CVE-2026-19039

{
  "id": "CVE-2026-19039",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-06T13:17:27.980",
  "lastModified": "2026-10-23T21:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [
    {
      "sourceIdentifier": "[email protected]",
      "tags": [
        "disputed"
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability was detected in Kino-Kafkaesque ssh-mcp-server up to 8ebbbb99b26f80ff6162fe00957c6dec73fbc5a5. Impacted is the function ssh_exec of the file src/index.ts of the component SSH Command Handler. Performing a manipulation of the argument host/username results in command injection. The attack requires a local approach. The actual existence of this vulnerability is currently in question. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project maintainer explains: \"The intended threat model is that this MCP server is a local/trusted tool for an agent to execute commands over SSH, so callers already have meaningful execution capability through the exposed shell.\""
    },
    {
      "lang": "es",
      "value": "Se detectó una vulnerabilidad en el servidor ssh-mcp de Kino-Kafkaesque hasta 8ebbbb99b26f80ff6162fe00957c6dec73fbc5a5. La función ssh_exec del archivo src/index.ts del componente Gestor de Comandos SSH se ve afectada. Realizar una manipulación del argumento host/username resulta en inyección de comandos. El ataque requiere un enfoque local. La existencia real de esta vulnerabilidad está actualmente en cuestión. Este producto adopta una estrategia de lanzamiento continuo para mantener la entrega continua. Por lo tanto, los detalles de la versión para las versiones afectadas o actualizadas no pueden especificarse. El mantenedor del proyecto explica: ’El modelo de amenaza previsto es que este servidor MCP es una herramienta local/de confianza para que un agente ejecute comandos a través de SSH, por lo que los llamadores ya tienen una capacidad de ejecución significativa a través del shell expuesto.’"
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Kino-Kafkaesque",
          "product": "ssh-mcp-server",
          "cpes": [
            "cpe:2.3:a:kino-kafkaesque:ssh-mcp-server:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "SSH Command Handler"
          ],
          "versions": [
            {
              "version": "8ebbbb99b26f80ff6162fe00957c6dec73fbc5a5",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 1.9,
          "baseSeverity": "LOW",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "vulnAvailabilityImpact": "LOW",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "PROOF_OF_CONCEPT",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.4
      }
    ],
    "cvssMetricV2": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P",
          "baseScore": 4.3,
          "accessVector": "LOCAL",
          "accessComplexity": "LOW",
          "authentication": "SINGLE",
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "availabilityImpact": "PARTIAL"
        },
        "baseSeverity": "MEDIUM",
        "exploitabilityScore": 3.1,
        "impactScore": 6.4,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-06T13:57:17.874979Z",
          "id": "CVE-2026-19039",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-74"
        },
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/KinoThe-Kafkaesque/ssh-mcp-server/issues/3",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/KinoThe-Kafkaesque/ssh-mcp-server/issues/3#issuecomment-4319612623",
      "source": "[email protected]"
    },
    {
      "url": "https://vuldb.com/cve/CVE-2026-19039",
      "source": "[email protected]"
    },
    {
      "url": "https://vuldb.com/submit/863828",
      "source": "[email protected]"
    },
    {
      "url": "https://vuldb.com/vuln/386458",
      "source": "[email protected]"
    },
    {
      "url": "https://vuldb.com/vuln/386458/cti",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/KinoThe-Kafkaesque/ssh-mcp-server/issues/3#issuecomment-4319612623",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}