---
id: CVE-2026-81101
title: >-
  The configure command accepted any endpoint URL and stored it beside the
  user's access token
summary: >-
  The configure command accepted any endpoint URL and stored it beside the
  user's access token. ConfigureCommand.execute in src/cli.ts persisted the
  value given to its endpoint option into the user profile without passing it
  through create…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'
cwe:
  - CWE-200
published: '2026-08-27'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:43:32.537'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-81101'
references:
  - url: 'https://github.com/Airtable/airtable-mcp-cli'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/Airtable/airtable-mcp-cli/pull/17'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/airtable-mcp-cli-before-0.2.5-credential-disclosure-via-unvalidated-configured-endpoint
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00446
epssPercentile: 0.36179
ingestedAt: '2026-09-24T20:51:40.235Z'
---

## Overview

The configure command accepted any endpoint URL and stored it beside the user's access token. ConfigureCommand.execute in src/cli.ts persisted the value given to its endpoint option into the user profile without passing it through createSafeUrl in src/config.ts, the helper that already restricted the environment-variable form of the same setting to the vendor's own hosts over HTTPS. Because the connect path in src/mcp.ts attaches the stored token as a bearer credential on every request to the configured endpoint, a user who was persuaded to run configure with an endpoint of the attacker's choosing sent their personal access token to that destination on each subsequent invocation. Version 0.2.5 applies the same helper to the option.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.