CVE-2026-15526 is a path traversal vulnerability affecting augmnt augments-mcp-server version 7.1.0. The issue resides in the scanProjectDeps function within the scan_project_deps component, specifically in the file src/tools/v4/scan-project-deps.ts. By manipulating the packageJsonPath argument, a local attacker with limited privileges can traverse directories outside the intended scope. The vulnerability does not require user interaction and has a low complexity attack vector but is limited to local access. Although an exploit is publicly available, there is no vendor response or patch at this time.

An attacker with local access and limited privileges can exploit this vulnerability to perform path traversal, potentially accessing files or directories outside the intended scope of the application. This could lead to unauthorized information disclosure or influence over the application’s behavior. The impact is limited by the requirement for local access and the absence of privilege escalation or remote exploitation vectors.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should restrict local access to trusted users only and monitor for any suspicious local activity related to the augments-mcp-server. Avoid running the affected version 7.1.0 in untrusted environments until a patch or official mitigation is available.