Security1 hOctober 2, 2026, 22:20

MCPVault path filters bypassed: CVE-2026-57441 and CVE-2026-57442

Two advisories in MCPVault, which restricts which directories a language model can read, describe path-filter bypasses: CVE-2026-57441 (CVSS 8.4) and CVE-2026-57442 (CVSS 6.9). Both stem from comparing a path as a string instead of the filesystem-resolved path.

DEV Community

Open source

CVE-2026-57441: on case-insensitive filesystems a case variant of .git or node_modules passes the string check
CVE-2026-57442: the deny list is anchored at the root and misses nested .git and .obsidian directories
Fix: resolve paths to canonical form and check at the point of use
Operators should run the server as a user limited to required directories

#MCPVault

CVE-2026-48710 (BadHost): malformed Host header bypasses Starlette path authorization

Security

Exploit details for Citrix NetScaler CVE-2026-88772 reveal pre-auth shellcode path

Security

Two RouterOS Bugs, One Escalation Path: What CVE-2026-67277 and CVE-2026-86060 Mean for Edge Routers

Security

MCPVault path filters bypassed: CVE-2026-57441 and CVE-2026-57442

CVE-2026-48710 (BadHost): malformed Host header bypasses Starlette path authorization

Exploit details for Citrix NetScaler CVE-2026-88772 reveal pre-auth shellcode path

Two RouterOS Bugs, One Escalation Path: What CVE-2026-67277 and CVE-2026-86060 Mean for Edge Routers

CVE-2026-92957: vm2 sandbox escape via node: prefix bypass