{
 "id": "AIR-2026-0120",
 "slug": "cve-2026-57442-path-restriction-bypass-vulnerability-in-mcpv",
 "title": "CVE-2026-57442: Path restriction bypass vulnerability in MCPVault",
 "summary": "A path filter vulnerability in the MCPVault Model Context Protocol server permits traversal into nested repository or Obsidian metadata directories. An attacker influencing AI agent paths can read restricted files or tokens.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "MCPVault"
 ],
 "incident_date": "2026-09-15",
 "incident_date_precision": "day",
 "first_reported": "2026-09-15",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57442",
   "publisher": "NVD",
   "title": "CVE-2026-57442: MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault.",
   "published_at": "2026-09-15"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-57442",
  "path-traversal",
  "mcp"
 ],
 "created_at": "2026-10-18T06:33:31.967Z",
 "updated_at": "2026-10-18T06:33:31.967Z"
}