SZB-436d5a6b6f
EUVD lists registry authorization bypass in zuke build system before 1.51.0 (EUVD-2026-114132)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- zuke-build
- Product
- zuke
- First seen
Summary
The EUVD listing says zuke's MCP registry mode accepts command-form registry descriptors without applying the ZUKE_REGISTRY_LAUNCH_HOSTS authorization. It gives a CVSS v3.1 score of 8.0/10 and was last updated 2026-10-30.
If you use zuke-build
Upgrade zuke to version 1.51.0 or later
Review configured MCP registry descriptors for unexpected command entries
Restrict registry launch hosts to trusted sources until patched
What the sources say 1
· Mastodon: “Prior to 1.51.0, the @ Zuke /core MCP registry mode accepts command-form registry descriptors without applying the ZUKE_REGISTRY_LAUNCH_HOSTS authorization enforced for remote module desc” Source