EUVD-2026-25911Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable MCP server, no authentication required per CVSS 4.0 PR:N, partial confidentiality, integrity, and availability impact consistent with limited path traversal scope.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability has been found in dexhunter kaggle-mcp up to 406127ffcb2b91b8c10e20e6c2ca787fbc1dc92d. This vulnerability affects the function prepare_kaggle_dataset of the file src/kaggle_mcp/server.py. The manipulation of the argument competition_id leads to path traversal. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Path traversal in kaggle-mcp's prepare_kaggle_dataset function exposes the host filesystem to remote unauthenticated attackers via unsanitized competition_id input. Any deployment of this Model Context Protocol server at commit 406127ff or earlier is affected across all platforms. A publicly disclosed exploit exists and SSVC confirms the attack is automatable, meaning attackers can read, write, or partially disrupt arbitrary server files without credentials or user interaction; the maintainer has not responded to the coordinated disclosure issue filed on GitHub.
Technical ContextAI
kaggle-mcp is a Model Context Protocol (MCP) server written in Python that exposes Kaggle dataset operations as tool calls to AI agents. The vulnerable file src/kaggle_mcp/server.py contains the function prepare_kaggle_dataset, which constructs a filesystem path using the caller-supplied competition_id argument without sanitizing directory-traversal sequences such as '../'. CWE-22 (Path Traversal) describes this root cause: user-controlled input reaches a file-system operation before being neutralized. Because MCP servers accept structured tool invocations over a network transport, no web browser or HTTP stack is required - any MCP client can send the malicious argument directly. The affected CPE corresponds to the rolling-release commit 406127ffcb2b91b8c10e20e6c2ca787fbc1dc92d; no fixed version tag exists.
RemediationAI
No vendor-released patch has been identified at time of analysis; the maintainer has not responded to the GitHub issue (https://github.com/dexhunter/kaggle-mcp/issues/1) filed during responsible disclosure. Users who have deployed this MCP server should immediately restrict network access to the server to trusted internal clients only, preventing unauthenticated remote exploitation. Additionally, the MCP server process should be run under a dedicated low-privilege OS account with filesystem access restricted via chroot or container namespace isolation, so that a successful path traversal yields access only to an isolated directory tree rather than the host filesystem - this trades operational convenience for a hard containment boundary. Operators should monitor the upstream repository at https://github.com/dexhunter/kaggle-mcp/ for a responsive commit that sanitizes competition_id (e.g., via os.path.basename or explicit allowlist validation) and upgrade immediately upon availability. Until a fix lands, consider forking and applying a one-line sanitization patch locally as a stopgap.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today