GHSA-2q76-m6w6-qgc6
Payload: Improper access control for MCP API keys
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2026-105806
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Description
### Impact Under certain conditions, an authenticated user could manage MCP API keys outside their intended account allowing an attacker to escalate privileges through account takeover. Applications that do not use `@payloadcms/plugin-mcp` are not affected. ### Patches Users should upgrade to `@payloadcms/plugin-mcp` version `3.88.0` or later. ### Workarounds Upgrading is recommended. Until then, disable the MCP plugin or restrict MCP API-key management to trusted users.
Paquets affectés
| Paquet | Versions |
|---|---|
| npm · @payloadcms/plugin-mcp | introduced 3.61.0, fixed 3.88.0 |
Références
- https://github.com/payloadcms/payload/security/advisories/GHSA-2q76-m6w6-qgc6 WEB
- https://github.com/payloadcms/payload/commit/025581d8c5ed836039ad85397288a30f0d3c11c1 WEB
- https://github.com/payloadcms/payload PACKAGE
- https://github.com/payloadcms/payload/releases/tag/v3.88.0 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |