5.2
MediumCVSS 3.1 · from VulnCheck
CVE-2026-117570
nmap-mcp through commit 3636afa Permissive NSE Script Allowlist in scan_vulnerabilities
nmap-mcp · CWE-183 · CWE-183Affectednmap-mcp
FixNo fix listed yet.
PublishedOct 27, 13:08 · VulnCheck
ScoredOct 27 · 5.2 · VulnCheck
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:11 UTC
What we know
No known exploitation. CISA KEV, checked 22:11 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs local access to the machine. CVSS: local.
Description
Vorota-ai nmap-mcp through commit 3636afa contains an improper allowlist validation vulnerability in the scan_vulnerabilities tool that lets callers run blocked NSE script categories. MCP clients or prompt-injected agents can pass categories like exploit, dos, brute, or intrusive to nmap --script, running intrusive, brute-force, exploit, or denial-of-service scripts against scan targets.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed innmap-mcpup to 3636afa6ad4e159c7ad07ca35ede644f37db9c5e–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known