Vulnerability · Published May 1, 2026 · Assigned by VulDB

CVE-2026-7591TimBroddin astro-mcp-server MCP Tool Query Construction index.ts sql injection

Medium 6.3

In plain English

A medium-severity SQL injection in astro-mcp-server from TimBroddin. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.2%top 90.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A security flaw has been discovered in TimBroddin astro-mcp-server up to 1.1.1. The impacted element is an unknown function of the file src/index.ts of the component MCP Tool Query Construction. Performing a manipulation of the argument request.params.arguments results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Affected products (as reported)

Vendor	Product	Versions
TimBroddin	astro-mcp-server	1.1.01.1.1

Weakness: CWE-89, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-360544 | TimBroddin astro-mcp-server MCP Tool Query Construction index.ts sql injection vdb-entry, technical-description
VDB-360544 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #804450 | TimBroddin astro-mcp-server 1.1.1 SQL Injection third-party-advisory
https://github.com/TimBroddin/astro-mcp-server/issues/2 exploit, issue-tracking
https://github.com/TimBroddin/astro-mcp-server/ product