{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0010",
  "aliases": [],
  "published": "2026-09-19T00:00:00Z",
  "modified": "2026-09-19T00:00:00Z",
  "summary": "HTTP MCP servers and permissive modes form an over-privileged combination",
  "details": "## What the vulnerability is\n\nAn HTTP or SSE MCP server outside loopback combined with automatic tool permissions creates an over-privileged trust boundary. A remote or otherwise non-local server can supply tool interactions while the harness is configured not to require the normal approval step. This ACVE-native advisory describes the combination itself; it does not claim that every server using it is malicious.\n\n## Which configuration is exposed\n\nThe matcher requires `permissionMode` to be `auto` or `bypassPermissions`, and at least one `mcpServers` entry whose `transport` is `http` or `sse`. For that same entry, `urlHost` must not match `localhost`, `127.x.x.x`, `0.0.0.0`, or `[::1]`, with an optional port. These are the exact encoded conditions: non-loopback host, network transport, and permissive mode.\n\n## How ACVE detects it\n\nACVE reads `permissionMode`, `mcpServers[].transport`, and `mcpServers[].urlHost`. It cannot validate DNS resolution, proxy behavior, authentication, server ownership, tool capabilities, or whether a user would have approved a request. A host not matching the loopback expression is treated as non-loopback by the matcher, so unusual local aliases may produce a finding that needs review.\n\n## Fix\n\n1. Change the permission mode to `default` or another approval-required mode.\n2. Restrict MCP servers to an explicit allowlist and bind local-only services to loopback.\n3. Rebuild the lockfile and confirm both the effective permission mode and each server host.\n\nThe matcher is intentionally conservative about host classification: anything outside its explicit loopback expression requires an operator decision.\n\nThe recommended controls reduce both sides of the combination: approval limits execution, while host restrictions limit who can supply MCP traffic.\n\n## References\n\nSee `references` for primary sources.",
  "affected": [
    {
      "package": {
        "ecosystem": "AgentHarness",
        "name": "any"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://example.com/research/acve"
    },
    {
      "type": "REPORT",
      "url": "https://example.com/research/acve"
    }
  ],
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "5"
    }
  ],
  "database_specific": {
    "severity": "HIGH",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "taxonomy": {
        "owasp_asi": [
          "ASI01"
        ],
        "atlas": [
          "AML.T0051"
        ]
      },
      "exploitation": {
        "vector": "malicious project or server configuration",
        "userInteraction": "required",
        "kev": false
      },
      "exposure": "local",
      "vulnClasses": [
        "over-privileged-combination"
      ],
      "cwe": [
        "CWE-250"
      ],
      "matcher": {
        "all": [
          {
            "field": "permissionMode",
            "op": "in",
            "value": [
              "auto",
              "bypassPermissions"
            ]
          },
          {
            "some": "mcpServers",
            "where": {
              "all": [
                {
                  "field": "transport",
                  "op": "in",
                  "value": [
                    "http",
                    "sse"
                  ]
                },
                {
                  "not": {
                    "field": "urlHost",
                    "op": "regex",
                    "value": "^(localhost|127\\.\\d+\\.\\d+\\.\\d+|\\[::1\\]|0\\.0\\.0\\.0)(:\\d+)?$"
                  }
                }
              ]
            }
          }
        ]
      },
      "fix": {
        "summary": "Require approval and restrict MCP hosts to an explicit allowlist.",
        "actions": [
          {
            "type": "reconfigure",
            "target": "agent.permissionMode",
            "to": "default",
            "why": "Prevent network MCP tools from running without approval."
          },
          {
            "type": "reconfigure",
            "target": "settings:any:mcpServers.urlHost",
            "to": "loopback-or-allowlist",
            "why": "Limit network MCP connections to explicitly trusted hosts."
          }
        ]
      },
      "noCveReason": "ACVE-native configuration weakness; no CVE assigned.",
      "grounding": {
        "osv": {
          "checkedAt": "2026-09-20T02:43:30Z",
          "found": false,
          "aliasesConfirmed": [],
          "packagesConfirmed": [],
          "fixedVersionsConfirmed": [],
          "cvss": []
        },
        "nvd": {
          "checkedAt": "2026-09-20T02:43:30Z",
          "found": false,
          "cvss": null,
          "published": null
        },
        "kev": {
          "checkedAt": "2026-09-20T02:43:30Z",
          "listed": false
        },
        "registry": {
          "checkedAt": "2026-09-20T02:43:30Z",
          "confirmed": [],
          "missing": []
        }
      }
    }
  }
}