CVE-2026-58168
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
DeepTutor before version 1.4.10 contains an authorization bypass vulnerability allowing low-privilege users to invoke unrestricted MCP tools. The allowed_mcp_tools function returns None instead of a denied result when mcp_tools is omitted from a user's grant.
Risk Assessment
Attackers or prompt-injected content acting within a user session can enumerate and invoke any configured MCP tool, including filesystem, shell, and browser servers, gaining unauthorized access to sensitive deployment resources.
Recommendation
Upgrade DeepTutor to version 1.4.10 or later immediately, which includes a fix for this vulnerability. As a workaround, restrict access to MCP tools through proper permission configuration.
Other vulnerabilities in DeepTutor
See all- CVE-2026-51881Critical
Code injection vulnerability in deeptutor 1.4.0 in ExecTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to execute chosen shell commands in the service environment.
- CVE-2026-51880Critical
Path traversal vulnerability in deeptutor 1.4.0 in EditFileTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to write or edit absolute paths outside the intended bot workspace.
- CVE-2026-51879Critical
Authorization bypass vulnerability in deeptutor 1.4.0 in TutorBotManager.write_bot_file. A remote caller can enumerate bot IDs and overwrite another bot's whitelisted control files through the HTTP tutorbot file route.
- CVE-2026-51876Critical
Authorization bypass vulnerability in DeepTutor 1.4.0 in the book confirmation flow. An unauthenticated or unauthorized caller can reuse a publicly exposed book_id to submit a confirm-proposal request for an existing book, causing unauthorized overwrites of persisted metadata and spine content.
- CVE-2026-51870Critical
DeepTutor v1.4.0 is vulnerable to command execution in /tutorbot/agent/tools/shell.py:ExecTool.execute.
- CVE-2026-51878Medium
Authorization bypass vulnerability in deeptutor 1.4.0 in TurnRuntimeManager.regenerate_last_turn. A remote caller can enumerate or obtain a session_id and trigger regenerate on another user's session.
Original NVD description (English source)
DeepTutor before version 1.4.10 contains an authorization bypass vulnerability that allows low-privilege users to invoke unrestricted MCP tools due to the allowed_mcp_tools function returning None instead of a denied result when mcp_tools is omitted from a user's grant in deeptutor/multi_user/tool_access.py. Attackers or prompt-injected content acting within a user session can enumerate and invoke any configured MCP tool, including filesystem, shell, and browser servers, gaining unauthorized access to sensitive deployment resources.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS