CVE-2026-43901: Wireshark MCP Path Traversal Vulnerability

CVE-2026-43901 Overview

CVE-2026-43901 is a path traversal vulnerability [CWE-22] in Wireshark MCP, an MCP Server that wraps tshark as a structured analysis interface. Versions 1.1.5 and earlier expose a wireshark_export_objects MCP tool that accepts an attacker-controlled dest_dir parameter. The server forwards this value to tshark's --export-objects flag without enforcing a path restriction. The optional sandbox _allowed_dirs is None by default and only activates when the WIRESHARK_MCP_ALLOWED_DIRS environment variable is set. In a default installation, exported objects can be written to any directory on the filesystem.

Critical Impact
An attacker who can supply input to the MCP tool can write files extracted from packet captures to arbitrary filesystem locations, enabling overwrite of sensitive files or staging of malicious content.

Affected Products

bx33661 wireshark_mcp versions 1.1.5 and earlier
Default installations without WIRESHARK_MCP_ALLOWED_DIRS configured
Any MCP client integration relying on the wireshark_export_objects tool

Discovery Timeline

2026-05-11 - CVE-2026-43901 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-43901

Vulnerability Analysis

Wireshark MCP exposes tshark capabilities to AI agents and other MCP clients through a structured tool interface. The wireshark_export_objects tool extracts protocol objects (HTTP, SMB, TFTP, IMF, DICOM) from a capture file and writes them to a destination directory. The tool accepts the dest_dir argument directly from the MCP request and concatenates it into the tshark --export-objects <proto>,<dest_dir> invocation. No canonicalization, allowlist, or containment check runs before the path reaches tshark.

The code includes an _allowed_dirs sandbox intended to constrain output paths. This sandbox is initialized to None unless the WIRESHARK_MCP_ALLOWED_DIRS environment variable is explicitly set at startup. When _allowed_dirs is None, the validation logic short-circuits and accepts any path. Attackers exploiting this through user-influenced MCP traffic require user interaction, reflected in the CVSS vector component UI:R.

Root Cause

The root cause is missing input validation on a security-sensitive parameter combined with an opt-in sandbox model. The application treats the absence of WIRESHARK_MCP_ALLOWED_DIRS as permission to write anywhere, rather than defaulting to a safe working directory. This inverts the secure-by-default principle and leaves operators exposed unless they discover and configure the environment variable.

Attack Vector

An attacker delivers a crafted packet capture and induces a user or AI agent to invoke wireshark_export_objects with a malicious dest_dir such as /etc/cron.d or a user's ~/.ssh directory. Object names inside the capture can be controlled by the attacker, allowing the resulting filenames to overwrite shell startup files, cron jobs, or SSH authorized keys. The vulnerability does not provide direct code execution, but file overwrite in privileged locations frequently escalates to code execution on the host running the MCP server.

See the GitHub Security Advisory GHSA-3r68-x3xc-rxpg for upstream technical details.

Detection Methods for CVE-2026-43901

Indicators of Compromise

Files created outside the intended working directory by the process running wireshark-mcp or tshark
tshark command lines containing --export-objects with absolute paths pointing to /etc, /root, ~/.ssh, /var/spool/cron, or Windows system directories
Unexpected MCP tool invocations of wireshark_export_objects with dest_dir values containing .., /, or \

Detection Strategies

Audit MCP server request logs for wireshark_export_objects calls and inspect the dest_dir argument against an allowlist
Monitor process telemetry for tshark child processes spawned by the MCP server and alert on --export-objects destinations outside an approved directory
Inspect filesystem audit logs (auditd, Sysmon FileCreate) for writes by the MCP service account into sensitive paths

Monitoring Recommendations

Enable verbose logging in the MCP server and forward logs to a centralized analytics platform for correlation
Track environment variable state at process start to confirm WIRESHARK_MCP_ALLOWED_DIRS is set on production hosts
Alert on new or modified files in /etc/cron.*, ~/.ssh/authorized_keys, shell rc files, and service unit directories on hosts running wireshark-mcp

How to Mitigate CVE-2026-43901

Immediate Actions Required

Upgrade wireshark-mcp to a version later than 1.1.5 once a patched release is available from the maintainer
Set WIRESHARK_MCP_ALLOWED_DIRS to a dedicated, non-sensitive directory before starting the MCP server
Run the MCP server under a low-privilege service account with no write access to /etc, user home directories, or scheduled task paths

Patch Information

Monitor the bx33661/Wireshark-MCP repository for a fixed release. Until a patch is published, treat the configuration-based workaround as the primary control.

Workarounds

Explicitly configure WIRESHARK_MCP_ALLOWED_DIRS to restrict export destinations to a sandboxed directory
Deploy the MCP server inside a container or chroot with a read-only root filesystem and a single writable export volume
Disable or remove the wireshark_export_objects tool registration if object export is not required for your workflow
Apply mandatory access control profiles (AppArmor, SELinux) to constrain where the tshark process can write

bash

# Configuration example: constrain export destinations before launch
export WIRESHARK_MCP_ALLOWED_DIRS="/var/lib/wireshark-mcp/exports"
mkdir -p "$WIRESHARK_MCP_ALLOWED_DIRS"
chown wireshark-mcp:wireshark-mcp "$WIRESHARK_MCP_ALLOWED_DIRS"
chmod 750 "$WIRESHARK_MCP_ALLOWED_DIRS"

# Start the MCP server under the dedicated service account
sudo -u wireshark-mcp wireshark-mcp --transport stdio