{"id":"CVE-2026-117570","kind":"vulnerability","aliases":["CVE-2026-117570"],"related":[],"title":"nmap-mcp: allowlist bypass lets MCP callers run intrusive Nmap scripts","description":"Vorota-ai nmap-mcp through commit 3636afa contains an improper allowlist validation vulnerability in the scan_vulnerabilities tool that lets callers run blocked NSE script categories. MCP clients or prompt-injected agents can pass categories like exploit, dos, brute, or intrusive to nmap --script, running intrusive, brute-force, exploit, or denial-of-service scripts against scan targets.","summary":"The nmap-mcp server's scan_vulnerabilities tool fails to enforce its allowlist, so callers can pass blocked NSE script categories such as exploit, dos, brute, or intrusive to nmap. A caller, or an agent steered by prompt injection, can therefore launch exploit, brute-force, or denial-of-service scripts against scan targets.","severity":"medium","cvss":5.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","ai-tooling","mcp","nmap","self-hosted"],"not_affected_if":["server-not-deployed","tool-not-exposed"],"how_to_check":"- Check whether the deployed nmap-mcp code includes commit `3636afa` or earlier, for example with `git log --oneline | grep 3636afa` in the nmap-mcp checkout\n- Confirm which MCP clients can reach the scan_vulnerabilities tool","fix":"- unknown: the sources do not name a fixed commit or release; check the Vorota-ai nmap-mcp repository for a newer version and remove the tool from agents until a patched build is in place","status":"open","published_at":"2026-10-27T14:16:39+00:00","first_seen_at":"2026-10-27T14:32:19+00:00","triaged_at":"2026-10-27T14:33:14+00:00","updated_at":"2026-10-27T14:33:14+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-27T14:33:14Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources do not name a fixed commit or release; check the Vorota-ai nmap-mcp repository for a newer version and remove the tool from agents until a patched build is in place","reach":"unknown","title":"nmap-mcp: allowlist bypass lets MCP callers run intrusive Nmap scripts","impact":"medium","summary":"The nmap-mcp server's scan_vulnerabilities tool fails to enforce its allowlist, so callers can pass blocked NSE script categories such as exploit, dos, brute, or intrusive to nmap. A caller, or an agent steered by prompt injection, can therefore launch exploit, brute-force, or denial-of-service scripts against scan targets.","category":"ai-tooling","nicknames":[],"who_cares":["mcp","nmap","self-hosted","ai-agents"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Intrusive, exploit, or DoS scripts run against scan targets from the server","analyst_note":"Check the Vorota-ai nmap-mcp repository for a fixed commit or release and confirm whether the tool is reachable without authentication.","how_to_check":"- Check whether the deployed nmap-mcp code includes commit `3636afa` or earlier, for example with `git log --oneline | grep 3636afa` in the nmap-mcp checkout\n- Confirm which MCP clients can reach the scan_vulnerabilities tool","needs_analyst":true,"not_affected_if":["server-not-deployed","tool-not-exposed"],"who_is_affected":"Teams that run the Vorota-ai nmap-mcp server and expose its scan_vulnerabilities tool to MCP clients or agents that process untrusted input. Exposure depends on whether those callers can reach the server and whether it can scan hosts you do not own. Teams that do not run this server can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000676,"input_tokens":3362,"output_tokens":680,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-117570':15A,18A '-2026':14A,17A '3636afa':94C 'agent':21B,65B,120C 'ai':20B,23B,88C 'ai-ag':19B 'ai-tool':22B 'allowlist':4A,43B,98C 'block':48B,110C 'brute':56B,75B,127C,136C 'brute-forc':74B,135C 'bypass':5A 'caller':8A,45B,62B,108C 'categori':51B,113C,123C 'client':115C 'commit':93C 'contain':95C 'cve':13A,16A 'denial':79B,141C 'denial-of-servic':78B,140C 'dos':55B,126C 'enforc':41B 'exploit':54B,73B,125C,138C 'fail':39B 'forc':76B,137C 'host':29B 'improp':97C 'inject':69B,119C 'intrus':10A,58B,129C,134C 'launch':72B 'let':6A,107C 'like':124C 'mcp':3A,7A,25B,33B,91C,114C 'nmap':2A,11A,26B,32B,60B,90C,131C 'nmap-mcp':1A,31B,89C 'nse':49B,111C 'pass':47B,122C 'prompt':68B,118C 'prompt-inject':117C 'run':9A,109C,133C 'scan':36B,84B,103C,146C 'script':12A,50B,82B,112C,132C,144C 'self':28B 'self-host':27B 'server':34B 'servic':81B,143C 'steer':66B 'target':85B,147C 'therefor':71B 'tool':24B,38B,105C 'valid':99C 'vorota':87C 'vorota-ai':86C 'vulner':37B,100C,104C","nicknames":[],"mitigations":[],"who_affected":"Teams that run the Vorota-ai nmap-mcp server and expose its scan_vulnerabilities tool to MCP clients or agents that process untrusted input. Exposure depends on whether those callers can reach the server and whether it can scan hosts you do not own. Teams that do not run this server can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:39+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117570","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117570","severity":null,"published_at":"2026-10-27T14:16:39+00:00","modified_at":"2026-10-27T14:16:39+00:00","first_seen_at":"2026-10-27T14:32:19+00:00","fetched_at":"2026-10-27T14:32:19+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}