Medium severity4.6NVD Advisory· Published Sep 28, 2026· Updated Sep 28, 2026
CVE-2026-59563
CVE-2026-59563
Description
Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation tokens were not bound to the target resource identifier, allowing an MCP client or agent to replay a token generated for one resource to affect another resource of the same type. This issue is fixed in version 0.7.2.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: 0.7.0, 0.7.1
Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.