CVE Intelligence
Analysis AI-assisted

CVE-2026-2130: mcp-maigret Command Injection via search_username

CVE-2026-2130 is a command injection weakness (CWE-77) in mcp-maigret up to version 1.0.12, in the search_username component, reachable through the Username argument. The record states the attack may be launched remotely. NVD rates it critical with CVSS 3.1 9.8, while the CNA VulDB lists lower scores, and version 1.0.13 is reported to mitigate the issue with no confirmed exploitation in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-2130 is a command injection weakness (CWE-77) affecting mcp-maigret by BurtTheCoder, an MCP server, in versions up to 1.0.12. According to the record, the flaw lies in an unspecified part of src/index.ts within the search_username component and is triggered by manipulating the Username argument.

Impact

  • Command injection can allow an attacker to influence commands run by the affected component. The exact consequences depend on how the component is deployed, which the record does not describe.
  • The record states the attack may be launched remotely.
  • The NVD CVSS 3.1 vector reports high impact to confidentiality, integrity and availability.

Affected products and versions

  • Product listed as Burtthecoder Maigret Mcp Server, versions up to and including 1.0.12.
  • Version 1.0.13 is stated to mitigate the issue, and the referenced patch commit is b1ae073c4b3e789ab8de36dc6ca8111ae9399e7a.

Exploitation status

The vulnerability is not listed in the CISA KEV catalog in this record, so active exploitation is not confirmed. No confirmed exploitation appears in the sources consulted. The EPSS value recorded is a probability of 0.02012 with a percentile of 0.80376.

Remediation and mitigation

  • Upgrade mcp-maigret to version 1.0.13 or later, as indicated by the project release and the record.
  • If an immediate upgrade is not possible, limit network exposure of the service and restrict who can reach the search functionality.
  • Treat user-supplied identifiers as untrusted input and review how they are passed to system-level operations.
  • Run the component with the least privileges needed.

Detection guidance

  • Review logs of the search_username functionality for unusual or malformed Username values.
  • Monitor the service for unexpected child processes or outbound activity originating from the MCP server process.
  • Confirm the deployed version and verify that it is above 1.0.12.

Limitations of the available information

The record does not identify the exact vulnerable code path, the preconditions needed for exploitation, or whether default configurations are exposed. Scores differ between providers: NVD reports CVSS 3.1 9.8, while the CNA VulDB reports CVSS 4.0 5.3, CVSS 3.1 6.3 and CVSS 2.0 6.5. The EPSS date in the record should be verified against the source before relying on it.

Frequently asked questions

Which versions of mcp-maigret are affected by CVE-2026-2130?

The record lists mcp-maigret versions up to and including 1.0.12 as affected.

What is the recommended fix?

The record and the project release reference indicate that upgrading to version 1.0.13 mitigates the issue. The patch commit b1ae073c4b3e789ab8de36dc6ca8111ae9399e7a is also referenced.

Is this vulnerability known to be actively exploited?

The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.