{
  "entry": {
    "kind": "vuln",
    "slug": "cve-2026-114090",
    "name": "CVE-2026-114090",
    "vendor": "obsidian-tc",
    "description": "Several MCP server CVEs published 21 to 23 October 2026 affect servers developers run locally. CVE-2026-114090 (CVSS 7.6): `trigger dev --mcp` in Trigger.dev cli-v3 3.0.0 to before 4.5.4 bound its MCP server to all network interfaces and exposed /sse and /messages without authentication, so anyone on the LAN, or a malicious web page, could call trigger-task, cancel-run, list-runs and get-run-logs with the developer's stored Trigger.dev access token; fixed in 4.5.4. obsidian-tc, an MCP server for Obsidian vaults, published two advisories on 23 October: CVE-2026-115477 (CVSS 7.1), where a destructive tool call over Streamable HTTP still completed after the human declined or cancelled the confirmation, because the server took the echoed request state as proof of approval, and CVE-2026-115478, where memory tools overwrote hand-written notes sitting at the same path; both are fixed in 1.31.4. NVD also published CVE-2026-106765 (@rog0x/mcp-docker-tools 1.0.1, handleImageList), CVE-2026-106764 (@rog0x/mcp-git-tools 1.0.1, resolveBaseBranch) and CVE-2026-106763 (@justice8096/sagemath-mcp-server 1.0.1, escapeShellString and sanitizeCode), each described as allowing arbitrary code execution, with no fixed version published.",
    "website": "https://nvd.nist.gov/vuln/detail/CVE-2026-114090",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": {
      "manager": "npm",
      "packageName": "obsidian-tc",
      "command": null
    },
    "configFiles": null,
    "category": "mcp-server",
    "updatedAt": "2026-10-23",
    "risk": {
      "score": 76,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "CVE-2026-114090",
      "aliases": [
        "ti-154"
      ],
      "title": "MCP Servers on Developer Machines: Trigger.dev's Dev MCP Server Listened on All Interfaces With No Auth (CVE-2026-114090), obsidian-tc Ran Destructive Tools After the Human Said No, and Three Unpatched npm MCP Servers Allow Code Execution",
      "summary": "Several MCP server CVEs published 21 to 23 October 2026 affect servers developers run locally. CVE-2026-114090 (CVSS 7.6): `trigger dev --mcp` in Trigger.dev cli-v3 3.0.0 to before 4.5.4 bound its MCP server to all network interfaces and exposed /sse and /messages without authentication, so anyone on the LAN, or a malicious web page, could call trigger-task, cancel-run, list-runs and get-run-logs with the developer's stored Trigger.dev access token; fixed in 4.5.4. obsidian-tc, an MCP server for Obsidian vaults, published two advisories on 23 October: CVE-2026-115477 (CVSS 7.1), where a destructive tool call over Streamable HTTP still completed after the human declined or cancelled the confirmation, because the server took the echoed request state as proof of approval, and CVE-2026-115478, where memory tools overwrote hand-written notes sitting at the same path; both are fixed in 1.31.4. NVD also published CVE-2026-106765 (@rog0x/mcp-docker-tools 1.0.1, handleImageList), CVE-2026-106764 (@rog0x/mcp-git-tools 1.0.1, resolveBaseBranch) and CVE-2026-106763 (@justice8096/sagemath-mcp-server 1.0.1, escapeShellString and sanitizeCode), each described as allowing arbitrary code execution, with no fixed version published.",
      "severity": "high",
      "cvss": {
        "score": 7.6,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Remote code execution",
        "Authentication bypass"
      ],
      "componentType": "mcp-server",
      "component": {
        "name": "obsidian-tc",
        "vendor": null,
        "package": "obsidian-tc",
        "ecosystem": "npm",
        "catalogSlug": null
      },
      "affected": [
        {
          "range": ">=1.0.1 <1.31.4",
          "fixed": "1.31.4"
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-10-23",
      "modifiedAt": "2026-10-23",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "cve",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114090"
        }
      ],
      "mitigation": "Upgrade the Trigger.dev CLI to 4.5.4 or later and rotate the Trigger.dev access token on machines that ran trigger dev --mcp on an untrusted network. Upgrade obsidian-tc to 1.31.4 or later and back up any vault it can write. Remove @rog0x/mcp-docker-tools, @rog0x/mcp-git-tools and @justice8096/sagemath-mcp-server from MCP client configs. In general, run local MCP servers over stdio where the client supports it; when HTTP is needed, bind to 127.0.0.1, require a token and check the Origin header.",
      "detectedByAnomity": true
    }
  }
}