The Airtable MCP CLI accepted any endpoint URL entered with the configure command and stored that value together with the user’s access token. Because the stored token was appended as a bearer credential to every request made to the configured endpoint, a malicious endpoint supplied by an attacker would receive the token on each subsequent execution. This behavior exposes the personal access token to an unintended third party, effectively disclosing credentials and exposing the user to account compromise, as highlighted by CWE‑200.

The vulnerability affects the Airtable MCP CLI, specifically all releases prior to version 0.2.5. Users running earlier versions are able to execute the configure command without endpoint validation, causing the credentials to be persisted for later use.

The CVSS score of 6.9 indicates moderate to high severity from a confidentiality point of view. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower likelihood of widespread exploitation at present. However, the attack requires that an attacker convince a user to run the configure command with a malicious endpoint, which is feasible through social engineering or phishing. Once executed, the token is automatically exposed on each subsequent invocation, making the exploitation particularly damaging to the affected user.