Is there a public PoC exploit available for CVE-2026-7061?

Yes, a public proof-of-concept exploit is available for CVE-2026-7061. Prioritise patching immediately. EPSS: 0.8%.

chatgpt-mcp-server CVE-2026-7061

Q: What is the CVSS score of CVE-2026-7061?

CVE-2026-7061 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.8%.

MEDIUM

OS Command Injection (CWE-78)

2026-04-26 VulDB

Docker Command Injection

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:12 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Analysis Generated

Apr 26, 2026 - 22:30 vuln.today

Severity Changed

Apr 26, 2026 - 22:22 NVD

HIGH MEDIUM

CVSS changed

Apr 26, 2026 - 22:22 NVD

7.3 (HIGH) 6.9 (MEDIUM)

Analysis Generated

Apr 26, 2026 - 22:15 vuln.today

CVE Published

Apr 26, 2026 - 22:00 nvd

MEDIUM 5.5

DescriptionCVE.org

A weakness has been identified in Toowiredd chatgpt-mcp-server up to 0.1.0. Affected by this issue is some unknown functionality of the file src/services/docker.service.ts of the component MCP/HTTP. This manipulation causes os command injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

OS command injection in Toowiredd chatgpt-mcp-server up to version 0.1.0 allows remote unauthenticated attackers to execute arbitrary system commands through the Docker service component. The vulnerability exists in src/services/docker.service.ts within the MCP/HTTP interface and has publicly available exploit code. The vendor has been notified but has not yet released a patch.

Technical ContextAI

The vulnerability resides in the Docker service component (docker.service.ts) of the Model Context Protocol (MCP) server implementation. MCP is a protocol that enables communication between clients and language model servers. The underlying issue is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), indicating that user-supplied input is passed unsanitized to OS command execution functions without proper escaping or validation. The Docker service likely constructs shell commands dynamically based on HTTP parameters or request body data, allowing attackers to inject arbitrary shell metacharacters and commands. Docker command injection through an HTTP interface exposes the entire host system to compromise if the MCP server process has elevated privileges or broad filesystem access.

RemediationAI

Upgrade to a patched version released by the Toowiredd project; however, no patched release is currently available as of the vendor notification date-monitor GitHub repository (https://github.com/Toowiredd/chatgpt-mcp-server/) for security updates. As an immediate compensating control, restrict network access to the MCP/HTTP interface using a firewall or reverse proxy to only trusted internal clients; do not expose the service directly to the internet. Disable the Docker service component if it is not actively required for your use case, or run the application in a sandboxed environment (container with minimal privileges, restricted filesystem mounts) to limit command execution scope. Review Docker service code in src/services/docker.service.ts for all user input handling and ensure all shell commands use parameterized APIs (e.g., execFile with argument array) rather than shell string interpolation. Until a patch is available, disable MCP server functionality in production environments or use network segmentation to restrict access to trusted endpoints only.