CVE-2026-27203
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:HSummary
CVE-2026-27203 is a high-severity External Control of System or Configuration Setting (CWE-15) vulnerability. Its CVSS base score is 8.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as AI Agent Protocols and Integrations; in the Protocol-Specific Risks risk domain.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-27203 is an Environment Variable Injection vulnerability affecting all versions of the eBay API MCP Server, an open-source local MCP server that provides AI assistants with comprehensive access to eBay's Sell APIs. The issue resides in the updateEnvFile function within src/auth/oauth.ts, which is invoked by the ebay_set_user_tokens tool to update the .env file with new tokens. This function blindly appends or replaces values without validating them for newlines or quotes, enabling attackers to inject arbitrary environment variables into the configuration file.
The vulnerability has a CVSS v3.1 base score of 8.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H), indicating network accessibility, low attack complexity, and low privileges required. An attacker with low privileges, such as an authenticated user able to invoke the ebay_set_user_tokens tool, can inject malicious environment variables. This may result in configuration overwrites, denial of service, and potential remote code execution.
Mitigation details are available in the GitHub security advisory at https://github.com/YosefHayim/ebay-mcp/security/advisories/GHSA-97rm-xj73-33jh and a related commit at https://github.com/YosefHayim/ebay-mcp/commit/aab0bda75ea9dd27aa37d0d8524d7cf41b3c4a9a. There was no fix for this issue at the time of publication on 2026-02-21. The vulnerability is associated with CWEs CWE-15 and CWE-74.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7748
Vulnerability Data
eBay API MCP Server is an open source local MCP server providing AI assistants with comprehensive access to eBay's Sell APIs. All versions are vulnerable to Environment Variable Injection through the updateEnvFile function. The ebay_set_user_tokens tool allows updating the .env…
more
file with new tokens. The updateEnvFile function in src/auth/oauth.ts blindly appends or replaces values without validating them for newlines or quotes. This allows an attacker to inject arbitrary environment variables into the configuration file. An attacker can inject arbitrary environment variables into the .env file. This could lead to configuration overwrites, Denial of Service, and potential RCE. There was no fix for this issue at the time of publication.
- CWE(s)
AI Security AnalysisAI
- AI Category
- AI Agent Protocols and Integrations
- Risk Domain
- Protocol-Specific Risks
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: ai, mcp
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 4 hardening rules · 2 OS baselines
V1.2.1V1.2.3V1.2.5V1.2.8
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for logical access to configuration resources so external parties cannot alter them.
Enforces documented access restrictions on all changes to system configuration, directly blocking unauthorized external control of settings.
Limits privileges to the minimum needed, reducing the set of users who can externally modify configuration.
SI-10 directly requires validation of information inputs to reject malformed or special-element content before it reaches downstream parsers.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Hardened configuration baselines and change controls directly limit external manipulation of settings.
Secure SDLC practices directly require input validation and output encoding that prevent injection flaws.
Formal change and exception management catches externally driven configuration alterations.
Least-privilege access policies reduce unauthorized external modification of configuration values.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Configuration management directly prevents external tampering with system settings.
Access rights assignment determines who may change system settings.
Privileged access rights reduce the number of users who can alter configuration.
Security testing in development catches injection vulnerabilities before release.
Information access restriction limits who can view or modify configuration data.
Change management enforces controlled, authorized modifications to settings.