knowns CVE-2026-86544

Exploitation requires a valid knowns session credential with at minimum read-restricted access (CVSS PR:L confirmed). The attacker must reach the MCP server over the network (CVSS AV:N). The vulnerable code path activates when any of the code mutation handlers (code.replace, code.rename, code.insert, code.delete) receive a target path that resolves into the .knowns/ permission configuration directory - no special server configuration is needed, as the flaw exists in the default authorization logic applied to all sessions. Exploitation is limited by the requirement for any valid session token; fully unauthenticated network access is insufficient. Symlink-based path traversal to the .knowns/ directory is also a viable attack vector, as the pre-patch code did not resolve symlinks before applying path checks.

The CVSS 4.0 score of 7.2 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H) accurately reflects the core risk: network-exploitable, no special conditions, requiring only a low-privilege session, with high integrity and availability impact. The PR:L constraint limits exposure to users who already hold at least a read-only session token, meaning unauthenticated internet-facing exploitation is not possible. No public exploit code has been identified and the vulnerability does not appear in CISA KEV, though the publicly available commit diff provides sufficient technical detail for a motivated researcher to reconstruct the attack path quickly. The integrity impact is well-founded - overwriting the .knowns/ permission registry directly leads to privilege escalation - and the availability rating is plausible since misconfigured permissions can lock out legitimate administrators. EPSS data was not provided in the input and cannot be assessed. Overall, this is a real and actionable risk for any deployment where untrusted users hold read-restricted knowns sessions, but is not a mass-exploitation candidate given the required authentication prerequisite.

An attacker with a read-restricted knowns session crafts a code.replace request targeting .knowns/config.json or another permission registry file, supplying a payload that overwrites role definitions or grants administrative permissions to their session identity. Because the code mutation handler misclassifies the operation as read-only, the permission guard permits the write. On the next API call, the attacker's session resolves with full administrative privileges, enabling unrestricted code mutation and configuration control. The publicly available commit diff provides sufficient implementation detail for an experienced researcher to reconstruct this exploit path without additional reverse engineering.