pentest-mcp

Pentest MCP 专业渗透测试 MCP 服务器，支持现代传输/认证和扩展的侦察工具集。 0.9.0 版本变更 将 MCP SDK 升级到 @modelcontextprotocol/sdk@^1.26.0 将 MCP Inspector 保持在最新版本（@modelcontextprotocol/inspector@^0.20.0），并附带打包启动器 Streamable HTTP 现为主要网络传输方式（MCPTRANSPORT=http） SSE 仅作为已弃用的兼容模式保留 新增 Bearer Token 认证，支持 OIDC JWKS 和内省...

CVE-2026-77298 SeaweedFS S3 OIDC Bearer authentication bypasses IAM role trust policy

SeaweedFS is a distributed storage system for files and blobs. In versions 4.39 and earlier, the S3 API accepts an external OIDC JWT sent directly in the Authorization header and maps it to an IAM role without enforcing that role's trust policy, so a federated user can assume a role they are not...

CVE-2026-77298 SeaweedFS S3 OIDC Bearer authentication bypasses IAM role trust policy

SeaweedFS is a distributed storage system for files and blobs. In versions 4.39 and earlier, the S3 API accepts an external OIDC JWT sent directly in the Authorization header and maps it to an IAM role without enforcing that role's trust policy, so a federated user can assume a role they are not...

CVE-2026-77298

SeaweedFS is a distributed storage system for files and blobs. In versions 4.39 and earlier , the S3 API accepts an external OIDC JWT sent directly in the Authorization header and maps it to an IAM role without enforcing that role's trust policy . While the standard STS AssumeRoleWithWebIdentity ...