{"id":"CVE-2026-108586","summary":"1MCP Agent 0.20.0 through 0.39.0 OAuth Tag-Scope Bypass via Negated Tag Filter","details":"1MCP Agent (@1mcp/agent) 0.20.0 through 0.39.0 contains an incorrect authorization vulnerability that allows authenticated clients to bypass OAuth tag-scope enforcement using negated advanced tag-filter expressions. Attackers holding a single-tag token can send a filter like not \u003cgranted-tag\u003e to list and invoke tools on backend MCP servers outside their granted scopes.","modified":"2026-10-15T02:30:38.889718472Z","published":"2026-10-10T16:14:10.297Z","database_specific":{"cwe_ids":["CWE-863"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108586.json","cna_assigner":"VulnCheck"},"references":[{"type":"WEB","url":"https://www.npmjs.com/package/@1mcp/agent"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108586.json"},{"type":"ADVISORY","url":"https://hackmd.io/@haind/1mcp-negated-tag-filter-oauth-scope-bypass"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108586"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/1mcp-agent-0.20.0-through-0.39.0-oauth-tag-scope-bypass-via-negated-tag-filter"},{"type":"PACKAGE","url":"https://github.com/1mcp-app/agent"},{"type":"ARTICLE","url":"https://github.com/1mcp-app/agent/blob/v0.39.0/src/sdk/legacy/transport/http/middlewares/scopeAuthMiddleware.ts#L163-L183"},{"type":"ARTICLE","url":"https://github.com/1mcp-app/agent/blob/v0.39.0/src/transport/http/routes/inspectHelpers.ts#L79-L102"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/1mcp-app/agent","events":[{"introduced":"e9cb1e643454bc6785aa88c256a7f01803b2506a"},{"fixed":"93cc6b27d7b31ebd7b40fddd1c4c3436bc5a71cf"}],"database_specific":{"extracted_events":[{"introduced":"0.20.0"},{"last_affected":"0.39.0"},{"fixed":"0.39.0"}],"source":["AFFECTED_FIELD","DESCRIPTION"]}}],"versions":["v0.38.0","v0.38.2","v0.39.0-beta.5","v0.39.0-beta.4","v0.39.0-beta.3","v0.39.0-beta.2","v0.39.0-beta.1","v0.39.0-beta.0","v0.38.1","v0.37.0","v0.36.0","v0.35.0","v0.35.0-beta.4","v0.35.0-beta.3","v0.35.0-beta.2","v0.35.0-beta.1","v0.34.4","v0.34.3","v0.34.2","v0.34.1","v0.34.0","v0.33.0","v0.33.0-beta3","v0.33.0-beta2","v0.33.0-beta1","v0.32.2","v0.32.1","v0.32.0","v0.32.0-beta1","v0.31.0","v0.31.0-beta3","v0.31.0-beta2","v0.31.0-beta1","v0.30.3","v0.30.2","v0.30.1","v0.30.0","v0.30.0-beta1","v0.29.2","v0.29.1","v0.29.0","v0.29.0-beta7","v0.29.0-beta6","v0.29.0-beta5","v0.29.0-beta4","v0.29.0-beta3","v0.29.0-beta2","v0.29.0-beta1","v0.28.1","v0.28.0","v0.27.4","v0.27.3","v0.27.2","v0.27.1","v0.27.0","v0.26.1","v0.26.0","v0.25.5","v0.25.4","v0.25.3","v0.25.2","v0.25.1","v0.25.0","v0.24.0","v0.23.2","v0.23.1","v0.23.0","v0.22.3","v0.22.2","v0.22.1","v0.22.0","v0.21.0","v0.20.3","v0.20.2","v0.20.1","v0.20.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108586.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}]}