CVE-2026-7066

choieastsea simple-openstack-mcp server.py exec_openstack os command injection

State: Published
Severity: 6.9 Medium
Published: Apr 26, 2026
Updated: Apr 27, 2026
Reserved: Apr 26, 2026

Description

A vulnerability was found in choieastsea simple-openstack-mcp up to 767b2f4a8154cca344344b9725537a58399e6036. The affected element is the function exec_openstack of the file server.py. The manipulation results in os command injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	7.3 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
3.0	7.3 High	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
2.0	7.5 High	AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-78 OS Command Injection
CWE-77 Command Injection

Affected Products

Product	Versions
simple-openstack-mcpchoieastsea	767b2f4a8154cca344344b9725537a58399e6036Affected

References

VDB-359641 | choieastsea simple-openstack-mcp server.py exec_openstack os command injectionvdb-entrytechnical-description
VDB-359641 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #798622 | choieastsea simple-openstack-mcp 767b2f4a8154cca344344b9725537a58399e6036 OS Command Injectionthird-party-advisory
https://github.com/choieastsea/simple-openstack-mcp/issues/3exploitissue-tracking
https://github.com/choieastsea/simple-openstack-mcp/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.