# CVE-2026-58168: HKUDS DeepTutor authorization bypass in MCP tool access

Source: https://junglewise.ai/threats/cve-2026-58168-hkuds-deeptutor-authorization-bypass-in-mcp-tool-access  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-30. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-58168 · Severity: high · CVSS 8.8 · Published 2026-06-30

DeepTutor, an AI-powered tutoring and agent platform, contains a security flaw where low-privileged users can access powerful system tools they should not be able to reach. This allows an attacker or a malicious AI prompt to bypass restrictions and interact directly with the server's filesystem, web browser, or command shell. Such access could lead to the theft of sensitive data, unauthorized system changes, or full compromise of the server hosting the application.

Technologies: [HKUDS DeepTutor](https://junglewise.ai/threats/technologies/deeptutor). Vendors: [HKUDS](https://junglewise.ai/threats/vendors/hkuds), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-58168 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-58168 being exploited in the wild.

**How severe is CVE-2026-58168?** High severity, with a CVSS score of 8.8, published 30 June 2026.

**Which products and versions are affected?** HKUDS DeepTutor < 1.4.10; deeptutor (PyPI) < 1.4.10, ECOSYSTEM:introduced=0,fixed=1.4.10.

**Is there a fix for CVE-2026-58168?** Yes. deeptutor (PyPI): upgrade to 1.4.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-58168 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-58168?** Check whether you run HKUDS DeepTutor or deeptutor (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- deeptutor (PyPI): upgrade to 1.4.10 or later

  ```sh
  pip install "deeptutor>=1.4.10"
  ```


## Technical details

An authorization bypass exists in DeepTutor's multi-user tool access logic within `deeptutor/multi_user/tool_access.py`. The `allowed_mcp_tools` function incorrectly returned `None` (interpreted as unrestricted access) instead of a denied result when the `mcp_tools` field was omitted from a user's grant configuration. A remote attacker with low-privileged credentials, or a malicious actor using prompt injection, can enumerate and invoke any configured MCP tool. This includes tools for filesystem access, shell execution, and browser interaction, potentially leading to full remote code execution or sensitive resource exposure. The vulnerability is resolved in version 1.4.10 by implementing a 'fail-closed' policy for non-admin users.

## Affected products

- HKUDS DeepTutor < 1.4.10

## Identifiers

- CVE-2026-58168
- GHSA-jg88-rvpc-qvxj
- PYSEC-2026-4206

## Timeline

- 2026-06-21: patched: Version 1.4.10 released and fix PR merged.
- 2026-06-30: disclosed: CVE-2026-58168 published.

## References

- [https://github.com/HKUDS/DeepTutor/commit/90046374b3dcd4f8a866d2d64a64440bc08eb2ef](https://github.com/HKUDS/DeepTutor/commit/90046374b3dcd4f8a866d2d64a64440bc08eb2ef)
- [https://github.com/HKUDS/DeepTutor/pull/579](https://github.com/HKUDS/DeepTutor/pull/579)
- [https://github.com/HKUDS/DeepTutor/releases/tag/v1.4.10](https://github.com/HKUDS/DeepTutor/releases/tag/v1.4.10)
- [https://www.vulncheck.com/advisories/deeptutor-insecure-default-grants-unrestricted-mcp-tool-access-to-non-admin-users](https://www.vulncheck.com/advisories/deeptutor-insecure-default-grants-unrestricted-mcp-tool-access-to-non-admin-users)

## Related threats

- [DeepTutor code injection in shell execution tool](https://junglewise.ai/threats/cve-2026-51881-deeptutor-1-4-0-contains-code-injection-in-exectool-execute)
- [deeptutor path traversal in EditFileTool.execute](https://junglewise.ai/threats/cve-2026-51880-deeptutor-1-4-0-contains-a-path-traversal-issue-in-editfiletool)
- [DeepTutor authorization bypass in TutorBotManager file write](https://junglewise.ai/threats/cve-2026-51879-deeptutor-1-4-0-contains-an-authorization-bypass-through-a-user)
- [DeepTutor authorization bypass in session regeneration](https://junglewise.ai/threats/cve-2026-51878-deeptutor-1-4-0-contains-an-authorization-bypass-through-a-user)
- [DeepTutor authorization bypass in book confirmation](https://junglewise.ai/threats/cve-2026-51876-deeptutor-1-4-0-contains-an-authorization-bypass-vulnerability-in)