Nmap Mcp
Monthly
Vorota-ai's nmap-mcp MCP server does not enforce its own NSE script-category blocklist in the scan_vulnerabilities tool, so callers can pass categories such as exploit, dos, brute, or intrusive straight through to nmap --script. Anyone able to invoke that tool on the deployment, whether a legitimate MCP client or an agent steered by prompt injection, can therefore turn an ordinary scan into intrusive probing, brute-force attempts, or denial-of-service script runs against whatever targets the server is pointed at. The flaw is rated 4.8 (CVSS 4.0, AV:L/PR:L, with scope change and low integrity/availability impact on downstream systems), no public exploit code and no CISA KEV entry were identified at time of analysis, and the vulnerable host itself is not compromised; harm depends on the server being aimed at systems an attacker wants to disrupt.
Vorota-ai's nmap-mcp MCP server does not enforce its own NSE script-category blocklist in the scan_vulnerabilities tool, so callers can pass categories such as exploit, dos, brute, or intrusive straight through to nmap --script. Anyone able to invoke that tool on the deployment, whether a legitimate MCP client or an agent steered by prompt injection, can therefore turn an ordinary scan into intrusive probing, brute-force attempts, or denial-of-service script runs against whatever targets the server is pointed at. The flaw is rated 4.8 (CVSS 4.0, AV:L/PR:L, with scope change and low integrity/availability impact on downstream systems), no public exploit code and no CISA KEV entry were identified at time of analysis, and the vulnerable host itself is not compromised; harm depends on the server being aimed at systems an attacker wants to disrupt.