The flaw in the Command Line Handler of ssh‑mcp exposes credentials because the src/index.ts file does not properly protect stored or transmitted credentials. An attacker who is able to execute commands locally can read these credentials, allowing unauthorized access to the SSH connections managed by the tool and potentially compromising the systems to which the connections are made.

The vulnerable product is tufantunc’s ssh‑mcp, in all releases up to and including 1.5.0. No later versions are listed as fixed, and the project has yet to release a patch for this issue.

The CVSS base score of 4.8 assigns a medium severity, while the EPSS score of less than 1% indicates a very low likelihood of public exploitation at this time. The vulnerability is not currently catalogued in the CISA KEV database. The attack vector is limited to local execution; thus, a local attacker or one who gains local execution privileges can read the exposed credentials. Because the exploit source code is publicly available, the primary risk is the potential compromise of SSH credentials and subsequent unauthorized access to protected services.