PT-2026-35516 · Dexhunter · Kaggle-Mcp

Mida · Published 2026-04-27 · Updated 2026-04-28 · CVE-2026-7149

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions dexhunter kaggle-mcp versions prior to 406127ffcb2b91b8c10e20e6c2ca787fbc1dc92d

Description A path traversal issue exists in the prepare kaggle dataset() function within the src/kaggle mcp/server.py file. This flaw allows a remote attacker to perform path traversal by manipulating the competition id argument. Path traversal is a technique that allows an attacker to access files and directories that are stored outside the web root folder by manipulating variables that reference files with dot-dot-slash (../) sequences.

Recommendations Update dexhunter kaggle-mcp to a version later than 406127ffcb2b91b8c10e20e6c2ca787fbc1dc92d. As a temporary workaround, restrict or validate the input provided to the competition id argument in the prepare kaggle dataset() function to prevent the use of path traversal sequences.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-7149

GHSA-Q882-JC55-6343

Affected Products

Kaggle-Mcp

References · 10

• 🔥 https://github.com/dexhunter/kaggle-mcp/issues/1 · Exploit
• https://osv.dev/vulnerability/GHSA-q882-jc55-6343 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-7149 · Security Note
• https://vuldb.com/vuln/359748 · Note
• https://vuldb.com/submit/802052 · Note
• https://vuldb.com/vuln/359748/cti · Note
• https://github.com/dexhunter/kaggle-mcp · Note
• https://t.me/CVEtracker/51981 · Telegram Post
• https://twitter.com/CVEnew/status/2048852107856331114 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2048927160405016682 · Twitter Post