PT-2026-33431 · Unknown · Aap Mcp Server

Melissa Ing · Published 2026-04-17 · Updated 2026-04-17 · CVE-2026-6494

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions AAP MCP server (affected versions not specified)

Description An unauthenticated remote attacker can exploit a log injection flaw by sending specially crafted input to the toolsetroute parameter. This parameter is not properly sanitized before being written to logs, allowing the injection of control characters such as newlines and ANSI escape sequences. This capability enables an attacker to obscure legitimate log entries and insert forged ones, which could facilitate social engineering attacks, potentially leading an operator to execute dangerous commands or visit malicious URLs.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-117

Related Identifiers

CVE-2026-6494

Affected Products

Aap Mcp Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-6494 · Security Note
• https://access.redhat.com/security/cve/CVE-2026-6494 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2459131 · Note
• https://twitter.com/VulmonFeeds/status/2045112112821698602 · Twitter Post
• https://twitter.com/CVEnew/status/2045102593723035752 · Twitter Post