Most recent entries from all https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 11 Oct 2026 11:39:35 +0000 CVE-2026-108586 — 1MCP Agent 0.20.0 through 0.39.0 OAuth Tag-Scope Bypass via Negated Tag Filter https://vulnerability.circl.lu/vuln/cve-2026-108586 <p><strong>Affected:</strong> 1mcp-app @1mcp/agent</p> <p>1MCP Agent (@1mcp/agent) 0.20.0 through 0.39.0 contains an incorrect authorization vulnerability that allows authenticated clients to bypass OAuth tag-scope enforcement using negated advanced tag-filter expressions. Attackers holding a single-tag token can send a filter like not &lt;granted-tag&gt; to list and invoke tools on backend MCP servers outside their granted scopes.</p> <p><strong>Affected:</strong> 1mcp-app @1mcp/agent</p> <p>1MCP Agent (@1mcp/agent) 0.20.0 through 0.39.0 contains an incorrect authorization vulnerability that allows authenticated clients to bypass OAuth tag-scope enforcement using negated advanced tag-filter expressions. Attackers holding a single-tag token can send a filter like not &lt;granted-tag&gt; to list and invoke tools on backend MCP servers outside their granted scopes.</p> https://vulnerability.circl.lu/vuln/cve-2026-108586