1MCP 0.39.0 Is Still Latest. The Scope CVE Lists No Fix.

npm's latest tag for @1mcp/agent is 0.39.0, published 9 October 2026 at 16:56 UTC. CVE-2026-108586 was published the next day, at 16:14 UTC, and the affected range runs through that same version. The record lists no patched release.

HaiND, of the Post and Telecommunication Institute of Technology, is the finder named on the CVE. The technical note is the writeup the CVE cites. VulnCheck is the CNA. US X trends at 22:09 UTC were Ukraine, college football, and Zelensky. Hacker News did not lead with this package. The operator fact is the dist-tag.

Medium Medium on the CVE's own scores: CVSS v4 base 5.3, CVSS v3.1 base 5.4. Low privileges, low confidentiality, low integrity. The score assumes the caller already holds a token. The control that failed is the wall between tags.

What the CVE actually says.#

CVE-2026-108586 is CWE-863, incorrect authorization, in @1mcp/agent from 0.20.0 through 0.39.0. An authenticated client can bypass OAuth tag-scope enforcement with a negated advanced tag filter. A token that holds a single tag can list and invoke tools on backend MCP servers outside that grant. The package URL on the record is pkg:npm/@1mcp/agent. Default status for versions outside that range is unaffected. No fixed version is listed.

1MCP is an aggregator. Backends sit behind one HTTP API, and a tag on the OAuth token is supposed to be the fine-grained boundary. HaiND's note describes the miss at that boundary. The scope check collects the tag names the filter mentions and asks whether each of those names is granted. A negated filter mentions a tag the token already has, so the name check passes. The filter then runs as a complement and selects backends that do not carry the granted tag. Listing and invocation share that selection. There is no second tag check at invocation time.

The note is explicit about what still holds. With no filter, selection stays pinned to the granted tags. A filter that names an ungranted tag is rejected. The failure is the negated advanced path, where the authorized names and the selected backends come apart.

The note also says what was not done. The real parser and the scope check were run on two synthetic connections. A live deployment with an issued OAuth token and real backends was not stood up. The claim is the authorization decision, which the HTTP routes use. It is not a report of an incident in a named organization.

The package clock and the impact clock.#

The package clock is the registry, read tonight.

0.20.0 was published on 27 August 2025 at 14:17 UTC. That tag's tree already contains scopeAuthMiddleware and the tag-query parser. HaiND writes that the earlier range was not bisected, so the 0.20.0 floor is the CNA's range. Presence of those files is not a reproduction of the bypass on every version in between.

0.38.3 was published on 9 October at 15:36 UTC. The note verifies the logic there, commit a405891. 0.39.0 followed at 16:56:42 UTC, GitHub release v0.39.0 at 16:56:58 UTC, commit 93cc6b2, and the note says the logic is the same. The next dist-tag is 0.39.0-beta.5, published 7 October at 15:55 UTC, which is also inside 0.20.0 through 0.39.0. Nothing newer is on npm. The registry's modified time is 16:58 UTC on 9 October.

The disclosure clock is 10 October. The CVE record's datePublished is 16:14:10 UTC. HaiND's note, fetched after that timestamp, still describes coordinated disclosure as in progress and still says no CVE had been assigned. The page and the record are not one document. VulnCheck's advisory is dated 10 October and cites the same note.

1. 2025-08-27
   npm publishes @1mcp/agent 0.20.0. The CVE later marks this version as the start of the affected range.
2. 2026-10-09
   0.38.3 at 15:36 UTC, then 0.39.0 at 16:56 UTC. The release notes point latest at 0.39.0. The researcher's note verifies both.
3. 2026-10-10
   CVE-2026-108586 at 16:14 UTC. No patched version. Main's later commits are a dependency bump, a changelog-tag fix, and a pnpm change.

After v0.39.0, main was five commits ahead. The messages are a handlebars bump, a fix that restricts changelog tags to the candidate branch, and a pnpm update with lockfile parsing. The last of those merges is 16:22 UTC on 10 October, eight minutes after the CVE timestamp. None of them is the tag-scope check.

What this is not.#

It is not an unauthenticated entry. The caller needs a valid token with at least one granted tag, scope validation enabled, and at least one backend tagged outside that grant. HaiND's impact note is the multi-tenant case, where tags separate tenants, and the single-tenant case, where a low-tier tag is supposed to stop at that tier. If you do not use tags as the boundary, this particular miss has nothing to cross.

It is not a stolen-credential worm. This week's GhostAction wave and the Tensorlake npm release are publish tokens and install hooks. Here the token is the one you issued, and the package you installed is the maintainer's 0.39.0. The miss is inside the authorization check.

It is not a live incident report. The note says the HTTP run with a real token was not stood up, and it makes no claim past the authorization decision. Brief the check. Do not brief a victim count.

It is not closed by a denylist of one spelling. The note says more than one way of writing the negation reaches the same parser node. The control HaiND points at is to intersect the selected backends with the granted tags in every filter mode, and to check that ceiling again at invocation. That intersection is not in 0.39.0.

What to change before the next install.#

Inventory @1mcp/agent before you refresh it. The global npm install, the latest dist-tag, the next tag, and the ghcr.io/1mcp-app/agent:latest image named in the 9 October release notes are all inside the range the CVE marks affected. 0.38.3, shipped the same afternoon, is the other version the researcher verified.

If tags are how you separate tenants or privilege tiers, treat that wall as open for any token that holds at least one tag. The no-filter path still pins to the grant, and a direct ask for an ungranted tag is still denied. A negated advanced filter is the path that selects the complement. Until a release says CVE-2026-108586 is fixed, tag scope is not the isolation boundary.

Rotating tokens does not close the check. The precondition is a legitimate token. Issue a tighter grant only if you also stop trusting the filter. A new token of the same shape hits the same middleware.

Wait for a release note that names this CVE. A version number that is merely newer than 0.39.0 would be evidence only after that note exists. Tonight the registry has no such version, and the five commits on main after the tag do not touch the check. The GitHub security-advisory list is the other place a patched range would show up. It was empty.