Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-117570— nmap-mcp through commit 3636afa Permissive NSE Script Allowlist in scan_vulnerabilities

Quick assessment

Affected
Vorota-ai nmap-mcp
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Vorota-ai 的 nmap-mcp 项目（截至 commit 3636afa）在 scan_vulnerabilities 工具中存在一个不当的白名单验证漏洞，允许调用方执行被禁止的 NSE 脚本类别。MCP 客户端或遭受提示注入攻击的代理可向 nmap --script 参数传递 exploit、dos、brute 或 intrusive 等类别，从而针对扫描目标运行具有侵入性、暴力破解、漏洞利用或拒绝服务性质的脚本。

CVSS 5.2 · Medium EPSS 0.24% · P16

Affected Version Matrix 1

VendorProduct Version RangeStatus
Vorota-ai nmap-mcp ≤ 3636afa6ad4e159c7ad07ca35ede644f37db9c5e affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-117570

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
nmap-mcp through commit 3636afa Permissive NSE Script Allowlist in scan_vulnerabilities
Source: CVE Program / CVE List V5
Vulnerability Description
Vorota-ai nmap-mcp through commit 3636afa contains an improper allowlist validation vulnerability in the scan_vulnerabilities tool that lets callers run blocked NSE script categories. MCP clients or prompt-injected agents can pass categories like exploit, dos, brute, or intrusive to nmap --script, running intrusive, brute-force, exploit, or denial-of-service scripts against scan targets.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
宽松定义的白名单
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Vorota-ai nmap-mcp 0 ~ 3636afa6ad4e159c7ad07ca35ede644f37db9c5e -

II. Public POCs for CVE-2026-117570

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-117570

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-117570 (1)

Proof of Concept for CVE-2026-117570 (1)

Other References for CVE-2026-117570 (1)

IV. Related Vulnerabilities

Same weakness: CWE-183