Improper Allowlist Validation in Vorota-ai nmap-mcp Tool

CVE-2026-117570

What is CVE-2026-117570?

The Vorota-ai nmap-mcp tool includes a vulnerability in the scan_vulnerabilities feature due to improper allowlist validation. This flaw allows users to bypass security measures, enabling the execution of potentially harmful NSE script categories such as exploit, denial of service, brute-force, and intrusive scripts against targeted systems. Clients utilizing MCP or agents with prompt injection capabilities can exploit this weakness, posing significant risks to the integrity of network security. Remediation steps should focus on correcting the allowlist validation process to prevent unauthorized script execution.

References