A vulnerability classified as problematic has been found in tufantunc ssh-mcp up to 1.5.0. Impacted is an unknown function of the file src/index.ts of the component Command Line Handler. This manipulation causes insufficiently protected credentials.
This vulnerability is tracked as CVE-2026-7038. The attack is restricted to local execution. Moreover, an exploit is present.
The project was informed of the problem early through an issue report but has not responded yet.
