CVE-2026-86439: Knowns Path Traversal Vulnerability

CVE-2026-86439 Overview

CVE-2026-86439 is a path traversal vulnerability [CWE-22] affecting Knowns versions prior to 0.30.0. The flaw resides in Model Context Protocol (MCP) tool argument handling, where the server fails to validate filesystem paths supplied by clients. Attackers can inject directory traversal sequences into path arguments to read, create, overwrite, and delete Markdown files outside the intended project directory. The vulnerable code paths are located in internal/storage/doc_store.go and internal/storage/memory_store.go. Exploitation requires only low-privileged network access to the MCP server and no user interaction.

Critical Impact
Authenticated MCP clients can traverse outside the project root to read, modify, or delete arbitrary Markdown files accessible to the Knowns server process.

Affected Products

Knowns versions prior to 0.30.0
internal/storage/doc_store.go (MCP doc tool handler)
internal/storage/memory_store.go (MCP memory tool handler)

Discovery Timeline

2026-09-07 - CVE-2026-86439 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86439

Vulnerability Analysis

Knowns exposes MCP tools that accept filesystem paths from remote clients. The doc and memory tool handlers accept path arguments and pass them to file read, write, and delete operations without confining the resolved path to the project root. An authenticated MCP client can supply strings such as ../../etc/notes.md or absolute paths to reach Markdown files outside the intended workspace. The impact is bounded to files the Knowns process can access, but that scope includes any Markdown content readable or writable by the service account. Successful exploitation compromises confidentiality, integrity, and availability of those files.

Root Cause

The root cause is missing path containment in the MCP tool argument parsers. The pre-patch code in doc_store.go and memory_store.go builds filesystem paths from untrusted input using naive string joining. There is no rejection of absolute paths, parent traversal sequences (..), Windows volume prefixes, or symlink escapes.

Attack Vector

An attacker with access to invoke MCP tools on the Knowns server crafts tool calls whose path arguments contain traversal sequences. The server resolves the path relative to the project directory but does not verify that the final path remains inside the root. The handler then performs the requested file operation on the escaped path.

// Post-patch containment logic added in internal/safepath/path.go
// Source: https://github.com/knowns-dev/knowns/commit/09c5a96fd5817b941dc86669278c1a17db10ed4e

// Package safepath resolves untrusted filesystem paths inside an explicit root.
package safepath

import (
	"fmt"
	"os"
	"path/filepath"
	"regexp"
	"runtime"
	"strings"
)

var windowsVolumePath = regexp.MustCompile(`^[A-Za-z]:`)

// Resolve resolves an untrusted relative path inside root. Absolute paths,
// parent traversal, Windows volume paths, and symlink escapes are rejected.
func Resolve(root, untrusted string) (string, error) {
	return resolve(root, untrusted, false)
}

// ResolveProject resolves a project path inside root. Native absolute paths
// are accepted only when they still resolve inside root.
func ResolveProject(root, untrusted string) (string, error) {
	return resolve(root, untrusted, true)
}

The patch also introduces an identifier allowlist for memory keys in internal/models/memory.go:

// Source: https://github.com/knowns-dev/knowns/commit/09c5a96fd5817b941dc86669278c1a17db10ed4e
var memoryIDPattern = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$`)

Detection Methods for CVE-2026-86439

Indicators of Compromise

MCP tool invocations whose path arguments contain .., absolute path prefixes (/, C:\), or URL-encoded traversal sequences such as %2e%2e%2f.
Knowns process file access to Markdown files (*.md) outside the configured project root directory.
Unexpected creation, modification, or deletion of Markdown files owned by the Knowns service account in sensitive locations.

Detection Strategies

Enable verbose logging on the Knowns MCP server and alert on tool arguments containing directory traversal patterns.
Instrument filesystem auditing (Linux auditd, Windows Object Access) on paths outside the project root that are readable or writable by the Knowns service account.
Compare Knowns binary version against 0.30.0 across managed hosts and flag any earlier release.

Monitoring Recommendations

Forward Knowns application and OS-level file access logs to a centralized analytics platform for correlation with MCP client activity.
Baseline the set of file paths touched by the Knowns process and alert on deviations.
Track MCP session identity and correlate unusual tool argument patterns to specific clients.

How to Mitigate CVE-2026-86439

Immediate Actions Required

Upgrade Knowns to version 0.30.0 or later, which introduces the safepath package and the memoryIDPattern allowlist.
Restrict network exposure of the Knowns MCP endpoint to trusted clients only until patching is complete.
Run the Knowns process under a dedicated low-privilege service account that has access only to the intended project directory.

Patch Information

The fix is delivered in Knowns release v0.30.0 and implemented in commit 09c5a96. Additional context is available in the GitHub Security Advisory GHSA-9gfj-28hw-jchp and the VulnCheck advisory.

Workarounds

Block or filter MCP tool arguments containing .. sequences and absolute path prefixes at an upstream proxy.
Confine the Knowns process using mandatory access controls (AppArmor, SELinux) or containerization to restrict filesystem access to the project directory.
Disable the vulnerable doc and memory MCP tools if they are not required for the deployment.

bash

# Example: run Knowns in a restricted container mounting only the project directory
docker run --rm \
  --read-only \
  --user 1000:1000 \
  -v /srv/knowns/project:/project:rw \
  -w /project \
  knowns:0.30.0