ACVE-2026-0010

The configuration

Configuration label

permissionMode auto|bypassPermissions + transport http|sse

Affected entries

• AgentHarness: any — SEMVER (introduced 0)

Matcher

• all
  • permissionMode in [ "auto", "bypassPermissions" ]
  • some mcpServers
    • all
      • transport in [ "http", "sse" ]
      • not
        • urlHost regex "^(localhost|127\\.\\d+\\.\\d+\\.\\d+|\\[::1\\]|0\\.0\\.0\\.0)(:\\d+)?$"

Why it is exploitable

What the vulnerability is

An HTTP or SSE MCP server outside loopback combined with automatic tool permissions creates an over-privileged trust boundary. A remote or otherwise non-local server can supply tool interactions while the harness is configured not to require the normal approval step. This ACVE-native advisory describes the combination itself; it does not claim that every server using it is malicious.

Which configuration is exposed

The matcher requires permissionMode to be auto or bypassPermissions, and at least one mcpServers entry whose transport is http or sse. For that same entry, urlHost must not match localhost, 127.x.x.x, 0.0.0.0, or [::1], with an optional port. These are the exact encoded conditions: non-loopback host, network transport, and permissive mode.

How ACVE detects it

ACVE reads permissionMode, mcpServers[].transport, and mcpServers[].urlHost. It cannot validate DNS resolution, proxy behavior, authentication, server ownership, tool capabilities, or whether a user would have approved a request. A host not matching the loopback expression is treated as non-loopback by the matcher, so unusual local aliases may produce a finding that needs review.

Fix

1. Change the permission mode to default or another approval-required mode.
2. Restrict MCP servers to an explicit allowlist and bind local-only services to loopback.
3. Rebuild the lockfile and confirm both the effective permission mode and each server host.

The matcher is intentionally conservative about host classification: anything outside its explicit loopback expression requires an operator decision.

The recommended controls reduce both sides of the combination: approval limits execution, while host restrictions limit who can supply MCP traffic.

References

See references for primary sources.

Underlying CVEs / aliases

No CVE assigned. ACVE-native configuration weakness; no CVE assigned.

Detect

npx @pickbitsai/acve audit

For CI, emit SARIF with npx @pickbitsai/acve audit --format sarif --out acve.sarif --apply and upload it with GitHub code scanning.

Fix

Require approval and restrict MCP hosts to an explicit allowlist.

Validation

No validation entries recorded.

Grounding

• OSV: not found; checked-at 2026-09-20T02:43:30Z
• NVD: not found; checked-at 2026-09-20T02:43:30Z
• KEV: not listed in KEV; checked-at 2026-09-20T02:43:30Z

References

ADVISORY

• https://example.com/research/acve

REPORT

• https://example.com/research/acve