The vulnerability CVE-2026-43992 affects the junoclaw platform by Dragonmonk111. Prior to version 0.x.y-security-1, the platform's MCP write tools accepted a 'mnemonic: string' parameter containing the BIP-39 seed. This seed was embedded in the LLM tool-call JSON, exposing it to interception or logging on any transport or telemetry path between the LLM provider and the MCP process. This exposure constitutes an information disclosure vulnerability (CWE-200) with related weaknesses in sensitive data exposure (CWE-312, CWE-522, CWE-532). The vulnerability is rated critical with a CVSS 3.1 base score of 9.8, reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability is fixed in version 0.x.y-security-1, but no explicit patch link or vendor advisory confirming the fix is provided in the data.

The vulnerability allows unauthorized actors to access the BIP-39 seed mnemonic embedded in tool-call JSON payloads. This exposure can lead to compromise of cryptographic keys and potentially full control over affected accounts or assets managed by the junoclaw platform. The CVSS score of 9.8 indicates critical impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported as of the published date.

A fix for this vulnerability is included starting from junoclaw version 0.x.y-security-1. Users should upgrade to this version or later to remediate the issue. Since the vendor advisory or patch links are not explicitly provided, users should consult the official Dragonmonk111 junoclaw release notes or security advisories to confirm patch availability and apply updates accordingly. No additional mitigations are specified.