CVE-2026-31841 Raw exposure of database statements in Hyperterse MCP search tool
Attackers can view raw SQL queries via the search tool, exposing internal database statements that should remain hidden.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31841?
CVE-2026-31841 is a medium-severity vulnerability in hyperterse, published on 12 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Hyperterse is a tool-first MCP framework for building AI-ready backend surfaces from declarative config. Prior to v2.2.0, the search tool allows LLMs to search for tools using natural language. While returning results, Hyperterse also returned the raw SQL queries, exposing statements which were supposed to be executed under the hood, and protected from being displayed publicly. This issue has been fixed as of v2.2.0.
Weakness: CWE-433
Which versions are affected by CVE-2026-31841?
2 open source packages ship an affected version, including hyperterse. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
hyperterse npm | From 2.0.0 | 2.2.0 |
hyperterse npm | From 2.0.0 | 2.2.0 |
Products include Hyperterse Hyperterse.
How do I fix CVE-2026-31841?
Upgrade hyperterse to 2.2.0 or later.
Is CVE-2026-31841 being exploited?
There is no known exploitation of CVE-2026-31841 in the wild and no public exploit code.
Sources
Also known as GHSA-92gp-jfgx-9qpv.