This vulnerability in tufantunc ssh-mcp (up to version 1.5.0) is caused by insufficient protection of credentials in a component related to command line handling, specifically in an unspecified function within src/index.ts. The weakness is classified under CWE-522 (Insufficiently Protected Credentials). Exploitation requires local access with low privileges and does not depend on user interaction. The vulnerability has a CVSS 4.8 (medium) score, reflecting limited attack vector and impact scope. The project was notified early but has not issued a fix or advisory. No cloud service is involved, and no official remediation or patch is currently available.

The vulnerability allows an attacker with local access to potentially obtain or manipulate credentials that are insufficiently protected by the software. This could lead to unauthorized access or privilege escalation within the local environment. The impact is limited by the requirement for local execution and low privileges, and there is no indication of remote exploitation or broader system compromise.

No official fix or patch is currently available from the vendor, and the project has not responded to the issue report. Users should restrict local access to trusted users only and monitor for any suspicious activity related to credential handling in ssh-mcp. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.