CVE-2026-9680

Full vulnerability record from the local CVENow database.

Description

Improper exposure of the MCP server in alibabacloud-rds-openapi-mcp-server allows remote attackers to invoke exposed MCP tools via network access to an MCP endpoint listening on all network interfaces by default.

Severity

MEDIUM

CVSS score

5.8 (v3.1)

Vulnerability status

Deferred

Source identifier

[email protected]

Published

2026-07-28 09:16:42.830000

Last modified

2026-10-24 13:10:00.147000

View original CVE JSON

{
  "id": "CVE-2026-9680",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-28T09:16:42.830",
  "lastModified": "2026-10-24T13:10:00.147",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper exposure of the MCP server in alibabacloud-rds-openapi-mcp-server allows remote attackers to invoke exposed MCP tools via network access to an MCP endpoint listening on all network interfaces by default."
    },
    {
      "lang": "es",
      "value": "Exposición indebida del servidor MCP en alibabacloud-rds-openapi-mcp-server permite a atacantes remotos invocar herramientas MCP expuestas a través de acceso de red a un endpoint MCP escuchando en todas las interfaces de red por defecto."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Alibaba",
          "product": "Alibaba Cloud RDS OpenAPI MCP Server",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "1.8.0",
              "lessThanOrEqual": "3.1.2",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
          "baseScore": 5.8,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-28T16:07:57.564922Z",
          "id": "CVE-2026-9680",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1188"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/aliyun/alibabacloud-rds-openapi-mcp-server",
      "source": "[email protected]"
    }
  ]
}