CVE-2026-55156 in token-optimizer-mcp
Summary
by MITRE • 09/28/2026
Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, the dashboard HTTP server in token-optimizer-mcp exposes /api/session-summary and /api/session-events with no authentication middleware — any network-accessible client can reach them without credentials. Both handlers concatenate the caller-supplied sessionId query parameter directly into a filesystem path via path.join, and Node.js normalizes .. segments at resolution time, allowing an unauthenticated attacker to read any .jsonl file reachable from the server's filesystem. This issue has been patched in version 5.1.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/28/2026
The vulnerability identified in Token Optimizer MCP prior to version 5.1.0 represents a critical combination of authentication bypass and path traversal flaws within its dashboard HTTP server component. The service exposes two primary API endpoints, /api/session-summary and /api/session-events, which are designed to provide insights into token usage and session activities for AI coding agents. These endpoints facilitate the sharing of live local knowledge graphs across multiple CLI clients, making them central to the tool's operational utility. However, in versions preceding 5.1.0, these handlers were implemented without any authentication middleware or access control mechanisms. This architectural oversight means that any client capable of reaching the network interface where the server is listening can interact with these endpoints without providing valid credentials, effectively exposing sensitive session data to unauthorized parties on the same network segment or potentially over the internet if exposed publicly.
The technical root cause lies in how the application processes user input for file system operations. Both vulnerable handlers accept a sessionId parameter via the query string and utilize this value directly within Node.js path.join function calls to construct filesystem paths. While path.join is generally safer than simple string concatenation, it does not inherently prevent directory traversal attacks when combined with improper validation of the resulting normalized path. An attacker can supply a maliciously crafted sessionId containing relative path sequences such as ..../etc/passwd or similar constructs targeting .jsonl files stored within the application's data directories. Node.js normalizes these paths at resolution time, resolving the parent directory references and allowing the server to read arbitrary files from the filesystem that are accessible by the user account running the process. This behavior aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, as the application fails to restrict file access to intended directories, and CWE-798: Use of Hard-coded Credentials is indirectly relevant due to the lack of authentication requirements for sensitive data retrieval.
The operational impact of this vulnerability is significant given the nature of the data involved. The exposed .jsonl files likely contain detailed logs of AI coding agent activities, including code snippets, user prompts, and potentially proprietary logic or credentials embedded within those contexts. An unauthenticated attacker could enumerate these sessions by guessing common session identifiers or exploiting predictable naming conventions to extract sensitive information. This constitutes a severe confidentiality breach under the ATT&CK framework, specifically mapping to T1005: Data from Local System as the initial access vector for data exfiltration and potentially T1213: Data from Information Repositories if structured knowledge graphs are targeted. The ability to read arbitrary files also opens the door for further exploitation vectors, such as reading configuration files that might contain database connection strings or API keys stored in plaintext within the local environment.
Mitigation strategies focus on both immediate remediation and long-term architectural improvements. The primary fix involves upgrading to version 5.1.0 of Token Optimizer MCP, where this issue has been patched by implementing proper input validation and restricting file access scopes. In addition to updating software, administrators should enforce strict network segmentation for services exposing internal APIs or dashboards, ensuring they are not accessible from untrusted networks. Implementing authentication middleware on all API endpoints is essential to prevent unauthorized access regardless of underlying code flaws. Furthermore, developers should adopt a principle of least privilege when handling file system operations, using allowlists for permitted filenames rather than relying solely on path normalization techniques which can be circumvented by sophisticated traversal attacks. Regular security audits and static analysis tools configured to detect CWE-22 patterns in Node.js applications can help identify similar vulnerabilities before deployment.