{ "query": "", "kind": "vuln", "page": 1, "pages": 7, "pageSize": 24, "total": 167, "results": [ { "kind": "vuln", "slug": "cve-2026-12537", "name": "CVE-2026-12537", "vendor": "Gemini CLI", "description": "Running headless in CI, Gemini CLI automatically trusted whatever workspace folder it was pointed at and loaded configuration from it, including a .gemini/.env file, before the container sandbox came up. A crafted .env reaches the container launcher as an OS command, so an unprivileged attacker who can influence repository contents, for instance through a pull request from a fork, executes code on the CI runner host itself. Found independently by Elad Meged of Novee Security and Dan Lisichkin of Pillar Security through Google's Vulnerability Rewards Program, and presented at Black Hat USA 2026 as one link in a chain that starts from an ordinary GitHub issue and ends at workflow secrets.", "website": "https://thehackernews.com/2026/08/claude-code-and-gemini-cli-flaws-let.html", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "advisory", "capabilities": [], "packaging": null, "configFiles": null, "category": "ci", "updatedAt": "2026-08-07", "risk": { "score": 100, "band": "critical", "signals": [], "dangerousCombos": [] }, "dangerousCombos": [], "vuln": { "id": "CVE-2026-12537", "aliases": [ "ti-071" ], "title": "CVE-2026-12537: Gemini CLI Command Injection Reaches CI Runner Hosts Before the Sandbox Starts (CVSS 10.0)", "summary": "Running headless in CI, Gemini CLI automatically trusted whatever workspace folder it was pointed at and loaded configuration from it, including a .gemini/.env file, before the container sandbox came up. A crafted .env reaches the container launcher as an OS command, so an unprivileged attacker who can influence repository contents, for instance through a pull request from a fork, executes code on the CI runner host itself. Found independently by Elad Meged of Novee Security and Dan Lisichkin of Pillar Security through Google's Vulnerability Rewards Program, and presented at Black Hat USA 2026 as one link in a chain that starts from an ordinary GitHub issue and ends at workflow secrets.", "severity": "critical", "cvss": { "score": 10, "vector": null, "version": null }, "cwe": [], "attackType": [ "Remote code execution" ], "componentType": "ci", "component": { "name": "Gemini CLI", "vendor": null, "package": null, "ecosystem": null, "catalogSlug": "agent/gemini-cli" }, "affected": [ { "range": "Gemini CLI < 0.39.1; google-github-actions/run-gemini-cli < 0.1.22", "fixed": "0.39.1" } ], "exploited": false, "exploitPublic": false, "publishedAt": "2026-08-07", "modifiedAt": "2026-08-07", "lastVerified": "2026-11-01", "references": [ { "type": "article", "url": "https://thehackernews.com/2026/08/claude-code-and-gemini-cli-flaws-let.html" }, { "type": "cve", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12537" } ], "mitigation": "Upgrade Gemini CLI to 0.39.1 or later and run-gemini-cli to 0.1.22 or later. Until then do not run the agent against untrusted branches or forks on shared runners, and treat a .gemini/ directory as executable content in code review rather than as configuration.", "detectedByAnomity": false } }, { "kind": "vuln", "slug": "cve-2026-59726", "name": "CVE-2026-59726", "vendor": "Unauthenticated", "description": "Noma Labs found that Ruflo exposed an MCP bridge with no authentication, letting an unauthenticated attacker reach it directly and execute code with the privileges of the connected agent. Because the bridge is what agents call to reach their tools, control of it converts every connected agent into an administrative foothold. Rated CVSS 10.0 as CVE-2026-59726 (GHSA-c4hm-4h84-2cf3).", "website": "https://noma.security/blog/rufroot-the-mcp-bridge-vulnerability-that-turns-agents-into-rogue-admins-cve-2026-59726/", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "advisory", "capabilities": [], "packaging": null, "configFiles": null, "category": "mcp-server", "updatedAt": "2026-07-29", "risk": { "score": 100, "band": "critical", "signals": [], "dangerousCombos": [] }, "dangerousCombos": [], "vuln": { "id": "CVE-2026-59726", "aliases": [ "ti-063", "GHSA-c4hm-4h84-2cf3" ], "title": "RufRoot: Unauthenticated RCE via an Exposed MCP Bridge Turns Agents Into Rogue Admins (CVSS 10.0)", "summary": "Noma Labs found that Ruflo exposed an MCP bridge with no authentication, letting an unauthenticated attacker reach it directly and execute code with the privileges of the connected agent. Because the bridge is what agents call to reach their tools, control of it converts every connected agent into an administrative foothold. Rated CVSS 10.0 as CVE-2026-59726 (GHSA-c4hm-4h84-2cf3).", "severity": "critical", "cvss": { "score": 10, "vector": null, "version": null }, "cwe": [], "attackType": [ "Remote code execution", "Privilege escalation" ], "componentType": "mcp-server", "component": { "name": "Unauthenticated", "vendor": null, "package": null, "ecosystem": null, "catalogSlug": null }, "affected": [ { "range": null, "fixed": null } ], "exploited": false, "exploitPublic": false, "publishedAt": "2026-07-29", "modifiedAt": "2026-07-29", "lastVerified": "2026-11-01", "references": [ { "type": "article", "url": "https://noma.security/blog/rufroot-the-mcp-bridge-vulnerability-that-turns-agents-into-rogue-admins-cve-2026-59726/" }, { "type": "cve", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59726" }, { "type": "advisory", "url": "https://github.com/advisories/GHSA-c4hm-4h84-2cf3" } ], "mitigation": "Patch Ruflo. Inventory every MCP bridge or gateway reachable on the network, confirm each requires authentication, and bind them to localhost unless there is a specific reason not to. An MCP bridge inherits the blast radius of every agent behind it.", "detectedByAnomity": true } }, { "kind": "vuln", "slug": "cve-2026-77244", "name": "CVE-2026-77244", "vendor": "mcp-atlassian", "description": "NVD published CVE-2026-77244 on 22 September 2026 (GHSA-wrhw-j3f9-8vc6, CVSS 3.1 10.0, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N). Before 0.22.0, the sooperset mcp-atlassian server's HTTP transport accepted requests with no verified user identity: AtlassianOpaqueTokenVerifier accepted any non-empty token, and the Jira/Confluence fetchers fell back to the operator's globally configured credentials. Anyone who could reach the endpoint could call every Atlassian tool, read and write, as the account that deployed the server. 0.22.0 (10 July 2026) returns 401 at the transport boundary and makes global-credential fallback opt-in via ALLOW_GLOBAL_CRED_FALLBACK. A sibling advisory, GHSA-5j8j-256g-vvp5 (published 19 August, GitHub CVSS 10.0, no CVE yet), showed that under `--transport sse` the auth middleware only matched the /mcp path, never /sse or /messages/, so SSE requests skipped authentication entirely and valid headers were dropped; operators who enabled ALLOW_GLOBAL_CRED_FALLBACK to make SSE work put every anonymous request back on the operator token. That path is fixed in 0.23.1. This is a different flaw from CVE-2026-73498 (ti-094, confluence_upload_attachment file read), which needs an authenticated client.", "website": "https://github.com/advisories/GHSA-wrhw-j3f9-8vc6", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "advisory", "capabilities": [], "packaging": { "manager": "unknown", "packageName": "mcp-atlassian", "command": null }, "configFiles": null, "category": "mcp-server", "updatedAt": "2026-09-22", "risk": { "score": 100, "band": "critical", "signals": [], "dangerousCombos": [] }, "dangerousCombos": [], "vuln": { "id": "CVE-2026-77244", "aliases": [ "ti-112", "GHSA-wrhw-j3f9-8vc6" ], "title": "CVE-2026-77244: mcp-atlassian Over HTTP Ran Anonymous Requests as the Operator, and the SSE Transport Stayed Open Until 0.23.1 (CVSS 10.0)", "summary": "NVD published CVE-2026-77244 on 22 September 2026 (GHSA-wrhw-j3f9-8vc6, CVSS 3.1 10.0, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N). Before 0.22.0, the sooperset mcp-atlassian server's HTTP transport accepted requests with no verified user identity: AtlassianOpaqueTokenVerifier accepted any non-empty token, and the Jira/Confluence fetchers fell back to the operator's globally configured credentials. Anyone who could reach the endpoint could call every Atlassian tool, read and write, as the account that deployed the server. 0.22.0 (10 July 2026) returns 401 at the transport boundary and makes global-credential fallback opt-in via ALLOW_GLOBAL_CRED_FALLBACK. A sibling advisory, GHSA-5j8j-256g-vvp5 (published 19 August, GitHub CVSS 10.0, no CVE yet), showed that under `--transport sse` the auth middleware only matched the /mcp path, never /sse or /messages/, so SSE requests skipped authentication entirely and valid headers were dropped; operators who enabled ALLOW_GLOBAL_CRED_FALLBACK to make SSE work put every anonymous request back on the operator token. That path is fixed in 0.23.1. This is a different flaw from CVE-2026-73498 (ti-094, confluence_upload_attachment file read), which needs an authenticated client.", "severity": "critical", "cvss": { "score": 10, "vector": null, "version": null }, "cwe": [], "attackType": [ "Authentication bypass" ], "componentType": "mcp-server", "component": { "name": "mcp-atlassian", "vendor": null, "package": "mcp-atlassian", "ecosystem": null, "catalogSlug": null }, "affected": [ { "range": "<0.23.1", "fixed": "0.23.1" } ], "exploited": false, "exploitPublic": false, "publishedAt": "2026-09-22", "modifiedAt": "2026-09-22", "lastVerified": "2026-11-01", "references": [ { "type": "advisory", "url": "https://github.com/advisories/GHSA-wrhw-j3f9-8vc6" }, { "type": "cve", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77244" } ], "mitigation": "Upgrade mcp-atlassian to 0.23.1 or later (0.22.0 alone leaves the SSE path open), and rebuild any container image built before 19 August 2026. Leave