CVE-2026-19039

Name of the Vulnerable Software and Affected Versions Kino-Kafkaesque ssh-mcp-server versions prior to 8ebbbb99b26f80ff6162fe00957c6dec73fbc5a5

Description Command injection is possible via the SSH Command Handler component in the ssh exec() function located in the src/index.ts file. This occurs when the host/username argument is manipulated. The attack requires local access. The project maintainer notes that the tool is intended for local/trusted agents who already possess execution capabilities through the exposed shell.

Recommendations Update Kino-Kafkaesque ssh-mcp-server to a version later than 8ebbbb99b26f80ff6162fe00957c6dec73fbc5a5. As a temporary mitigation, restrict access to the ssh exec() function to only trusted local users.