CVE-2026-19268

MEDIUM 6.3

abdullah1854 MCPGateway Claude Usage Range Endpoint claude-usage.ts getUsageByDateRange command injection

CVSS Score

6.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was identified in abdullah1854 MCPGateway up to 549f494a9e363f40530149de324b8097de424230. This impacts the function getUsageByDateRange of the file src/services/claude-usage.ts of the component Claude Usage Range Endpoint. The manipulation of the argument since leads to command injection. The attack can be initiated remotely. The exploit is publicly available and might be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

CWE	CWE-77 CWE-74
Vendor	abdullah1854
Product	mcpgateway
Published	Aug 8, 2026

Stay Ahead of the Next One

Get instant alerts for abdullah1854 mcpgateway

Be the first to know when new medium vulnerabilities affecting abdullah1854 mcpgateway are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

abdullah1854 / MCPGateway

549f494a9e363f40530149de324b8097de424230

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/387012 vuldb.com: https://vuldb.com/vuln/387012/cti vuldb.com: https://vuldb.com/cve/CVE-2026-19268 vuldb.com: https://vuldb.com/submit/865222 github.com: https://github.com/abdullah1854/MCPGateway/issues/2 github.com: https://github.com/abdullah1854/MCPGateway/

Credits

🔍 gongyanyu02 (VulDB User) VulDB CNA Team