CVE-2026-19263 Details
Description
A vulnerability was found in INQUIRELAB mcp-bridge-api up to b30a82aa1d1d1139e0de846c41c8aadee6e06114. The impacted element is an unknown function of the file mcp-bridge.js of the component Servers Endpoint. Performing a manipulation of the argument command/args results in command injection. It is possible to initiate the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The pull request to fix this issue awaits acceptance.
A command injection vulnerability has been identified in the INQUIRELAB MCP Bridge API, specifically in versions prior to the commit b30a82aa1d1d1139e0de846c41c8aadee6e06114. The issue arises in the 'Servers Endpoint' component, within an unknown function of the 'mcp-bridge.js' file. The vulnerability allows for arbitrary command execution on the server where the bridge is running, with the execution rights of the bridge service. This is achieved by manipulating the 'command' and 'args' parameters in a request to the 'POST /servers' endpoint, which lacks proper authentication and validation. The API then spawns a process with the specified command and arguments, enabling remote code execution.
The vulnerability has been addressed in a pull request that implements authentication and authorization for the 'POST /servers' endpoint, removing the ability to execute arbitrary processes from untrusted API input. Users are advised to update to the latest version of the INQUIRELAB MCP Bridge API.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 8, 2026CISA-ADP
Assessed Aug 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/INQUIRELAB/mcp-bridge-api/issues/1 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/INQUIRELAB/mcp-bridge-api/ | [email protected] | Source CodeVendor |
| https://github.com/INQUIRELAB/mcp-bridge-api/issues/1 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/INQUIRELAB/mcp-bridge-api/issues/1#issuecomment-4320749148 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-19263 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/865220 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/387010 | [email protected] | BundlePermission Required |
| https://vuldb.com/vuln/387010/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| INQUIRELAB mcp-bridge-api | <= b30a82aa1d1d1139e0de846c41c8aadee6e06114 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 11, 2026 | CVE Modified | CISA-ADP |
| Aug 8, 2026 | New CVE Received | [email protected] |