Penpot: MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-45805 · Microsoft / collected KEV context

EUVD-2026-44700

GHSA-22qr-rp27-j9wm

cve-program · CVE-2026-45805

• https://github.com/penpot/penpot/security/advisories/GHSA-22qr-rp27-j9wm
• https://github.com/penpot/penpot/issues/9518
• https://github.com/penpot/penpot/commit/798ee46b4a84ee6dfc756b001f33acbe0280d62f
• https://github.com/penpot/penpot/releases/tag/2.15.0

euvd · EUVD-2026-44700

• https://github.com/penpot/penpot/security/advisories/GHSA-22qr-rp27-j9wm
• https://github.com/penpot/penpot/issues/9518
• https://github.com/penpot/penpot/commit/798ee46b4a84ee6dfc756b001f33acbe0280d62f
• https://github.com/penpot/penpot/releases/tag/2.15.0

nvd · CVE-2026-45805

• https://github.com/penpot/penpot/commit/798ee46b4a84ee6dfc756b001f33acbe0280d62f
• https://github.com/penpot/penpot/issues/9518
• https://github.com/penpot/penpot/releases/tag/2.15.0
• https://github.com/penpot/penpot/security/advisories/GHSA-22qr-rp27-j9wm

osv · GHSA-22qr-rp27-j9wm

• https://github.com/penpot/penpot/security/advisories/GHSA-22qr-rp27-j9wm
• https://github.com/penpot/penpot

No related operational record is retained in the current change model.