{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0422",
  "aliases": [],
  "modified": "2026-09-20T00:00:00Z",
  "summary": "Internet scanning targets agent config files and MCP endpoints",
  "details": "## What\n\nSANS ISC documented internet reconnaissance for .claude, .cursor, .vscode/mcp.json, .mcp/config.json, and MCP endpoint paths. The observed request volume is active reconnaissance, not proof that a target was compromised. The row captures a reachable remote MCP configuration as a static exposure condition.\n\n## Which configuration is exposed\n\nA local setup is exposed when an MCP server URL host is non-loopback or agent configuration files are served from a web root. The matcher covers the MCP half because lock discovery cannot see arbitrary web roots; operators must separately remove credential files from published content.\n\n## How ACVE detects it\n\nACVE checks one mcpServers element for a present host that is not localhost, 127.0.0.1, or ::1. It does not make network requests or prove that a web server exposed the file. Missing host data is possible.\n\n## Fix\n\nRemove credentials and configuration files from web roots, rotate any tokens that were reachable, bind MCP services privately, and require authentication for intentional remote transport. Review access logs for the paths named by SANS.\n\n## Grounding needed\n\nThe SANS diary should be checked for the 14-day observation window, request paths, and source-IP count. Recon evidence supports weaponised intent but not a confirmed victim.\n\nThis record is limited to the condition named in the public source: Internet scanning targets agent config files and MCP endpoints. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.",
  "affected": [
    {
      "package": {
        "ecosystem": "AgentHarness",
        "name": "agent-web-surface"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "HIGH",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "code",
      "vulnClasses": [
        "exposed-surface",
        "credential-theft"
      ],
      "cwe": [
        "CWE-522"
      ],
      "exploitation": {
        "status": "weaponised-poc",
        "checkedAt": "2026-09-20T00:00:00Z",
        "sources": [
          {
            "url": "https://isc.sans.edu/diary/33150",
            "type": "dfir"
          }
        ],
        "kev": {
          "listed": false
        },
        "first_seen": "2026-07-13",
        "last_seen": "2026-07-13",
        "victims": {
          "range": "one small host observed approximately 200 recon requests in 14 days",
          "sectors": [
            "technology"
          ],
          "evidence": "SANS ISC recorded config-file requests and MCP handshakes from 49 source IPs."
        },
        "attribution": "unattributed"
      },
      "cveBoundary": "exposed-surface",
      "matcher": {
        "some": "mcpServers",
        "where": {
          "all": [
            {
              "field": "urlHost",
              "op": "exists"
            },
            {
              "field": "urlHost",
              "op": "neq",
              "value": "localhost"
            },
            {
              "field": "urlHost",
              "op": "neq",
              "value": "127.0.0.1"
            },
            {
              "field": "urlHost",
              "op": "neq",
              "value": "::1"
            }
          ]
        }
      },
      "fix": {
        "summary": "Remove agent credentials from web roots and restrict MCP endpoints.",
        "actions": [
          {
            "type": "remove",
            "target": "web roots containing .claude or .mcp files"
          },
          {
            "type": "reconfigure",
            "target": "mcpServers.urlHost",
            "to": "loopback or authenticated",
            "why": "Close remote discovery paths."
          }
        ]
      },
      "noCveReason": "No CVE assigned; this record describes a configuration or supply-chain condition.",
      "grounding": {
        "itw": {
          "checkedAt": "2026-09-20T16:17:50Z",
          "sources": [
            {
              "url": "https://isc.sans.edu/diary/33150",
              "status": 200,
              "contentType": "text/html; charset=UTF-8",
              "sha256": "sha256:36256926e6ec191df484094037f6fb453f3557b9b9c4943e36efdeb75ede37ab",
              "type": "dfir"
            }
          ],
          "kev": {
            "listed": false
          }
        }
      }
    }
  }
}