nmap-mcp EUVD-2026-110848

The attacker must be able to invoke the scan_vulnerabilities tool on the nmap-mcp server - either as an MCP client or via an agent that has been prompt-injected - and supply the NSE script category argument; the flaw is that the allowlist validation in scan_vulnerabilities does not reject the blocked categories exploit, dos, brute, and intrusive, so those are passed through to nmap --script. Limiting factors: exploitation is local to the MCP deployment (AV:L) and requires the privilege of calling the tool (PR:L), not remote unauthenticated access; the vulnerable host itself is not compromised, and the integrity/availability impact falls on whatever scan targets the server is pointed at, so realistic harm depends on the server being used to scan systems the attacker wants to disrupt or brute-force.

This is a medium-severity guardrail-bypass issue, and the signals are consistent in pointing to limited real-world urgency rather than a high-priority emergency. The supplied CVSS 4.0 base score is 4.8 (medium) with AV:L/AC:L/AT:N/PR:L/UI:N, meaning exploitation is local, low-complexity, and requires some privilege (the ability to invoke the MCP tool); there is no impact on the vulnerable host itself (VC:N/VI:N/VA:N) and only low integrity/availability impact on subsequent systems (SI:L/SA:L), i.e. the scan targets. The vuln.today decision label is 'this_month' - not act_now or emergency - which aligns with the modest technical impact. There is no CISA KEV listing (so no confirmed active exploitation) and no EPSS score was provided in the input, so exploitation probability cannot be quantified from available data. No confirmed working exploit code is present; the references are a VulnCheck advisory, the project repository, a GitHub issue, and the exact vulnerable code lines, which document the flaw but are not verified exploit code. The realistic concern is that this tool is explicitly designed to be driven by LLM agents, so a prompt-injected agent could flip the tool into running intrusive/DoS/brute-force/exploit NSE scripts; however, the harm lands on scan targets rather than the MCP host, and the attacker already needs the ability to call the tool. Net: a legitimate but non-urgent correctness/safety defect, not a high-CVSS-but-overrated issue nor a drop-everything priority. Missing EPSS data is the main gap.

An MCP client or a prompt-injected agent connected to nmap-mcp calls the scan_vulnerabilities tool and supplies an NSE script category such as 'exploit', 'dos', 'brute', or 'intrusive', which the permissive allowlist fails to reject. nmap is then invoked with --script for those categories, running intrusive, brute-force, exploit, or denial-of-service scripts against the scan target. No public exploit identified at time of analysis, though the VulnCheck advisory and GitHub issue pinpoint the vulnerable validation logic.