CVE-2026-19366 in LudusMCP
Summary
by MITRE • 08/09/2026
A flaw has been found in NocteDefensor LudusMCP up to 1.0.24. Affected is an unknown function of the file src/tools/insertCredsRangeConfig.ts of the component insert_creds_range_config. Executing a manipulation of the argument configPath/outputPath can lead to path traversal. The attack is restricted to local execution. The project was informed of the problem early through an issue report but has not responded yet.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/16/2026
The vulnerability identified in NocteDefensor LudusMCP version 1.0.24 represents a critical path traversal flaw within the insert_creds_range_config component. This security weakness exists in the src/tools/insertCredsRangeConfig.ts file where an unvalidated input parameter allows malicious manipulation of the configPath/outputPath arguments. The flaw stems from insufficient validation of user-supplied paths during credential configuration processing, creating an opportunity for attackers to navigate outside intended directories and potentially access unauthorized system resources.
This vulnerability operates under CWE-23 Path Traversal or CWE-77 Command Injection patterns where improper input sanitization enables attackers to manipulate file system operations through crafted path sequences. The attack vector requires local execution privileges since the flaw is confined to local system manipulation rather than remote exploitation capabilities. The security implications extend beyond simple directory traversal as this could potentially allow unauthorized access to sensitive configuration files, credential storage locations, or other system resources that might be accessible through the application's file handling mechanisms.
The operational impact of this vulnerability is significant for any organization relying on this toolchain for credential management and configuration deployment. Local attackers with access to the system can exploit this weakness to read arbitrary files from the filesystem, potentially exposing sensitive data stored in configuration directories or other locations that the application might have access to. The lack of response from the project maintainers following early issue reporting creates a concerning gap in vulnerability remediation, leaving systems exposed to potential exploitation.
Mitigation strategies should focus on immediate input validation and sanitization of all path parameters within the affected component. Implementing strict path validation routines that reject any input containing directory traversal sequences such as ../ or ..\ is essential. Additionally, applying principle of least privilege access controls to the application's file system operations can limit the damage potential even if exploitation occurs. The project should implement comprehensive testing procedures including static code analysis and dynamic security testing to identify similar vulnerabilities in other components. Organizations should also consider implementing runtime monitoring solutions that can detect suspicious file access patterns indicative of path traversal attempts, aligning with ATT&CK technique T1059 Command and Scripting Interpreter and T1566 Phishing techniques that might be used to deliver malicious inputs.