Medium severity · published Aug 6, 2026
CVE-2026-19040
MissionSquad mcp-api dcrClients.ts server-side request forgery
6.3
CVSS
0.3%
EPSS
No
On KEV
Description
A flaw has been found in MissionSquad mcp-api up to 1.11.9. The affected element is an unknown function of the file src/services/dcrClients.ts. Executing a manipulation can lead to server-side request forgery. The attack may be performed from remote. Upgrading to version 1.11.10 is sufficient to fix this issue. This patch is called f068ab4ad6f0907ac7001b995588c2673f11a755. You should upgrade the affected component.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MC
mcp-api · MissionSquad
1.11.0; 1.11.1; 1.11.2; 1.11.3; 1.11.4; 1.11.5; +4 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-19040
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-19040
github.com
https://github.com/MissionSquad/mcp-api/
github.com
https://github.com/MissionSquad/mcp-api/commit/f068ab4ad6f0907ac7001b995588c2673f11a755
github.com
https://github.com/MissionSquad/mcp-api/issues/42
github.com
https://github.com/MissionSquad/mcp-api/pull/45
github.com
https://github.com/MissionSquad/mcp-api/releases/tag/v1.11.10
vuldb.com
https://vuldb.com/cve/CVE-2026-19040
More from mcp-api
6.3
CVE-2026-19041
MissionSquad mcp-api NPM Package Version packages.ts this.packageService.installPackage command injection