What’s Vulnerable › Vulnerabilities
CVE-2026-59563: HMAC Confirmation Token Unbinding in zscaler-mcp-server
- Severity: medium (CVSS 4.6 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-28 · updated 2026-09-28
- Weakness: CWE-305
Description
Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation tokens were not bound to the target resource identifier, allowing an MCP client or agent to replay a token generated for one resource to affect another resource of the same type. This issue is fixed in version 0.7.2.
Affected products
- zscaler-mcp-server: from 0.7.0 before 0.7.2 — fixed in 0.7.2
How to fix
Upgrade to a fixed version: zscaler-mcp-server 0.7.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-59563 or the next vulnerability affects your stack