What happened
Published 2026-06-30 (CVSS 8.8 High), CVE-2026-58168 is a logic error in DeepTutor's multi-user MCP access control. The function that should return a deny result for absent permissions instead returns None, which propagates as allow-all. The DeepTutor project has 25,000+ GitHub stars. A proof-of-concept pull request (PR #579) was public at the time of disclosure.
Why it matters
MCP tools in AI tutoring platforms can include filesystem access, shell execution, and browser automation. A bypass allowing any low-privilege user — or prompt-injected content from an untrusted document — to invoke these tools results in arbitrary code execution and data exfiltration in the deployment environment. The prompt-injection vector is particularly dangerous in a tutoring context where student-supplied content is routinely ingested.
Attack vector
The allowed_mcp_tools() function in deeptutor/multi_user/tool_access.py returns None when the mcp_tools permission key is absent from a user's grant record. The caller interprets None as unrestricted access (allow-all) rather than deny. A low-privilege user or prompt-injected content can enumerate and invoke any configured MCP tool — including shell execution and filesystem access — without authorization.
Affected systems
HKUDS DeepTutor before 1.4.10
Mitigation
Upgrade to DeepTutor 1.4.10. Fix commit: https://github.com/HKUDS/DeepTutor/commit/90046374b3dcd4f8a866d2d64a64440bc08eb2ef