CVE-2026-81845: mcp-sequential-thinking Path Traversal Flaw

CVE-2026-81845 Overview

CVE-2026-81845 is a path traversal vulnerability [CWE-22] in the arben-adm mcp-sequential-thinking project through version 0.5.0. The flaw resides in the import_session and export_session functions defined in mcp_sequential_thinking/server.py. Attackers can manipulate the file_path argument to reach files outside the intended directory. The attack is exploitable over the network and requires low privileges. The maintainer released version 0.6.0, which includes patch commit 2fad3ee8ab1d0868b6c1afb5895bc336a10e5267, to resolve the issue.

Critical Impact
Remote authenticated attackers can traverse the file system through the Import/Export Session component, exposing or overwriting files accessible to the server process.

Affected Products

arben-adm mcp-sequential-thinking versions up to and including 0.5.0
Component: Import Session / Export Session in mcp_sequential_thinking/server.py
Fixed in release v0.6.0

Discovery Timeline

2026-08-28 - CVE-2026-81845 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-81845

Vulnerability Analysis

The vulnerability affects a Model Context Protocol (MCP) server that exposes tools for sequential-thinking workflows. Two tool handlers, import_session and export_session, accept a caller-supplied file_path string. The handlers pass this value to file I/O routines without normalizing or constraining the path to an allow-listed directory.

An attacker who can invoke the MCP tool interface can supply relative traversal sequences such as ../../etc/passwd or absolute paths. On write operations through export_session, attackers can place session data at arbitrary writable locations. On read operations through import_session, attackers can retrieve files readable by the server process.

Root Cause

The root cause is missing input validation on the file_path parameter, classified under [CWE-22] Improper Limitation of a Pathname to a Restricted Directory. The functions do not resolve the canonical path and verify containment within a designated session directory before opening the file.

Attack Vector

Exploitation occurs remotely through the MCP tool invocation channel. The attacker requires low-privilege access to call the exposed tools. No user interaction is needed. Impact is bounded to the confidentiality, integrity, and availability of files reachable by the MCP server process user.

python

# Patch excerpt from mcp_sequential_thinking/server.py
# The maintainer converted the tool to async and hardened argument handling.
@mcp.tool()
-def process_thought(
+async def process_thought(
     thought: str,
     thought_number: int,
     total_thoughts: int,
     next_thought_needed: bool,
     stage: str,
-    tags: List[str] = [],
-    axioms_used: List[str] = [],
-    assumptions_challenged: List[str] = [],
+    tags: Optional[List[str]] = None,
+    axioms_used: Optional[List[str]] = None,
+    assumptions_challenged: Optional[List[str]] = None,
     ctx: Optional[Context] = None,
 ) -> dict:
     """Add a sequential thought with its metadata.

Source: GitHub Commit 2fad3ee

Detection Methods for CVE-2026-81845

Indicators of Compromise

MCP tool invocations of import_session or export_session where file_path contains .., absolute paths, or URL-encoded traversal sequences (%2e%2e%2f).
Session files written outside the expected working directory of the MCP server.
Server process file reads of sensitive OS files such as /etc/passwd, SSH keys, or application configuration files.

Detection Strategies

Inspect MCP server logs for file_path arguments that contain traversal characters or resolve outside the designated session directory.
Deploy filesystem auditing (auditd, Sysmon FileCreate/FileRead events) scoped to the process running mcp-sequential-thinking.
Compare the deployed package version against 0.6.0 and flag any host running an earlier release.

Monitoring Recommendations

Alert on child processes and file operations initiated by the MCP server outside its installation and session directories.
Monitor authentication logs for the identities permitted to invoke MCP tools and correlate with anomalous session import/export volumes.
Track outbound file transfers of files named after harvested session exports to detect data staging.

How to Mitigate CVE-2026-81845

Immediate Actions Required

Upgrade arben-adm mcp-sequential-thinking to version 0.6.0 or later, which contains patch commit 2fad3ee8ab1d0868b6c1afb5895bc336a10e5267.
Restrict network exposure of the MCP server to trusted clients only and require authentication on the tool interface.
Run the MCP server under a dedicated low-privilege user account with filesystem access limited to a session directory.

Patch Information

The fix is delivered in GitHub Release v0.6.0 via GitHub Pull Request #18, which merged commit 2fad3ee8ab1d0868b6c1afb5895bc336a10e5267. Background discussion is available in GitHub Issue #17. Additional references are cataloged at VulDB CVE-2026-81845.

Workarounds

If upgrading is not immediately possible, disable or gate the import_session and export_session tools at the MCP configuration layer.
Enforce a filesystem chroot, container mount namespace, or AppArmor/SELinux profile that confines the server to a session-only directory.
Add a reverse-proxy or wrapper that validates the file_path parameter against an allow-list and rejects paths containing .. or absolute prefixes.

bash

# Upgrade to the patched release
pip install --upgrade "mcp-sequential-thinking>=0.6.0"

# Verify the installed version
pip show mcp-sequential-thinking | grep -i version