CVE-2026-55156

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, the dashboard HTTP server in token-optimizer-mcp exposes /api/session-summary and /api/session-events with no authentication middleware — any network-accessible client can reach them without credentials. Both handlers concatenate the caller-supplied sessionId query parameter directly into a filesystem path via path.join, and Node.js normalizes .. segments at resolution time, allowing an unauthenticated attacker to read any .jsonl file reachable from the server's filesystem. This issue has been patched in version 5.1.0.

• CWE-22

• https://github.com/ooples/token-optimizer-mcp/commit/b4ee96dac799cbfba0a9f9c17844ce9d613cbcc7
• https://github.com/ooples/token-optimizer-mcp/releases/tag/v5.1.0
• https://github.com/ooples/token-optimizer-mcp/security/advisories/GHSA-76pc-mqxp-3rq5
• https://github.com/ooples/token-optimizer-mcp/security/advisories/GHSA-76pc-mqxp-3rq5

Published

Sep 28, 2026

Last Modified

Sep 28, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55142Numeric truncation error in Microsoft Office Word allows an …5.5
• CVE-2026-55144Missing cryptographic step in Windows CryptoAPI allows an au…7.1
• CVE-2026-55145Improper neutralization of special elements used in a comman…7.1
• CVE-2026-55149Vouch Proxy is an SSO and OAuth/OIDC login solution for Ngin…7.5
• CVE-2026-5515IBM App Connect Enterprise 13.0.1.0 through 13.0.7.0 stores …5.5
• CVE-2026-55153mchange-commons-java is a Java library of shared utility cla…7.1
• CVE-2026-55157Token Optimizer MCP measures token savings per AI coding age…8.4
• CVE-2026-55158Conflibot warns in advance when merging a pull request will …9.1
• CVE-2026-55159luci-app-adblock-fast a WebUI for fast, lightweight DNS-base…8.8
• CVE-2026-5516IBM WebSphere Application Server - Liberty 22.0.0.11 through…5.9
• CVE-2026-55160Stringer is a self-hosted, anti-social RSS reader. Prior to …7.6
• CVE-2026-55162Lemur manages TLS certificate creation. Prior to 1.9.2, lemu…6.3