CVE-2026-55156

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-55156
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55156.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-55156
Aliases
Published
2026-09-28T17:48:21Z
Modified
2026-10-02T03:31:09Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints
Details

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, the dashboard HTTP server in token-optimizer-mcp exposes /api/session-summary and /api/session-events with no authentication middleware — any network-accessible client can reach them without credentials. Both handlers concatenate the caller-supplied sessionId query parameter directly into a filesystem path via path.join, and Node.js normalizes .. segments at resolution time, allowing an unauthenticated attacker to read any .jsonl file reachable from the server's filesystem. This issue has been patched in version 5.1.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-22"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55156.json"
}
References

Affected packages

Git / github.com/ooples/token-optimizer-mcp

Affected ranges

Type
GIT
Repo
https://github.com/ooples/token-optimizer-mcp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b4ee96dac799cbfba0a9f9c17844ce9d613cbcc7
Fixed
94815a16e3322101694e97561fc1dc8b5af904dc
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "5.1.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.0.0
v2.*
v2.0.0
v2.1.0
v2.10.0
v2.10.1
v2.11.0
v2.12.0
v2.12.1
v2.12.2
v2.13.0
v2.14.0
v2.15.0
v2.15.1
v2.15.2
v2.16.0
v2.17.0
v2.18.0
v2.19.0
v2.19.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.8.0
v2.9.0
v3.*
v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.1.0
v4.*
v4.0.0
v4.0.1
v4.1.0
v4.2.0
v5.*
v5.0.0
v5.0.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55156.json"