impact within the same authorization scope (S:U).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 30, 2026 - 17:40 vuln.today

Analysis Updated

Jun 30, 2026 - 17:40 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 17:39 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 30, 2026 - 17:22 vuln.today

cvss_changed

CVSS changed

Jun 30, 2026 - 17:22 NVD

8.8 (HIGH) 7.7 (HIGH)

Analysis Generated

Jun 30, 2026 - 17:16 vuln.today

DescriptionCVE.org

DeepTutor before version 1.4.10 contains an authorization bypass vulnerability that allows low-privilege users to invoke unrestricted MCP tools due to the allowed_mcp_tools function returning None instead of a denied result when mcp_tools is omitted from a user's grant in deeptutor/multi_user/tool_access.py. Attackers or prompt-injected content acting within a user session can enumerate and invoke any configured MCP tool, including filesystem, shell, and browser servers, gaining unauthorized access to sensitive deployment resources.

AnalysisAI

Privilege escalation via missing authorization in HKUDS DeepTutor before 1.4.10 lets any authenticated low-privilege user invoke deployment-wide MCP (Model Context Protocol) tools they were never granted. The root cause is the allowed_mcp_tools function in deeptutor/multi_user/tool_access.py returning None (interpreted as 'allow all') instead of a denied result when the mcp_tools key is omitted from a user's grant, so a regular user - or prompt-injected content running inside their session - can enumerate and call filesystem, shell, and browser MCP servers. No public exploit is identified at the time of analysis and it is not in CISA KEV, but a vendor patch (v1.4.10) is available and the issue was reported by VulnCheck.

Technical ContextAI

DeepTutor is an open-source AI tutoring application (vendor HKUDS, CPE cpe:2.3:a:hkuds:deeptutor) that integrates Model Context Protocol (MCP) tool servers - including filesystem, shell, and browser back-ends - and gates access in multi-user deployments through a per-user grant system. The flaw is classic CWE-862 (Missing Authorization): the access-control predicate allowed_mcp_tools was written to fail open. When a user's grant simply lacks the mcp_tools field, the function returns None rather than an explicit deny, and downstream code treats that null as an unrestricted allow. This is an insecure-default / fail-open design bug rather than a memory-safety or injection flaw; the v1.4.10 fix changes MCP tools to deny-by-default for non-admin users so the absence of an explicit grant now means no access.

RemediationAI

Vendor-released patch: upgrade to DeepTutor v1.4.10 or later (release: https://github.com/HKUDS/DeepTutor/releases/tag/v1.4.10; fix commit 90046374b3dcd4f8a866d2d64a64440bc08eb2ef via PR https://github.com/HKUDS/DeepTutor/pull/579), which makes MCP tools deny-by-default for non-admin users; the upgrade is described as drop-in with no migration required. If you cannot upgrade immediately, reduce exposure by removing or disabling high-impact MCP servers (filesystem, shell, browser) from the deployment so that even a fail-open grant exposes nothing dangerous - at the cost of losing those tool capabilities for everyone; alternatively, restrict the deployment to trusted/admin users only or run in single-user mode, accepting reduced multi-tenant functionality. Review existing non-admin user grants and explicitly populate the mcp_tools field so the bypass path is not silently triggered, and consult the VulnCheck advisory for details.