Read the docs
TI-2026-31965 Aliases CVE-2026-43901GHSA-3r68-x3xc-rxpg

Wireshark MCP: Arbitrary file write via export_objects when WIRESHARK_MCP_ALLOWED_DIRS is not configured

Priority HIGH 65CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Wireshark MCP is an MCP Server that turns tshark into a structured analysis interface, then layers in optional Wireshark suite utilities. In 1.1.5 and earlier, wireshark-mcp exposes a wireshark_export_objects MCP tool that accepts an attacker-controlled dest_dir parameter and passes it to tshark's --export-objects flag with no mandatory path restriction. The path sandbox (_allowed_dirs) is None by default and only activates when the environment variable WIRESHARK_MCP_ALLOWED_DIRS is explicitly set. In a default installation, any directory on the filesystem can be used as the export destination.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00345 28th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
bx33661Wireshark-MCPup to 1.1.5—No fix listedCNA
—wireshark-mcp (PyPI)up to 1.1.5—No fix listedGHSA-3r68-x3xc-rxpg
  • Wireshark-MCP Vendorbx33661 Affected up to 1.1.5 Fixed in — No fix listed CNA
  • wireshark-mcp (PyPI) Vendor— Affected up to 1.1.5 Fixed in — No fix listed GHSA-3r68-x3xc-rxpg

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:bx33661:wireshark_mcp:*:*:*:*:*:*:*:*up to 1.1.5Vulnerablebx33661
  • cpe:2.3:a:bx33661:wireshark_mcp:*:*:*:*:*:*:*:* Versions up to 1.1.5 Vulnerable ·bx33661

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-43901
  2. 2026-10-03 Alias added: GHSA-3r68-x3xc-rxpg

References

Exploit 1

Advisory 1

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences