CVE-2026-19334 NightTrek CVE debrief

Who should care

System administrators and security teams responsible for NightTrek Ollama-mcp installations should assess and mitigate this vulnerability to prevent local exploitation. They should review system configurations, verify potentially affected components, and enforce system hardening measures. Additionally, they should monitor system logs for suspicious activity and track exceptions for remediated assets.

Technical summary

A flaw in NightTrek Ollama-mcp up to 80cf2e17cfc144963a475b619093a2d13c13dbc9 allows local attackers to inject commands via manipulation of the name, modelfile, source, or destination arguments in src/index.ts. The attack can only be executed locally. The product uses a rolling release model, so no version details for affected or updated releases are available. System administrators should focus on implementing strict input validation and system hardening measures.

Defensive priority

Local attackers may exploit this low-severity vulnerability to inject commands, emphasizing the need for strict input validation and system hardening.

Recommended defensive actions

• Implement strict input validation for the name, modelfile, source, and destination arguments.
• Enforce system hardening measures to restrict local exploitation.
• Monitor system logs for suspicious activity indicative of command injection attempts.
• Verify system configurations and inventory to identify potentially affected components.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

Evidence is limited; verify affected systems and assess command injection risks through thorough inventory checks and vulnerability scanning. The product's rolling release model means no specific version details are available for affected or updated releases. The project was informed early but has not yet responded. Verify system configurations and inventory to identify potentially affected components. Consider the limited information available and focus on defensive measures.

Official resources