CVE-2026-9467: mcp-debugger Path Traversal Vulnerability

CVE-2026-9467 Overview

CVE-2026-9467 is a path traversal vulnerability [CWE-22] in debugmcp mcp-debugger versions up to and including 0.20.0. The flaw resides in the handleGetSourceContext function within src/server.ts. Attackers can manipulate path input to access files outside the intended directory. The vulnerability is exploitable remotely over the network and requires low privileges. A public exploit is available, and the vendor did not respond to disclosure attempts.

Critical Impact
Authenticated remote attackers can read arbitrary files accessible to the mcp-debugger process by abusing the handleGetSourceContext source resolution logic.

Affected Products

debugmcp mcp-debugger versions up to and including 0.20.0
Deployments exposing the Model Context Protocol (MCP) debug server over the network
Integrations relying on handleGetSourceContext for source file retrieval

Discovery Timeline

2026-05-25 - CVE-2026-9467 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-9467

Vulnerability Analysis

The vulnerability exists in the handleGetSourceContext handler defined in src/server.ts of the mcp-debugger project. The handler accepts a source path parameter from a Model Context Protocol request and uses it to read file contents for debugging context. The function fails to validate or canonicalize the supplied path before resolving it against the server's working directory.

Attackers can submit path segments containing ../ sequences or absolute paths to traverse outside the intended source root. The server then returns the contents of arbitrary files readable by the mcp-debugger process. This exposes source code, configuration files, environment data, and credentials stored on the host.

Exploitation requires only low-privileged access to the MCP endpoint and no user interaction. The attack scope is limited to confidentiality, with no integrity or availability impact reported.

Root Cause

The root cause is missing path sanitization in the handleGetSourceContext function. The handler trusts client-supplied file paths and does not enforce that resolved paths remain within an allow-listed source directory. There is no normalization step that rejects traversal sequences before the file read operation.

Attack Vector

An attacker with access to the mcp-debugger network interface sends a crafted MCP request invoking handleGetSourceContext with a malicious path argument. The path uses directory traversal sequences to reference targets such as /etc/passwd, .env files, or SSH keys. The server reads and returns the file contents in its response.

The vulnerability mechanism is documented in the public proof of concept tracked on the GitHub Issue Tracker and detailed in VulDB #365448. No synthetic exploit code is reproduced here.

Detection Methods for CVE-2026-9467

Indicators of Compromise

MCP requests to handleGetSourceContext containing ../, ..\\, URL-encoded traversal sequences, or absolute filesystem paths
File read operations by the mcp-debugger process targeting paths outside the configured source directory
Unexpected access to sensitive files such as /etc/passwd, ~/.ssh/, .env, or credential stores by the Node.js runtime hosting mcp-debugger

Detection Strategies

Inspect application logs for handleGetSourceContext invocations with path arguments containing traversal patterns or absolute paths
Deploy filesystem auditing on hosts running mcp-debugger to flag reads outside the project workspace
Correlate MCP request volume and source path entropy to identify scripted enumeration attempts

Monitoring Recommendations

Forward mcp-debugger and host audit logs to a centralized analytics platform for correlation
Alert on outbound responses from the MCP service that exceed expected source file sizes or contain credential patterns
Track network exposure of MCP debugger ports and restrict ingress to authorized developer workstations

How to Mitigate CVE-2026-9467

Immediate Actions Required

Restrict network access to the mcp-debugger service to trusted developer hosts using firewall rules or a reverse proxy
Run mcp-debugger under a least-privileged service account that cannot read sensitive files outside the project directory
Audit existing deployments for evidence of unauthorized handleGetSourceContext calls referencing files outside the source tree

Patch Information

No vendor patch is available. The vendor was contacted prior to disclosure but did not respond, per the VulDB advisory. Affected operators should monitor the debugmcp project repository for an update beyond version 0.20.0 and apply it once released.

Workarounds

Wrap or fork handleGetSourceContext to canonicalize the input path with path.resolve and reject results outside an allow-listed source root
Bind mcp-debugger to localhost only and tunnel access through SSH rather than exposing it on a network interface
Run the service inside a container or sandbox with a read-only filesystem mount limited to the intended source tree

bash

# Configuration example: bind mcp-debugger to loopback and constrain filesystem access
# Restrict listener
export MCP_DEBUGGER_HOST=127.0.0.1

# Launch under a constrained user with a chroot-style workspace mount
sudo -u mcpdebug \
  systemd-run --uid=mcpdebug --gid=mcpdebug \
  --property=ProtectSystem=strict \
  --property=ReadOnlyPaths=/srv/project-source \
  --property=InaccessiblePaths=/etc /root /home \
  node ./dist/server.js