Beam Mcp
Monthly
Incorrect type conversion in the BeamMCP (beam_mcp) Elixir library from 0.1.0 before 0.10.1 causes an authenticated MCP client's JSON boolean and null tool arguments to arrive at the host's dispatch function as the Elixir strings "true", "false" and "nil"; because a string is truthy in Elixir, a host that branches on truthiness - for example `if args.dry_run` or a `confirm: false` guard - evaluates a client-supplied false as though it were set. The same normalization applies to prompts/get arguments on versions 0.5.0 and later, while the practical impact is bounded: the client could have sent true directly, so only hosts or policy layers whose false branch diverges from their true branch are meaningfully affected, and an attacker must already be an authorized MCP client (CVSS 4.0 base 2.3; assessed CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N). No public exploit has been identified at time of analysis and CISA SSVC records no exploitation; a vendor-released patch (0.10.1) is available.
Authenticated MCP clients connected to a beam_mcp server in the 0.1.0 through 0.10.0 range can call tools (and prompts) with arguments that violate the JSON Schema the server itself advertised, because BeamMCP.Schema.validate/2 only enforced constraints on the top-level arguments object. The practical impact is limited to integrity (CVSS 3.1 base vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 5.3): a host whose dispatch code trusts the declared schema may act on out-of-range numbers, undeclared nested keys, or other forbidden values, and whatever that host does with the value determines the real blast radius. Exploitation requires an authorized MCP client connection (PR:L) plus a host that does not independently re-validate - no public exploit identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no, and no KEV listing exists. The issue is rated medium severity and low priority despite being network-reachable.
Incorrect type conversion in the BeamMCP (beam_mcp) Elixir library from 0.1.0 before 0.10.1 causes an authenticated MCP client's JSON boolean and null tool arguments to arrive at the host's dispatch function as the Elixir strings "true", "false" and "nil"; because a string is truthy in Elixir, a host that branches on truthiness - for example `if args.dry_run` or a `confirm: false` guard - evaluates a client-supplied false as though it were set. The same normalization applies to prompts/get arguments on versions 0.5.0 and later, while the practical impact is bounded: the client could have sent true directly, so only hosts or policy layers whose false branch diverges from their true branch are meaningfully affected, and an attacker must already be an authorized MCP client (CVSS 4.0 base 2.3; assessed CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N). No public exploit has been identified at time of analysis and CISA SSVC records no exploitation; a vendor-released patch (0.10.1) is available.
Authenticated MCP clients connected to a beam_mcp server in the 0.1.0 through 0.10.0 range can call tools (and prompts) with arguments that violate the JSON Schema the server itself advertised, because BeamMCP.Schema.validate/2 only enforced constraints on the top-level arguments object. The practical impact is limited to integrity (CVSS 3.1 base vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 5.3): a host whose dispatch code trusts the declared schema may act on out-of-range numbers, undeclared nested keys, or other forbidden values, and whatever that host does with the value determines the real blast radius. Exploitation requires an authorized MCP client connection (PR:L) plus a host that does not independently re-validate - no public exploit identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no, and no KEV listing exists. The issue is rated medium severity and low priority despite being network-reachable.