Skip to content
OpenAdvisories

Product · payloadcms

plugin-mcp

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.6
    CVE-2026-105806

    Payload: Improper access control for MCP API keys

    Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys outside the intended account, enabling privilege escalation through account takeov…

    payloadcms payload plugin-mcp @payloadcms/plugin-mcp npm