Tools AI Risk Radar ai-incident-0113
Incident record
Zscaler's MCP server let one approval token unlock other resources
- Severity
- Medium
- Status
- Patched
- Type
- Agent Hijack
- Target
- Zscaler MCP Server 0.7.0 and 0.7.1
- Actor
- researcher
- CVE
- CVE-2026-59563
What happened
Zscaler's MCP server asks for an HMAC confirmation token before an agent changes a resource. In versions 0.7.0 and 0.7.1 a token generated for one resource also worked on any other resource of the same type, so an MCP client or agent could replay it to change a resource nobody had approved. CVE-2026-59563, published by Zscaler on 28 September 2026, scores it CVSS 3.1 4.6.
Version 0.7.2 fixes it. It reached PyPI on 31 March 2026, six months before the record.
Sources
- NVD record CVE-2026-59563nvd.nist.gov/vuln/detail/CVE-2026-59563
- Zscaler MCP Server fix, pull request 41github.com/zscaler/zscaler-mcp-server/pull/41
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 13 October 2026