AIKIDO-2026-803826

TL;DR

The roots service accepts arbitrary URI schemes, including file://, without validating the scheme or path, and registers them without authorization checks. Registered roots are returned to every authenticated administrator with no per-team filtering. A scoped user can register local-file URIs that other administrators and MCP clients later dereference, exposing sensitive system paths. The fix validates accepted schemes and applies ownership and per-team authorization to root registration and listing.