CVE-2026-117570: nmap-mcp through commit 3636afa Permissive NSE Script Allowlist in scan_vulnerabilities
Vorota-ai nmap-mcp through commit 3636afa contains an improper allowlist validation vulnerability in the scanvulnerabilities tool that lets callers run blocked NSE script categories. MCP clients or prompt-injected agents can pass categories like exploit, dos, brute, or intrusive to nmap --script, running intrusive, brute-force, exploit, or denial-of-service scripts against scan targets.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of Vorota-ai nmap-mcp that include the affected scan_vulnerabilities implementation are exposed when an MCP client or an agent can invoke that tool. The impact is especially relevant where clients or agents can be influenced by untrusted prompts or inputs.
What access does an attacker need to exploit it?
An attacker needs the ability to cause calls to the scan_vulnerabilities tool, directly through an MCP client or indirectly by prompt-injecting an agent that can use it. No user interaction is required once the attacker can supply the script category.
What can exploitation do?
A caller can supply categories that should be blocked, including exploit, dos, brute, and intrusive, causing nmap to run the associated NSE scripts against scan targets. This can lead to intrusive scanning, brute-force attempts, exploit attempts, or denial-of-service activity against those targets.
What can be done if patching is not immediately possible?
Restrict access to the scan_vulnerabilities tool to trusted MCP clients and prevent untrusted prompts or inputs from controlling its script-category argument. Limit the scan targets reachable by the nmap-mcp deployment to reduce the impact of unauthorized NSE script execution.