CVE-2026-15528: kicad-mcp Path Traversal Vulnerability

CVE-2026-15528 Overview

CVE-2026-15528 affects lamaalrajih kicad-mcp versions up to 3.3.1. The vulnerability resides in the kicad_mcp/utils/path_validator.py file, where manipulation of the project_path or schematic_path arguments leads to a protection mechanism failure [CWE-693]. An attacker with local access and low privileges can bypass the intended path validation logic. A public exploit exists, and the project was notified through an issue report but has not responded at the time of disclosure.

Critical Impact
A local attacker with low privileges can bypass path validation in kicad-mcp by manipulating project_path or schematic_path arguments, undermining a defense-in-depth control designed to restrict file access.

Affected Products

lamaalrajih kicad-mcp versions up to and including 3.3.1
File affected: kicad_mcp/utils/path_validator.py
Arguments affected: project_path and schematic_path

Discovery Timeline

2026-07-13 - CVE-2026-15528 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-15528

Vulnerability Analysis

The vulnerability is a protection mechanism failure [CWE-693] in the path validation routine of kicad-mcp, a Model Context Protocol (MCP) server for KiCad. The path_validator.py module is designed to constrain which paths clients may reference when opening or manipulating KiCad projects and schematics. By supplying crafted values for the project_path or schematic_path arguments, an attacker defeats these checks.

The issue is exploitable only from a local context and requires the attacker to already possess low privileges on the host. Successful manipulation weakens a defense-in-depth control rather than directly granting code execution. Because kicad-mcp bridges AI assistants to local KiCad project files, a bypassed validator broadens the set of files an untrusted MCP client can reach.

Root Cause

The root cause is insufficient enforcement of path constraints inside kicad_mcp/utils/path_validator.py. The validator does not adequately normalize or restrict input values before treating them as trusted, allowing crafted inputs to slip past the guard. Details of the flaw and reproduction steps are documented in the GitHub Issue #57 Discussion and the VulDB CVE-2026-15528 Entry.

Attack Vector

The attack vector is local. An adversary with low-privilege access to the system, or a locally-connected MCP client controlled by the attacker, submits manipulated project_path or schematic_path values. The validator returns success on inputs that should have been rejected, letting downstream code operate on paths outside the intended scope. No user interaction is required to trigger the flaw once the attacker can reach the MCP endpoint.

No verified exploit code is reproduced here. Technical details are available in the GitHub Repository for KiCad MCP and the VulDB Vulnerability #377866 entry.

Detection Methods for CVE-2026-15528

Indicators of Compromise

Requests to the kicad-mcp server referencing project_path or schematic_path values that contain traversal sequences, absolute paths outside the expected project directory, or unusual encoding.
Access by the kicad-mcp process to KiCad-related files located outside the user's normal project workspace.
Log entries from kicad_mcp/utils/path_validator.py that show validation succeeding on paths that resolve outside the configured project root.

Detection Strategies

Enable verbose logging around the path_validator.py code path and record the raw and canonicalized values of project_path and schematic_path for every request.
Compare the resolved absolute path against the intended project root directory. Alert on any resolved path that lies outside the expected base.
Monitor for local processes spawning kicad-mcp with unexpected arguments or environment variables that widen the effective project scope.

Monitoring Recommendations

Track file open, read, and write syscalls originating from the kicad-mcp process using host-based telemetry, and flag access outside declared project directories.
Audit the local MCP client population that can reach the kicad-mcp endpoint, and log all client-supplied path arguments centrally for review.

How to Mitigate CVE-2026-15528

Immediate Actions Required

Restrict access to the kicad-mcp server to trusted local users only, and avoid running it in multi-user or shared environments.
Run kicad-mcp under a dedicated low-privilege account whose filesystem access is limited to the intended KiCad project directory.
Review any MCP clients configured to communicate with kicad-mcp and remove clients that are not required.

Patch Information

At the time of publication, no vendor fix is available. The project maintainer had not responded to the issue report referenced in the GitHub Issue #57 Discussion. Track the GitHub Repository for KiCad MCP for updates beyond version 3.3.1.

Workarounds

Sandbox the kicad-mcp process using operating system controls such as Linux namespaces, seccomp profiles, AppArmor, SELinux, or macOS sandbox profiles to constrain the paths the process can access.
Place the KiCad project root on a filesystem mount that does not expose sensitive files, and deny the service account read access to files outside that mount.
Stop the kicad-mcp service when it is not actively in use to reduce the exposure window for local attackers.

bash

# Example: run kicad-mcp under a dedicated low-privilege user with a restricted project root
sudo useradd --system --home /var/lib/kicad-mcp --shell /usr/sbin/nologin kicadmcp
sudo install -d -o kicadmcp -g kicadmcp -m 0750 /var/lib/kicad-mcp/projects
sudo -u kicadmcp KICAD_PROJECT_ROOT=/var/lib/kicad-mcp/projects \
    python -m kicad_mcp