CVE-2026-59563
MEDIUM
NVD
CVSS Score
4.6
Severity
MEDIUM
Published
Sep 28, 2026
Vendor
unknown
Description
Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation tokens were not bound to the target resource identifier, allowing an MCP client or agent to replay a token generated for one resource to affect another resource of the same type. This issue is fixed in version 0.7.2.