CVE-2026-19040

MediumCVSS 6.3

Published: 06/08/2026(UTC)Updated: 23/10/2026(UTC)Translated: 06/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.43%

36th percentile - higher than 36% of all known CVEs

Summary

A server-side request forgery (SSRF) vulnerability was found in MissionSquad mcp-api up to version 1.11.9 in an unknown function in src/services/dcrClients.ts. The attack may be performed remotely. Upgrading to version 1.11.10 fixes the issue.

Risk Assessment

A remote attacker could use the server to send requests to internal resources, potentially leading to disclosure of sensitive information or attacks on other systems.

Recommendation

Update to version 1.11.10 or later and restrict access to internal resources.

Other vulnerabilities in MissionSquad mcp-api

CVE-2026-19041Medium
A command injection vulnerability was found in MissionSquad mcp-api up to version 1.11.8 in the this.packageService.installPackage function in src/controllers/packages.ts, in the NPM Package Version Handler component. The attack can be initiated remotely. Upgrading to version 1.11.9 resolves the issue.

Original NVD description (English source)

A flaw has been found in MissionSquad mcp-api up to 1.11.9. The affected element is an unknown function of the file src/services/dcrClients.ts. Executing a manipulation can lead to server-side request forgery. The attack may be performed from remote. Upgrading to version 1.11.10 is sufficient to fix this issue. This patch is called f068ab4ad6f0907ac7001b995588c2673f11a755. You should upgrade the affected component.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS