{"data":{"id":"3daefed1-188d-43da-873c-7ed0541ffdcc","title":"CVE-2026-55156: Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge…","summary":"Token Optimizer MCP versions before 5.1.0 run a dashboard HTTP server whose /api/session-summary and /api/session-events endpoints have no authentication middleware. Both handlers join the caller-supplied sessionId query parameter into a filesystem path with path.join, and Node.js normalizes .. segments, so an unauthenticated network client can read any .jsonl file the server can access.","solution":"This issue has been patched in version 5.1.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55156","publishedAt":"2026-09-28T18:17:23.203Z","cveId":"CVE-2026-55156","cweIds":["CWE-22"],"cvssScore":"5.3","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["@ooples/token-optimizer-mcp@< 5.1.0 (fixed: 5.1.0)"],"affectedPackageNames":["@ooples/token-optimizer-mcp"],"affectedVendors":[],"affectedVendorsRaw":["Token Optimizer MCP"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Token Optimizer MCP dashboard path traversal via sessionId in session endpoints","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00446,"epssCheckedAt":"2026-10-10T03:00:40.088Z","kevDateAdded":null,"advisoryAliases":["GHSA-76pc-mqxp-3rq5"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:43:10.045Z","patchAvailable":true,"disclosureDate":"2026-09-28T18:17:23.203Z","capecIds":["CAPEC-126"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}