CVE-2026-7066

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-7066", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-04-26T07:14:50.991Z", "datePublished": "2026-04-26T23:15:12.946Z", "dateUpdated": "2026-04-27T16:04:55.804Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-26T23:15:12.946Z"}, "title": "choieastsea simple-openstack-mcp server.py exec_openstack os command injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-78", "lang": "en", "description": "OS Command Injection"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-77", "lang": "en", "description": "Command Injection"}]}], "affected": [{"vendor": "choieastsea", "product": "simple-openstack-mcp", "versions": [{"version": "767b2f4a8154cca344344b9725537a58399e6036", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in choieastsea simple-openstack-mcp up to 767b2f4a8154cca344344b9725537a58399e6036. The affected element is the function exec_openstack of the file server.py. The manipulation results in os command injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "HIGH"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "HIGH"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-04-26T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-04-26T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-04-26T09:20:12.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "MidA (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/359641", "name": "VDB-359641 | choieastsea simple-openstack-mcp server.py exec_openstack os command injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/359641/cti", "name": "VDB-359641 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/798622", "name": "Submit #798622 | choieastsea simple-openstack-mcp 767b2f4a8154cca344344b9725537a58399e6036 OS Command Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/choieastsea/simple-openstack-mcp/issues/3", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/choieastsea/simple-openstack-mcp/", "tags": ["product"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-27T16:04:23.030462Z", "id": "CVE-2026-7066", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T16:04:55.804Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-7066", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-27T16:04:23.030462Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T16:04:50.910Z"}}], "cna": {"title": "choieastsea simple-openstack-mcp server.py exec_openstack os command injection", "credits": [{"lang": "en", "type": "reporter", "value": "MidA (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "choieastsea", "product": "simple-openstack-mcp", "versions": [{"status": "affected", "version": "767b2f4a8154cca344344b9725537a58399e6036"}]}], "timeline": [{"lang": "en", "time": "2026-04-26T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-04-26T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-04-26T09:20:12.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/359641", "name": "VDB-359641 | choieastsea simple-openstack-mcp server.py exec_openstack os command injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/359641/cti", "name": "VDB-359641 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/798622", "name": "Submit #798622 | choieastsea simple-openstack-mcp 767b2f4a8154cca344344b9725537a58399e6036 OS Command Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/choieastsea/simple-openstack-mcp/issues/3", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/choieastsea/simple-openstack-mcp/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in choieastsea simple-openstack-mcp up to 767b2f4a8154cca344344b9725537a58399e6036. The affected element is the function exec_openstack of the file server.py. The manipulation results in os command injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "OS Command Injection"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "Command Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-26T23:15:12.946Z"}}}, "cveMetadata": {"cveId": "CVE-2026-7066", "state": "PUBLISHED", "dateUpdated": "2026-04-27T16:04:55.804Z", "dateReserved": "2026-04-26T07:14:50.991Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-04-26T23:15:12.946Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "simple-openstack-mcp", "vendor": "choieastsea", "versions": [{"status": "affected", "version": "767b2f4a8154cca344344b9725537a58399e6036"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was found in choieastsea simple-openstack-mcp up to 767b2f4a8154cca344344b9725537a58399e6036. The affected element is the function exec_openstack of the file server.py. The manipulation results in os command injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en choieastsea simple-openstack-mcp hasta 767b2f4a8154cca344344b9725537a58399e6036. El elemento afectado es la funci\u00f3n exec_openstack del archivo server.py. La manipulaci\u00f3n resulta en inyecci\u00f3n de comandos del sistema operativo. Es posible lanzar el ataque de forma remota. El exploit se ha hecho p\u00fablico y podr\u00eda usarse. Este producto adopta el enfoque de lanzamientos continuos para proporcionar entrega continua. Por lo tanto, los detalles de la versi\u00f3n para las versiones afectadas y actualizadas no est\u00e1n disponibles. Se inform\u00f3 al proyecto del problema tempranamente a trav\u00e9s de un informe de incidencias, pero a\u00fan no ha respondido."}], "id": "CVE-2026-7066", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7066", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-27T16:04:23.030462Z", "version": "2.0.3"}}]}, "published": "2026-04-27T00:16:20.693", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/choieastsea/simple-openstack-mcp/"}, {"source": "cna@vuldb.com", "url": "https://github.com/choieastsea/simple-openstack-mcp/issues/3"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/798622"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/359641"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/359641/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}, {"lang": "en", "value": "CWE-78"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "767b2f4a8154cca344344b9725537a58399e6036"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "simple-openstack-mcp", "source": "cna", "vendor": "choieastsea"}, "product": "simple-openstack-mcp", "vendor": "choieastsea"}], "analysis": {"en": {"generated_at": "2026-04-28T19:56:03.107893+00:00", "value": {"mitigation_remediation": ["Apply the latest repository commit after the issue is resolved or obtain a patched release from the vendor.", "Restrict or disable the exec_openstack endpoint, ensuring it is protected behind strict access controls and only accessible by trusted administrative users.", "Sanitize all user-supplied parameters before passing them to the OS command layer, using whitelists or safe execution libraries to eliminate injection vectors.", "If an immediate fix is unavailable, isolate the service from public networks or place a firewall rule to block external access to the vulnerable API endpoints."], "summary": {"action": "Assess Impact", "impact": "Remote Code Execution via OS command injection"}, "threat_synthesis": {"affected_systems": "The product impacted is choieastsea simple-openstack-mcp, any release built before the commit 767b2f4a8154cca344344b9725537a58399e6036 is vulnerable. Because the project uses rolling releases and does not publish definitive version numbers, all pending releases that incorporate code up to that commit are at risk.", "description_and_impact": "The vulnerability resides in the exec_openstack function of server.py and allows an attacker to inject arbitrary OS commands. This form of command injection directly leads to remote code execution, compromising confidentiality, integrity, and availability of the affected system. The weakness is classified as CWE-77 and CWE-78, representing command injection and OS command injection respectively.", "risk_and_exploitability": "With a CVSS score of 6.9, the vulnerability is considered medium severity. The EPSS score of 1% indicates that while exploitation is possible, it is not presently common, but the public nature of the exploit raises the likelihood of targeted attacks. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote access to the exposed exec_openstack endpoint, presumably through a management API exposed over HTTP, allowing the attacker to trigger arbitrary command execution. Discovery of this flaw has been reported publicly, making it actionable for adversaries."}}}}, "created": "2026-04-27T19:51:49.166139+00:00", "updated": "2026-04-28T20:00:19.891504+00:00", "vendors": ["choieastsea", "choieastsea$PRODUCT$simple-openstack-mcp"]}