CVEvulnerability

CVE-2026-59563

4.6 MEDIUM Published 2026-09-28 Modified 2026-09-28 Official page ↗
Status
Awaiting Analysis
Published
2026-09-28
Last modified
2026-09-28
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.6 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
Weaknesses
CWE-305

Description

Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation tokens were not bound to the target resource identifier, allowing an MCP client or agent to replay a token generated for one resource to affect another resource of the same type. This issue is fixed in version 0.7.2.

Related

Weakness · CWE (1)

  • CWE-305 Authentication Bypass by Primary Weakness weakness

References