mcp-ssh-tool versions prior to 2.1.1 contain security weaknesses in transfer path policy enforcement and HTTP bearer token comparison. These issues allow bypassing local path restrictions during file transfers and expose a timing side channel in token validation. Version 2.1.1 includes fixes that strengthen path authorization and implement constant-time token comparison to mitigate these risks.