beam_mcp CVE-2026-88257

Exploitation requires an authorized MCP client connection (PR:L) to a beam_mcp server in the 0.1.0-0.10.0 range, AND tools (or prompts) whose advertised JSON schema declares constraints the pre-fix validator never enforced: anything inside nested objects or array items - items, minItems/maxItems, minLength/maxLength, pattern, nested required, nested enum, nested additionalProperties:false - or any use of oneOf/anyOf/$ref. The decisive condition is a HOST whose dispatch code trusts the declared schema and acts on those nested/array fields without re-validating; if the host independently re-checks its inputs, the schema bypass is inert. Limiting factors: the attacker must be a connected/authorized MCP client (not anonymous), no user interaction is involved, and per the CVSS vector impact is limited to integrity (VI:L) with no confidentiality or availability effect - the realistic blast radius is bounded by whatever a given host does with the forbidden value.

This is a medium-severity, low-priority issue despite being network-reachable. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 5.3 driven almost entirely by VI:L - a limited integrity effect on the vulnerable system, with VC:N (no confidentiality) and VA:N (no availability) and no subsequent-system impact. PR:L confirms the attacker must already be an authorized MCP client, not an anonymous internet attacker. The signals are mutually consistent and all point low: CISA's SSVC framework rates Exploitation 'none', Automatable 'no', and Technical Impact 'partial', which maps to a 'Track' (not 'Act') decision. No CISA KEV listing and no public exploit were provided, so exploitation is neither confirmed nor demonstrated. No EPSS probability was supplied in the input, so quantitative exploitation likelihood cannot be stated - this is a genuine data gap rather than a low score. The most important caveat is that the actual impact is indeterminate by design: the advisory explicitly says 'what the host does with such a value decides the impact,' so the VI:L rating is a conservative floor, and a specific host that feeds unvalidated nested/array arguments into a sensitive sink (file paths, DB queries, numeric limits) could experience worse-than-rated consequences. Risk should therefore be assessed per-deployment against how each host's dispatch code trusts the advertised schema.

An authorized MCP client connects to a beam_mcp server and issues a tools/call (or prompts/get) request whose arguments satisfy the top-level object schema but violate constraints declared only inside nested objects or array items - for example an out-of-range number, a string failing a 'pattern', or an undeclared key where additionalProperties:false was advertised. Because BeamMCP.Schema.validate/2 only enforced the top-level object, these forbidden values pass validation and reach the tool's dispatch function, which the host wrote assuming the declared schema was enforced. No public exploit code was identified at time of analysis, and exploitation requires client-level access plus a host that trusts the nested schema.