{"schema":"vulnpedia.research/1","cve":"CVE-2026-108586","generated":"2026-10-26T13:52:32.101Z","references":[{"url":"https://hackmd.io/@haind/1mcp-negated-tag-filter-oauth-scope-bypass","tags":["third-party-advisory"],"source":"mitre","sourceId":"VulnCheck","modified":"2026-10-10T16:14:10.297Z","origins":[{"source":"mitre","sourceId":"VulnCheck","modified":"2026-10-10T16:14:10.297Z","url":"https://hackmd.io/@haind/1mcp-negated-tag-filter-oauth-scope-bypass"},{"source":"nvd","sourceId":"CVE-2026-108586","modified":"2026-10-16T19:21:14.417","url":"https://hackmd.io/@haind/1mcp-negated-tag-filter-oauth-scope-bypass"}]},{"url":"https://github.com/1mcp-app/agent/blob/v0.39.0/src/sdk/legacy/transport/http/middlewares/scopeAuthMiddleware.ts#L163-L183","tags":["technical-description"],"source":"mitre","sourceId":"VulnCheck","modified":"2026-10-10T16:14:10.297Z","origins":[{"source":"mitre","sourceId":"VulnCheck","modified":"2026-10-10T16:14:10.297Z","url":"https://github.com/1mcp-app/agent/blob/v0.39.0/src/sdk/legacy/transport/http/middlewares/scopeAuthMiddleware.ts#L163-L183"},{"source":"nvd","sourceId":"CVE-2026-108586","modified":"2026-10-16T19:21:14.417","url":"https://github.com/1mcp-app/agent/blob/v0.39.0/src/sdk/legacy/transport/http/middlewares/scopeAuthMiddleware.ts#L163-L183"}]},{"url":"https://github.com/1mcp-app/agent/blob/v0.39.0/src/transport/http/routes/inspectHelpers.ts#L79-L102","tags":["technical-description"],"source":"mitre","sourceId":"VulnCheck","modified":"2026-10-10T16:14:10.297Z","origins":[{"source":"mitre","sourceId":"VulnCheck","modified":"2026-10-10T16:14:10.297Z","url":"https://github.com/1mcp-app/agent/blob/v0.39.0/src/transport/http/routes/inspectHelpers.ts#L79-L102"},{"source":"nvd","sourceId":"CVE-2026-108586","modified":"2026-10-16T19:21:14.417","url":"https://github.com/1mcp-app/agent/blob/v0.39.0/src/transport/http/routes/inspectHelpers.ts#L79-L102"}]},{"url":"https://github.com/1mcp-app/agent","tags":["product"],"source":"mitre","sourceId":"VulnCheck","modified":"2026-10-10T16:14:10.297Z","origins":[{"source":"mitre","sourceId":"VulnCheck","modified":"2026-10-10T16:14:10.297Z","url":"https://github.com/1mcp-app/agent"},{"source":"nvd","sourceId":"CVE-2026-108586","modified":"2026-10-16T19:21:14.417","url":"https://github.com/1mcp-app/agent"}]},{"url":"https://www.vulncheck.com/advisories/1mcp-agent-0.20.0-through-0.39.0-oauth-tag-scope-bypass-via-negated-tag-filter","tags":["third-party-advisory"],"source":"mitre","sourceId":"VulnCheck","modified":"2026-10-10T16:14:10.297Z","origins":[{"source":"mitre","sourceId":"VulnCheck","modified":"2026-10-10T16:14:10.297Z","url":"https://www.vulncheck.com/advisories/1mcp-agent-0.20.0-through-0.39.0-oauth-tag-scope-bypass-via-negated-tag-filter"},{"source":"nvd","sourceId":"CVE-2026-108586","modified":"2026-10-16T19:21:14.417","url":"https://www.vulncheck.com/advisories/1mcp-agent-0.20.0-through-0.39.0-oauth-tag-scope-bypass-via-negated-tag-filter"}]},{"source":"euvd","sourceId":"EUVD-2026-96373","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-96373","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-96373","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-96373"}]}],"packages":[],"pocCandidates":[],"cataloguedPoc":[],"vendorStatements":[]}