MediumVulnerability
CVE-2026-19268: abdullah1854 MCPGateway command injection through Claude Usage Range Endpoint
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-19268
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 1.8%
Summary
A command injection vulnerability exists in abdullah1854 MCPGateway up to commit 549f494a9e363f40530149de324b8097de424230. The flaw sits in the getUsageByDateRange function of src/services/claude-usage.ts, reached through the since argument of the Claude Usage Range Endpoint. A remote attacker can trigger it, and a public exploit is available.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Related items
- HighCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0…Similar attack · NVD/CVE Database
- HighGHSA-vvr2-h2jp-838m: Code Graph RAG: MCP paginated read_file path traversal / arbitrary file readSimilar attack · GitHub Advisory Database
- MediumAttackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on LinuxSimilar attack · Dark Reading
- MediumCVE-2026-124588: huggingface finetrainers code injection via Library argumentSimilar attack · NVD/CVE Database
- MediumTaiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch RecordsSimilar attack · The Hacker News