CVE-2026-54140

OpenHuman trusts instructions in external MCP tool descriptions

tinyhumansai · OpenHuman MCP integration

First documented disclosure · Review checkpoint

Summary

A configured malicious MCP server can insert instructions through its tool metadata.

Severity and exploitation evidence

High · 8.3/10 · CVSS 3.1. Severity source.

Exploitation not established: The advisory describes an attack scenario; the public patch records a controlled rejection test. Malicious exploitation is not established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Remote descriptions and titles flow into model context while the existing detector screens user messages rather than those tool definitions.

Conditions required

The user connects an attacker-controlled or compromised server. Harmful actions depend on model behavior and the permissions of other available tools.

Potential impact

Injected instructions may cause unauthorized tool use or disclosure of accessible data. The advisory’s scenario is not an observed customer compromise.

Affected versions and configurations

Before 0.57.13.

Fix and mitigation status

0.57.13 adds metadata sanitization, length limits, detection and rejection logging.

Practical next steps

Upgrade, review connected MCP servers and maintain independent approval boundaries for sensitive actions.

Operating lesson

Tool descriptions are remote input and require the same trust scrutiny as retrieved documents.

Evidence and limits

The public June 2 fix proposal discloses the mechanism; it merged June 3. The advisory followed October 9 and the CVE November 5. Pattern-based metadata filtering is not a general proof against prompt injection.

Sources