CVE-2026-15526 Overview
CVE-2026-15526 is a path traversal vulnerability in augmnt augments-mcp-server version 7.1.0. The flaw resides in the scanProjectDeps function within src/tools/v4/scan-project-deps.ts, part of the scan_project_deps component. An attacker with local access can manipulate the packageJsonPath argument to traverse outside the intended directory and access arbitrary files on the host filesystem [CWE-22].
The exploit has been publicly disclosed. The maintainer was notified through an issue report but has not responded at the time of publication. The vulnerability is scoped to local attackers and does not permit remote exploitation.
Critical Impact
Local attackers can leverage the packageJsonPath parameter to read files outside the intended project directory, exposing potentially sensitive configuration or source data.
Affected Products
- augmnt augments-mcp-server version 7.1.0
- Component: scan_project_deps
- File: src/tools/v4/scan-project-deps.ts
Discovery Timeline
- 2026-07-13 - CVE-2026-15526 published to NVD
- 2026-07-13 - Last updated in NVD database
Technical Details for CVE-2026-15526
Vulnerability Analysis
The vulnerability affects the scanProjectDeps function, which processes a caller-supplied packageJsonPath argument. The function does not properly normalize or validate the supplied path before opening the target file. As a result, an attacker supplying traversal sequences such as ../ can escape the expected project directory boundary.
Because the server runs as a Model Context Protocol (MCP) tool, the scan_project_deps capability is invoked by client requests. A local user who can invoke tool calls against the MCP server can direct the function to read files owned by the server process user. The scope is limited to confidentiality impact on local files that the server can read.
A proof-of-concept has been published in the project's GitHub issue tracker. See the GitHub Issue Discussion and VulDB Vulnerability Details for background.
Root Cause
The root cause is missing sanitization of the packageJsonPath parameter in scanProjectDeps. The function accepts user-influenced input and uses it directly in filesystem operations without enforcing a canonical base directory or rejecting path traversal sequences [CWE-22].
Attack Vector
Exploitation requires local access and low privileges. The attacker crafts a request to the scan_project_deps tool with a packageJsonPath value containing directory traversal sequences pointing at a sensitive file outside the intended workspace. The server resolves the path and returns or processes the file contents. No user interaction is required beyond invoking the tool.
See the GitHub PoC Repository for reference implementation details.
Detection Methods for CVE-2026-15526
Indicators of Compromise
- Tool invocations to scan_project_deps containing ../ sequences or absolute paths outside the expected project root in the packageJsonPath argument.
- Access log entries showing scanProjectDeps reading files such as /etc/passwd, ~/.ssh/, or environment configuration files unrelated to any active project workspace.
- Unexpected read access by the MCP server process to files outside its designated working directory.
Detection Strategies
- Instrument the MCP server to log every resolved absolute path passed to scanProjectDeps and alert on paths that fall outside the configured project root.
- Perform static analysis of MCP tool implementations for missing calls to path.resolve combined with base-directory validation.
- Monitor filesystem audit logs (auditd, FIM) for reads on sensitive paths by the Node.js process hosting augments-mcp-server.
Monitoring Recommendations
- Enable verbose MCP tool call logging and forward logs to a centralized SIEM for pattern matching on traversal sequences.
- Alert on any scan_project_deps invocation where the argument contains .., tilde expansion, or begins with /.
- Track process file-descriptor activity to detect the server opening files outside its intended workspace.
How to Mitigate CVE-2026-15526
Immediate Actions Required
- Restrict local access to the host running augments-mcp-server to trusted users only.
- Run the MCP server under a dedicated low-privilege account with filesystem access limited to intended project directories.
- Disable or unregister the scan_project_deps tool until a fix is available if it is not required for operations.
Patch Information
At the time of publication, no vendor patch is available. The maintainer of augmnt/augments-mcp-server was notified via an issue report but has not responded. Track the GitHub Issue Discussion and the VulDB CVE Report for updates.
Workarounds
- Sandbox the MCP server using containerization or a chroot to constrain filesystem visibility to the project workspace only.
- Apply mandatory access control (AppArmor, SELinux) profiles restricting the server process to specific directories.
- Wrap or fork scanProjectDeps to resolve packageJsonPath with path.resolve and reject any resolved path that does not start with the approved project root prefix.
# Configuration example: AppArmor profile snippet restricting the MCP server
/usr/bin/node ix,
/opt/augments-mcp-server/** r,
/srv/projects/** r,
deny /etc/** r,
deny /root/** r,
deny /home/*/.ssh/** r,
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
