CVE-2026-58168: DeepTutor Authorization Bypass Vulnerability

CVE-2026-58168 Overview

CVE-2026-58168 is an authorization bypass vulnerability in DeepTutor before version 1.4.10. The flaw resides in the allowed_mcp_tools function within deeptutor/multi_user/tool_access.py. When mcp_tools is omitted from a user's grant, the function returns None instead of a denied result. Low-privilege users can enumerate and invoke any configured Model Context Protocol (MCP) tool as a result. This includes filesystem, shell, and browser servers. The vulnerability is tracked under [CWE-862] Missing Authorization.

Critical Impact
Attackers or prompt-injected content operating within a user session can invoke unrestricted MCP tools, gaining unauthorized access to sensitive deployment resources including filesystem, shell execution, and browser automation capabilities.

Affected Products

DeepTutor by HKUDS, all versions prior to 1.4.10
Deployments exposing MCP filesystem, shell, or browser servers
Multi-user DeepTutor instances relying on default grant configuration

Discovery Timeline

2026-06-30 - CVE-2026-58168 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-58168

Vulnerability Analysis

DeepTutor implements a multi-user grant system to control which MCP tools each user can invoke. The allowed_mcp_tools function returns the whitelist of MCP tool names permitted for the current user. When the mcp_tools field is absent from a user's grant, the function returned None, which downstream code interpreted as "unrestricted access to all tools." This fail-open semantic is safe for partner-configured whitelists but unsafe for real non-admin users. MCP tools proxy host-side capabilities such as filesystem operations, shell command execution, and browser automation. A prompt-injection payload embedded in user content can therefore instruct the agent to invoke privileged MCP servers without any explicit admin grant.

Root Cause

The root cause is an insecure default in the grant schema. The mcp_tools=None sentinel was overloaded to mean "default" (all tools) rather than "deny by default." The patch introduces a distinction between partner-scoped whitelists, where None remains permissive, and non-admin runtime access, where absence of an explicit grant fails closed.

Attack Vector

An authenticated low-privilege user sends a chat turn containing crafted content or a prompt-injection payload. The agentic pipeline calls allowed_mcp_tools(), receives None, and passes all deferred MCP tools to the model. The model then invokes any MCP server the deployment exposes, including shell and filesystem tools, and returns results within the user session.

python

# Security patch in deeptutor/agents/chat/agentic_pipeline.py (excerpt)
await get_mcp_manager().ensure_started()
# Caller-scoped whitelist (e.g. a partner's configured MCP tools)
# intersected with the current user's admin grant. ``None`` means
# unrestricted; a set narrows the deferred tools. Real non-admin
# users fail closed when no MCP grant is present, while partner
# turns use their owner-scoped metadata whitelist as the authority.
from deeptutor.multi_user.tool_access import allowed_mcp_tools, combine_whitelists

raw_filter = context.metadata.get("mcp_tools_filter")
caller_allowed = (
    {str(name) for name in raw_filter} if isinstance(raw_filter, list) else None
)
is_partner = str((context.metadata or {}).get("source")) == "partner"
user_allowed = None if is_partner else allowed_mcp_tools()
allowed: set[str] | None = combine_whitelists(caller_allowed, user_allowed)
pool = self.registry.deferred_tools()
if allowed is not None:
    pool = [t for t in pool if t.get_definition().name in allowed]
# Source: https://github.com/HKUDS/DeepTutor/commit/90046374b3dcd4f8a866d2d64a64440bc08eb2ef

Detection Methods for CVE-2026-58168

Indicators of Compromise

Invocation of MCP shell, filesystem, or browser tools from sessions belonging to non-admin user IDs
Agent trace logs showing tool names outside the documented per-user whitelist
Unexpected outbound HTTP requests originating from MCP browser servers
Filesystem read or write events on paths outside DeepTutor's document workspace

Detection Strategies

Correlate DeepTutor audit logs with user role metadata to flag any MCP tool call where the caller lacks an explicit mcp_tools grant.
Alert on chat turns containing prompt-injection patterns such as embedded tool-call directives, system: role overrides, or requests to enumerate available tools.
Baseline MCP tool usage per user and detect deviations, particularly first-time use of shell or filesystem servers.

Monitoring Recommendations

Enable verbose logging on the MCP manager and forward tool invocation events to a central SIEM.
Monitor host processes spawned by MCP shell servers for unusual command lines or child process trees.
Track file access on directories reachable by the MCP filesystem server and alert on reads of credentials, keys, or configuration files.

How to Mitigate CVE-2026-58168

Immediate Actions Required

Upgrade DeepTutor to version 1.4.10 or later, which changes mcp_tools=None to deny-by-default for non-admin users.
Audit all existing user grants and populate mcp_tools with an explicit allow-list for every non-admin account.
Temporarily disable MCP shell, filesystem, and browser servers until the upgrade is complete.
Review recent agent trace logs for evidence of unauthorized MCP tool invocation.

Patch Information

The fix is delivered in DeepTutor v1.4.10 via pull request #579 and commit 90046374. The patch modifies deeptutor/multi_user/grants.py and deeptutor/agents/chat/agentic_pipeline.py so that mcp_tools=None denies access for non-admin runtime callers while preserving permissive semantics for partner-scoped configurations. See the VulnCheck Security Advisory for full advisory details.

Workarounds

If immediate upgrade is not possible, remove all MCP server registrations from the deployment configuration.
Set every user's grant to include an explicit empty mcp_tools: [] list to force denial under the vulnerable code path.
Restrict the DeepTutor process account so filesystem and shell MCP servers cannot reach sensitive paths or execute privileged binaries.

bash

# Configuration example: enforce explicit deny in each user grant
# grants.yaml
users:
  - id: student-user
    models:
      llm: []
    knowledge_bases: []
    skills: []
    enabled_tools: []
    mcp_tools: []       # explicit empty list denies all MCP tools
    exec_enabled: false