CVE-2026-58168: DeepTutor missing MCP tool authorization allows non-admin users to invoke unrestricted tools
(updated )
DeepTutor before version 1.4.10 contains an authorization bypass vulnerability that allows low-privilege users to invoke unrestricted MCP tools due to the allowed_mcp_tools function returning None instead of a denied result when mcp_tools is omitted from a user’s grant in deeptutor/multi_user/tool_access.py. Attackers or prompt-injected content acting within a user session can enumerate and invoke any configured MCP tool, including filesystem, shell, and browser servers, gaining unauthorized access to sensitive deployment resources.
References
- github.com/HKUDS/DeepTutor/commit/90046374b3dcd4f8a866d2d64a64440bc08eb2ef
- github.com/HKUDS/DeepTutor/pull/579
- github.com/HKUDS/DeepTutor/releases/tag/v1.4.10
- github.com/advisories/GHSA-jg88-rvpc-qvxj
- nvd.nist.gov/vuln/detail/CVE-2026-58168
- www.vulncheck.com/advisories/deeptutor-insecure-default-grants-unrestricted-mcp-tool-access-to-non-admin-users
Code Behaviors & Features
Detect and mitigate CVE-2026-58168 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →