CVE-2026-81101: Exposure of Sensitive Information to an Unauthorized Actor in Airtable airtable-mcp-cli
Description
CVE-2026-81101 is a medium severity vulnerability in the Airtable airtable-mcp-cli tool prior to version 0.2.5. The configure command allowed users to specify any endpoint URL, which was stored alongside the user's access token without proper validation. This flaw could cause the user's personal access token to be sent to an attacker-controlled endpoint on subsequent requests. Version 0.2.5 fixes this by applying a URL safety check to the endpoint option.
CVSS v4.0
Score 6.9medium
Affected software
Airtable
airtable-mcp-cli
pkg:github/airtable-mcp-cliRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability arises because the configure command in airtable-mcp-cli accepted arbitrary endpoint URLs and stored them with the user's access token without sanitization. The stored token was then attached as a bearer token on every request to the configured endpoint. Without validation, a malicious endpoint URL could cause token leakage to an unauthorized party. The fix in version 0.2.5 enforces endpoint URL restrictions using the createSafeUrl helper, which limits endpoints to vendor-approved HTTPS hosts.
Potential Impact
An attacker who convinces a user to configure the CLI with a malicious endpoint URL can receive the user's personal access token on every subsequent command invocation. This exposure of sensitive credentials could lead to unauthorized access to the user's Airtable resources. However, exploitation requires user interaction (UI:A) and no privileges or authentication are needed to trigger the issue.
Mitigation Recommendations
Upgrade to airtable-mcp-cli version 0.2.5 or later, which applies endpoint URL validation to prevent arbitrary URLs from being stored and used. Until upgraded, users should avoid running the configure command with untrusted endpoint URLs. No other mitigations are documented.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-26T16:00:34.121Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a906bb2acd9273b4983a184
Added to database: 08/27/2026, 16:54:10 UTC
Last enriched: 09/10/2026, 04:38:45 UTC
Last updated: 10/10/2026, 06:48:19 UTC
Views: 67
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.