1MCP Agent EUVD-2026-96373

Exploitation requires the attacker to already hold a valid, authenticated OAuth token scoped to at least one tag (PR:L) on a 1MCP Agent instance running version 0.20.0 through 0.39.0, and the deployment must use OAuth tag-scope enforcement with the advanced tag-filter feature that supports negation ('not <tag>'). The concrete prerequisite is the ability to supply a negated advanced tag-filter expression to the tool list/invoke endpoints; the vulnerable logic sits in scopeAuthMiddleware.ts and inspectHelpers.ts. Limiting factors: this is only meaningful in multi-tenant or multi-scope gateway configurations where different clients are granted different tag scopes over multiple backend MCP servers - a single-scope or single-tenant deployment exposes nothing extra, and an attacker with no valid token cannot reach the flaw at all.

This is a medium-severity authorization flaw (CVSS 4.0 base 5.3) and the vendor vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N is internally consistent with the description: network-reachable, low attack complexity, but requiring an already-authenticated client (PR:L) holding a valid single-tag OAuth token. The real-world risk is bounded by that authentication requirement - this is a privilege/scope-escalation issue for existing legitimate clients, not an anonymous remote compromise. No EPSS score was provided in the input, no CISA KEV listing is present, and no POC flag was supplied, so by the precision rules this is 'no public exploit identified at time of analysis'; however, the referenced hackmd write-up and the two pinpointed source-code lines (scopeAuthMiddleware.ts and inspectHelpers.ts) publicly document the exact bypass technique ('not <granted-tag>'), which is trivially reproducible without tooling - note this is disclosure of the method, not a confirmed weaponized exploit, and the two signals should not be conflated. The impact is capped at low confidentiality and low integrity (VC:L/VI:L) with no availability impact, reflecting that an attacker can enumerate and invoke tools on out-of-scope backend MCP servers but within the capabilities those tools expose. Net assessment: a legitimate, patch-worthy authorization bug for anyone running 1MCP Agent as a multi-tenant/multi-scope gateway, but not an emergency-priority internet-wide threat; the low product prevalence further reduces aggregate risk.

A client is issued a narrowly-scoped OAuth token granting access to only one tag (e.g. a single backend MCP server) on a shared 1MCP Agent gateway. Instead of requesting that tag, the client submits an advanced tag-filter of the form 'not <granted-tag>', which the scope-enforcement middleware fails to evaluate correctly, returning and permitting invocation of tools on every other backend server the client was never authorized to reach. The negated-filter technique is publicly described in the referenced hackmd advisory, making reproduction straightforward for any authenticated user.