CVE Feed

    Dashboard / CVE / CVE-2026-43901

    CVE-2026-43901

    Wireshark MCP is an MCP Server that turns tshark into a structured analysis interface, then layers in optional Wireshark suite utilities. In 1.1.5 and earlier, wireshark-mcp exposes a wireshark_export_objects MCP tool that accepts an attacker-controlled dest_dir parameter and passes it to tshark's --export-objects flag with no mandatory path restriction. The path sandbox (_allowed_dirs) is None by default and only activates when the environment variable WIRESHARK_MCP_ALLOWED_DIRS is explicitly set. In a default installation, any directory on the filesystem can be used as the export destination.

    Published:May 11, 2026
    Last Modified:May 13, 2026
    EPS:May 11, 2026
    EPSS Score:0.00045
    CVSS Score:6.8

    Affected Products

    Vendor
    Bx33661
    Product
    Wireshark-mcp
    Vendor
    Bx33661
    Product
    Wireshark Mcp

    Exploits

    https://github.com/bx33661/Wireshark-MCP/security/advisories/GHSA-3r68-x3xc-rxpghttps://github.com/bx33661/Wireshark-MCP/security/advisories/GHSA-3r68-x3xc-rxpg

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High