CVE-2026-19039 is a command injection vulnerability in the ssh_exec function of the src/index.ts file in the Kino-Kafkaesque ssh-mcp-server. The flaw arises from improper handling of the host and username arguments, allowing an attacker with local access to inject commands. The vulnerability is mitigated by the design assumption that the server is a local trusted tool, and users invoking it already possess meaningful execution rights. Due to the rolling release strategy, no fixed or affected versions are explicitly identified. No known exploits are reported in the wild.

Successful exploitation could allow a local attacker to execute arbitrary commands via manipulated host or username arguments, potentially leading to confidentiality, integrity, and availability impacts. However, since the server is intended for local trusted use and callers already have execution capabilities, the practical impact is limited. The CVSS score of 5.3 reflects a low severity with local attack vector and low complexity.

No official patch or fix is currently available or specified. Given the product's rolling release model and the maintainer's note on the intended threat model, no immediate action may be required beyond ensuring that only trusted local users have access to the ssh-mcp-server. Monitor vendor advisories for any updates or fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.