k6 MCP Server CVE-2026-89039

Exploitation requires the ability to invoke the convert_playwright_script prompt on the k6 MCP server and supplying the playwright_script argument as a bare path (not the documented '@'-prefixed form) or a '~'-prefixed path, which reaches an undocumented code path that performs no working-directory restriction; the '~' form is expanded to the home directory, making files like SSH private keys directly addressable. The working-directory restriction on the '@' form is also bypassable by placing a symbolic link inside the working directory that points outside it, because the path is not canonicalized before the check. Limiting factors: the attacker must already be able to invoke prompts on the server (PR:L - not anonymous), disclosure is bounded to files readable by the OS user running the server, and installations on v0.3.0/v0.4.0 have no restriction at all while later affected versions are exploitable only via the bare/'~'/symlink bypass.

This is a moderate-severity information-disclosure flaw whose signals are internally consistent but point to limited mass-exploitation risk. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) indicates a low-privilege actor who can invoke the MCP prompt can reliably read any file the server user can read, with high confidentiality impact and no integrity or availability impact - matching the CWE-22 path-traversal description. No EPSS score, CISA KEV listing, POC, or SSVC decision data was supplied, so there is no evidence of active exploitation or weaponization; status is best characterized as no public exploit identified at time of analysis. One nuance worth verifying: the CVSS marks AV:N, but MCP servers are frequently invoked over local/stdio transports, so real-world attack surface depends heavily on whether the server is exposed beyond localhost - verify the deployment transport with the operator. The PR:L is appropriate because exploitation requires the ability to invoke the prompt (i.e., a client already connected/authorized to the MCP server), which meaningfully narrows the realistic attacker population to those who already have some access to the host or MCP session. Net: a real but not urgent priority - high impact on secrets (SSH keys, credentials) if reachable, offset by the prerequisite of MCP access and the absence of any exploitation telemetry.

A user or tool with access to the k6 MCP server session invokes the convert_playwright_script prompt supplying a bare (non-'@') path such as ~/.ssh/id_rsa or an absolute path outside the working directory; the undocumented resolution path applies no directory restriction and returns the file contents in the prompt response. Alternatively, the attacker plants or abuses a symlink inside the working directory pointing to a sensitive file, since the path is not canonicalized before the restriction check. No public exploit code is identified, but the technique is trivial and requires no special tooling.