CVE-2026-45805

Description

PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE

Overview

State

—

Assigner (CNA)

—

CVSS severity

high

CVSS score

8.8 / 10

CVSS vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Effective score

8.8 / 10 HIGH source: CNA overview

CWE(s)

—

Reserved

—

Published

—

Last updated

—

Source

https://www.tenable.com/cve/CVE-2026-45805

Linked Threat

CVE-2026-45805 — CVE-2026-45805

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID

EUVD-2026-44700

Assigner

GitHub_M

Published

Jul 15, 2026, 3:11:22 PM

Updated

Jul 15, 2026, 3:44:45 PM

EUVD base score (CVSS 3.1)

8.8 / 10
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EUVD-reported EPSS

0.2300

Vendors

penpot

Products

penpot (< 2.15.0)

Aliases

GHSA-22qr-rp27-j9wm

ENISA description: Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot MCP's mcp/packages/server/src/ReplServer.ts bound the ReplServer to 0.0.0.0:4403 and exposed an unauthenticated /execute endpoint that passed the code field to PluginBridge.executePluginTask(), allowing anyone on the network to execute JavaScript on the server. This issue is fixed in version 2.15.0.

Vendor references (0)

References embedded in the original CVE record by the assigning CNA.

None in the CVE record.

Web references (2)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

• https://nvd.nist.gov/vuln/detail/CVE-2026-45805 tenable:nvd.nist.gov
• https://www.cve.org/CVERecord?id=CVE-2026-45805 tenable:www.cve.org

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

• Microsoft Patch Tuesday for May 2026 — Snort rules and prominent ...
  web:blog.talosintelligence.com

  Microsoft has released its monthly security update for May 2026 , which includes 137 vulnerabilities affecting a range of products, including 16 that Microsoft marked as "critical".

  2026-05-26 02:56 UTC
• Microsoft Releases Mitigation for Windows BitLocker Security Bypass 0 ...
  web:cybersecuritynews.com

  No patch has been released yet; Microsoft has instead issued a multi-step manual mitigation guide while a formal security update is prepared. Windows BitLocker Security Bypass The vulnerability originates in WinRE's handling of the BootExecute registry value under HKLM\ControlSet001\Control\Session Manager.

  2026-05-26 02:56 UTC
• CVE-2026-45805 | Security Details | Sonatype Guide
  web:guide.sonatype.com

  Technical security analysis for CVE-2026-45805 . CVSS 8.8 severity. View CVSS vectors, CWE classifications, and exploit maturity ratings.

  2026-05-26 02:56 UTC
• Security Update Guide - Microsoft Security Response Center
  web:msrc.microsoft.com

  Security Update Guide - Microsoft Security Response Center

  2026-05-26 02:56 UTC
• Microsoft April 2026 Patch Tuesday fixes 167 flaws, 2 zero-days
  web:www.bleepingcomputer.com

  Today is Microsoft's April 2026 Patch Tuesday with security updates for 167 flaws, including 2 zero-day vulnerabilities.

  2026-05-26 02:56 UTC
• August 2025 Patch Tuesday: Updates and Analysis | CrowdStrike
  web:www.crowdstrike.com

  Microsoft has released security updates for 107 vulnerabilities, including one publicly disclosed zero-day and 13 critical, in its August 2025 Patch Tuesday rollout.

  2026-05-26 02:56 UTC
• Microsoft provides mitigation for "YellowKey" BitLocker bypass flaw ...
  web:www.helpnetsecurity.com

  Microsoft is working on a fix for CVE - 2026 -45585 (aka "Yellowkey"), a vulnerability that can be used to bypass Windows' BitLocker protection.

  2026-05-26 02:56 UTC
• Microsoft mitigates YellowKey BitLocker bypass, no patch yet
  web:www.notebookcheck.net

  Microsoft released mitigation steps for YellowKey ( CVE - 2026 -45585), a BitLocker bypass that grants physical attackers access to encrypted Windows drives.

  2026-05-26 02:56 UTC
• Microsoft Rolls Out Mitigations for 'YellowKey' BitLocker ...
  web:www.securityweek.com

  Microsoft has announced mitigations for CVE - 2026 -45585, a BitLocker bypass triggered via FsTx in Windows Recovery.

  2026-05-26 02:56 UTC
• Patch Tuesday May 2026: Security Updates & CVE Analysis
  web:zecurit.com

  Get the complete breakdown of Microsoft's May 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

  2026-05-26 02:56 UTC

Only Available for Registered Users. Sign in to view.