AI agent vulnerability · Other MCP servers and tools

CVE-2026-7149: kaggle-mcp has a Path Traversal issue

mediumCVSS 4.0 5.5 · 3.1 7.3GHSA-q882-jc55-6343

A vulnerability has been found in dexhunter kaggle-mcp up to 406127ffcb2b91b8c10e20e6c2ca787fbc1dc92d. This vulnerability affects the function preparekaggledataset of the file src/kagglemcp/server.py. The manipulation of the argument competitionid leads to path traversal. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.

Published Apr 27, 2026 · Updated May 6, 2026

Affected packages

kaggle-mcp

Ecosystem: PyPI
Affected: <= 0.1.0
Fixed in: No patched version yet
Check: pip show kaggle-mcp

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

A vulnerability has been found in dexhunter kaggle-mcp up to 406127ffcb2b91b8c10e20e6c2ca787fbc1dc92d. This vulnerability affects the function prepare_kaggle_dataset of the file src/kaggle_mcp/server.py. The manipulation of the argument competition_id leads to path traversal. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Other MCP servers and tools vulnerabilities

All Other MCP servers and tools entries