# CVE-2026-105806: Payload plugin-mcp privilege escalation via API key management

Source: https://junglewise.ai/threats/cve-2026-105806-payload-is-a-free-and-open-source-headless-content-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-105806 · Severity: high · CVSS 4 · Published 2026-10-06

Payload is a headless content management system. In the MCP plugin (versions 3.61.0–3.87.0), authenticated users could manage API keys belonging to other accounts, enabling account takeover and privilege escalation. An attacker with valid credentials could assume administrative capabilities by modifying another user's API keys.

Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Payload](https://junglewise.ai/threats/vendors/payload).

## Quick answers

**Is CVE-2026-105806 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105806 being exploited in the wild.

**How severe is CVE-2026-105806?** High severity, with a CVSS score of 4, published 6 October 2026.

**Which products and versions are affected?** @payloadcms/plugin-mcp (npm) >= 3.61.0, < 3.88.0, SEMVER:introduced=3.61.0,fixed=3.88.0; Payload Plugin-Mcp 3.61.0 to 3.87.0.

**Is there a fix for CVE-2026-105806?** Yes. @payloadcms/plugin-mcp (npm): upgrade to 3.88.0 or later. Until then: Restrict collection access and the user/owner field to trusted administrators only; override both the create/update/delete/read access controls and the 'user' field configuration in the MCP plugin as documented in the fix commit.</anigation>
<parameter name="timeline">[{"kind":"disclosed", "at":"2026-10-06"}, {"kind":"patched", "at":"2026-08-11", "note":"version 3.88.0 released"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105806 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-105806?** Check whether you run @payloadcms/plugin-mcp (npm) or Payload Plugin-Mcp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @payloadcms/plugin-mcp (npm): upgrade to 3.88.0 or later

  ```sh
  npm install @payloadcms/plugin-mcp@3.88.0
  ```


Restrict collection access and the user/owner field to trusted administrators only; override both the create/update/delete/read access controls and the 'user' field configuration in the MCP plugin as documented in the fix commit.</anigation>
<parameter name="timeline">[{"kind":"disclosed", "at":"2026-10-06"}, {"kind":"patched", "at":"2026-08-11", "note":"version 3.88.0 released"}]

## Technical details

The MCP API key collection in affected versions lacked proper access control, allowing authenticated users to create, update, and delete API keys for any account rather than only their own. The vulnerability requires authentication and affects the api-keys management endpoint. The fix (v3.88.0) restricts key management to the owning user and prevents reassignment of the owner field.

## Affected products

- Payload plugin-mcp 3.61.0 to 3.87.0

## Identifiers

- CVE-2026-105806
- GHSA-2q76-m6w6-qgc6

## References

- [https://github.com/payloadcms/payload/commit/025581d8c5ed836039ad85397288a30f0d3c11c1](https://github.com/payloadcms/payload/commit/025581d8c5ed836039ad85397288a30f0d3c11c1)
- [https://github.com/payloadcms/payload/releases/tag/v3.88.0](https://github.com/payloadcms/payload/releases/tag/v3.88.0)