https://oddguan.com/tags/cve-2026-27735/Recent content in CVE-2026-27735 on Aonan Guanhttps://oddguan.com/avatar.webphttps://oddguan.com/avatar.webpHugo -- 0.147.7en-usSat, 28 Feb 2026 00:00:00 +0000https://oddguan.com/blog/anthropic-mcp-server-git-add-path-traversal-credential-exfiltration-capability-laundering-cve-2026-27735/Sat, 28 Feb 2026 00:00:00 +0000https://oddguan.com/blog/anthropic-mcp-server-git-add-path-traversal-credential-exfiltration-capability-laundering-cve-2026-27735/CVE-2026-27735: MCP Git Server git_add path traversal vulnerability enables credential exfiltration via GitPython's missing boundary validation. A single git_add call reads SSH keys, kubeconfig, and AWS credentials into Git history — invisible in the working directory. Third case of capability laundering in MCP ecosystems.