Advisories · Technology

1mcp-app @1mcp/agent.

Every CVE that names 1mcp-app @1mcp/agent among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-108586 CVE record

CVSS 5.3 Medium

1MCP Agent 0.20.0 through 0.39.0 OAuth Tag-Scope Bypass via Negated Tag Filter
- 1mcp-app @1mcp/agent
- Broken access control
Not analysed yet 10 Oct 2026