Command Injection Vulnerability in Kino-Kafkaesque SSH Command Handler

CVE-2026-19039

What is CVE-2026-19039?

A command injection vulnerability has been identified in the ssh_exec function of the SSH Command Handler component within the Kino-Kafkaesque ssh-mcp-server. This issue arises from improper handling of user input in the host/username arguments, allowing local attackers to execute arbitrary commands. The attack necessitates local access to the server, aligning with the project's intended use as a trusted tool for executing commands over SSH. However, the availability of the vulnerability remains uncertain. As this product follows a rolling release strategy, specific version details for affected updates may not be provided.

References