CVE-2026-100868 (GCVE-0-2026-100868)
Vulnerability from cvelistv5
Published
2026-09-27 13:09
Modified
2026-10-08 15:22
Severity ?
5.3 (Medium) - CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
6.3 (Medium) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
6.3 (Medium) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
VLAI Severity ?
EPSS score ?
CWE
- CWE-1327 - Binding to an Unrestricted IP Address
Summary
Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networks can connect to the WebSocket port to impersonate the Penpot browser plugin, intercept task payloads, and return forged results to the MCP client.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| penpot | penpot |
Version: 0 ≤ |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-100868",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-28T15:39:30.501039Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T15:40:09.957Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-ch2q-6x56-qg5r"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/%40penpot/mcp",
"product": "penpot",
"vendor": "penpot",
"versions": [
{
"lessThan": "2.18.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://www.npmjs.com",
"defaultStatus": "unaffected",
"packageName": "@penpot/mcp",
"packageURL": "pkg:npm/%40penpot/mcp",
"product": "@penpot/mcp",
"vendor": "penpot",
"versions": [
{
"lessThanOrEqual": "2.15.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:kaleidos:penpot:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.18.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-09-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networks can connect to the WebSocket port to impersonate the Penpot browser plugin, intercept task payloads, and return forged results to the MCP client."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1327",
"description": "Binding to an Unrestricted IP Address",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T15:22:06.862Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-ch2q-6x56-qg5r)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-ch2q-6x56-qg5r"
},
{
"tags": [
"patch"
],
"url": "https://github.com/penpot/penpot/commit/b5274a44766d095247037be18c1d1918ac67ddeb"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/penpot/penpot/blob/1d2c37e52c733f74017d90b0fd1ae2d074a5c33d/mcp/packages/server/src/PluginBridge.ts#L52"
},
{
"name": "GitHub Security Advisory (GHSA-22qr-rp27-j9wm)",
"tags": [
"related",
"vendor-advisory"
],
"url": "https://github.com/penpot/penpot/security/advisories/GHSA-22qr-rp27-j9wm"
},
{
"tags": [
"product"
],
"url": "https://github.com/penpot/penpot"
},
{
"name": "VulnCheck Advisory: Penpot before 2.18.0 Unauthenticated WebSocket Access via MCP Bridge",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/penpot-before-2.18.0-unauthenticated-websocket-access-via-mcp-bridge"
}
],
"title": "Penpot before 2.18.0 Unauthenticated WebSocket Access via MCP Bridge",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-100868",
"datePublished": "2026-09-27T13:09:53.387Z",
"dateReserved": "2026-09-27T00:20:54.407Z",
"dateUpdated": "2026-10-08T15:22:06.862Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-100868\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-28T15:39:30.501039Z\"}}}], \"references\": [{\"url\": \"https://github.com/penpot/penpot/security/advisories/GHSA-ch2q-6x56-qg5r\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-28T15:39:54.870Z\"}}], \"cna\": {\"title\": \"Penpot before 2.18.0 Unauthenticated WebSocket Access via MCP Bridge\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"George Chen\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 5.3, \"attackVector\": \"ADJACENT\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"LOW\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"LOW\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"LOW\"}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.3, \"attackVector\": \"ADJACENT_NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"penpot\", \"product\": \"penpot\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"2.18.0\", \"versionType\": \"semver\"}], \"packageURL\": \"pkg:npm/%40penpot/mcp\", \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"penpot\", \"product\": \"@penpot/mcp\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"2.15.4\"}], \"packageURL\": \"pkg:npm/%40penpot/mcp\", \"packageName\": \"@penpot/mcp\", \"collectionURL\": \"https://www.npmjs.com\", \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2026-09-22T00:00:00.000Z\", \"references\": [{\"url\": \"https://github.com/penpot/penpot/security/advisories/GHSA-ch2q-6x56-qg5r\", \"name\": \"GitHub Security Advisory (GHSA-ch2q-6x56-qg5r)\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://github.com/penpot/penpot/commit/b5274a44766d095247037be18c1d1918ac67ddeb\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/penpot/penpot/blob/1d2c37e52c733f74017d90b0fd1ae2d074a5c33d/mcp/packages/server/src/PluginBridge.ts#L52\", \"tags\": [\"technical-description\"]}, {\"url\": \"https://github.com/penpot/penpot/security/advisories/GHSA-22qr-rp27-j9wm\", \"name\": \"GitHub Security Advisory (GHSA-22qr-rp27-j9wm)\", \"tags\": [\"related\", \"vendor-advisory\"]}, {\"url\": \"https://github.com/penpot/penpot\", \"tags\": [\"product\"]}, {\"url\": \"https://www.vulncheck.com/advisories/penpot-before-2.18.0-unauthenticated-websocket-access-via-mcp-bridge\", \"name\": \"VulnCheck Advisory: Penpot before 2.18.0 Unauthenticated WebSocket Access via MCP Bridge\", \"tags\": [\"third-party-advisory\"]}], \"x_generator\": {\"engine\": \"vulncheck-endgame\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networks can connect to the WebSocket port to impersonate the Penpot browser plugin, intercept task payloads, and return forged results to the MCP client.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-1327\", \"description\": \"Binding to an Unrestricted IP Address\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:kaleidos:penpot:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"2.18.0\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"83251b91-4cc7-4094-a5c7-464a1b83ea10\", \"shortName\": \"VulnCheck\", \"dateUpdated\": \"2026-10-08T15:22:06.862Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-100868\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-08T15:22:06.862Z\", \"dateReserved\": \"2026-09-27T00:20:54.407Z\", \"assignerOrgId\": \"83251b91-4cc7-4094-a5c7-464a1b83ea10\", \"datePublished\": \"2026-09-27T13:09:53.387Z\", \"assignerShortName\": \"VulnCheck\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…