airtable @airtable/mcp-cli vulnerabilities

Latest airtable @airtable/mcp-cli CVEs

Newest publication first

1. CVE-2026-81101 Airtable MCP CLI before 0.2.5 Credential Disclosure via Unvalidated Configured Endpoint

   Published 2026-08-27

   Medium·CVSS 6.9 EPSS 0.45%

   The configure command accepted any endpoint URL and stored it beside the user's access token. ConfigureCommand.execute in src/cli.ts persisted the value given to its endpoint option into the user profile without passing it through createSafeUrl in src/config.ts, the helper that a...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.