Detections
Analytics

SCA: security update for @ooples/token-optimizer-mcp (GHSA-76pc-mqxp-3rq5)

medium Tenable Self-Hosted Container Security Plugin ID 445987

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local
 knowledge graph across 16 CLI clients. Prior to version 5.1.0, the dashboard HTTP server in token-
 optimizer-mcp exposes /api/session-summary and /api/session-events with no authentication middleware — any
 network-accessible client can reach them without credentials. Both handlers concatenate the caller-
 supplied sessionId query parameter directly into a filesystem path via path.join, and Node.js normalizes
 .. segments at resolution time, allowing an unauthenticated attacker to read any .jsonl file reachable
 from the server's filesystem. This issue has been patched in version 5.1.0. (CVE-2026-55156)

Solution

Update the @ooples/token-optimizer-mcp library and its related packages to version 5.1.0 or later.

See Also

https://github.com/advisories/GHSA-76pc-mqxp-3rq5

Plugin Details

Severity: Medium

ID: 445987

Version: Revision 1.3

Type: Local

Family: SCA Checks

Published: 8/15/2026

Updated: 9/29/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2026-55156

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/14/2026

Vulnerability Publication Date: 8/14/2026

Reference Information

CVE: CVE-2026-55156

cwe: CWE-22