CVE-2026-59563

MEDIUMCVSS 4.6

Description

Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation tokens were not bound to the target resource identifier, allowing an MCP client or agent to replay a token generated for one resource to affect another resource of the same type. This issue is fixed in version 0.7.2.

Timeline

Published:September 28th, 2026 1:17 PM

Last modified:September 28th, 2026 3:17 PM

CVSS Scoring

CVSS v3: 4.6 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

Weaknesses (CWE)

CWE-305

References & Reports

Advisories, patches, and third-party reports

https://github.com/zscaler/zscaler-mcp-server/pull/41

Source: NIST NVD · Data may lag official sources by up to one minute