ALLOW_GLOBAL_CRED_FALLBACK off; if a shared HTTP/SSE deployment only worked with it on, that deployment was running every anonymous caller as the operator. Prefer per-user stdio servers for developer agents; where a shared HTTP server is required, bind it to a private network behind an authenticating proxy. If an affected version was reachable beyond localhost, rotate the operator's Atlassian API token or PAT and review Jira and Confluence audit logs for changes made by that account that no human requested.", "detectedByAnomity": true } }, { "kind": "vuln", "slug": "cve-2026-87987", "name": "CVE-2026-87987", "vendor": "mistral-vibe", "description": "HiddenLayer published two advisories on 11 September 2026, credited to Esteban Tonglet, for permission-check bypasses in the Bash tool of Mistral Vibe. CVE-2026-87987 (CVSS 4.0 10.0): the permission check stripped leading environment-variable assignments before matching a command against its allowlist, but the shell still applied them, so an allowlisted command such as `git diff --ext-diff` with GIT_EXTERNAL_DIFF set, or `cat` with a modified PATH, ran attacker-chosen code with no approval prompt. CVE-2026-87984 (CVSS 4.0 9.3): redirect targets were left out of the workspace path check, so `echo x > /tmp/pwned` wrote outside the workspace without a prompt. SecMate independently reported the same class on 5 September and published on 23 September, demonstrating delivery through a hostile repository that ended with the victim's Mistral token exfiltrated. Per Mistral's advisory MAI-2026-003 as reproduced by SecMate, CVE-2026-87984 affects 1.3.4 to 2.25.3 and CVE-2026-87987 affects 2.6.0 to 2.25.3, both fixed in 2.25.4 (12 September), which makes the shell analysis fail closed; Mistral added further hardening through 2.25.8 and recommends that version. NVD records list no upper bound.", "website": "https://www.hiddenlayer.com/sai-security-advisory/2026-09-mistral-vibe5", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "advisory", "capabilities": [], "packaging": { "manager": "unknown", "packageName": "mistral-vibe", "command": null }, "configFiles": null, "category": "package", "updatedAt": "2026-09-11", "risk": { "score": 100, "band": "critical", "signals": [], "dangerousCombos": [] }, "dangerousCombos": [], "vuln": { "id": "CVE-2026-87987", "aliases": [ "ti-121" ], "title": "Mistral Vibe Shell Permission Bypass: Env-Var Prefix RCE and Unchecked Redirect File Write (CVE-2026-87987 CVSS 10.0, CVE-2026-87984 CVSS 9.3)", "summary": "HiddenLayer published two advisories on 11 September 2026, credited to Esteban Tonglet, for permission-check bypasses in the Bash tool of Mistral Vibe. CVE-2026-87987 (CVSS 4.0 10.0): the permission check stripped leading environment-variable assignments before matching a command against its allowlist, but the shell still applied them, so an allowlisted command such as `git diff --ext-diff` with GIT_EXTERNAL_DIFF set, or `cat` with a modified PATH, ran attacker-chosen code with no approval prompt. CVE-2026-87984 (CVSS 4.0 9.3): redirect targets were left out of the workspace path check, so `echo x > /tmp/pwned` wrote outside the workspace without a prompt. SecMate independently reported the same class on 5 September and published on 23 September, demonstrating delivery through a hostile repository that ended with the victim's Mistral token exfiltrated. Per Mistral's advisory MAI-2026-003 as reproduced by SecMate, CVE-2026-87984 affects 1.3.4 to 2.25.3 and CVE-2026-87987 affects 2.6.0 to 2.25.3, both fixed in 2.25.4 (12 September), which makes the shell analysis fail closed; Mistral added further hardening through 2.25.8 and recommends that version. NVD records list no upper bound.", "severity": "critical", "cvss": { "score": 10, "vector": null, "version": null }, "cwe": [], "attackType": [ "Remote code execution", "Prompt injection" ], "componentType": "package", "component": { "name": "mistral-vibe", "vendor": null, "package": "mistral-vibe", "ecosystem": null, "catalogSlug": "agent/mistral-vibe" }, "affected": [ { "range": ">=1.3.4 <2.25.4", "fixed": "2.25.8" } ], "exploited": false, "exploitPublic": false, "publishedAt": "2026-09-11", "modifiedAt": "2026-09-11", "lastVerified": "2026-11-01", "references": [ { "type": "article", "url": "https://www.hiddenlayer.com/sai-security-advisory/2026-09-mistral-vibe5" }, { "type": "cve", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87987" } ], "mitigation": "Upgrade Mistral Vibe to 2.25.8 or later, restart active sessions and confirm with `vibe --version`. Until every install is upgraded, do not let Vibe work on untrusted repositories, submodules or issue content, since the attack starts from repository text the model reads. Keep MISTRAL_API_KEY and other high-value credentials out of the agent's environment unless the task needs them, and rotate the Mistral token on machines that ran vulnerable versions against untrusted code. Run the agent inside an OS or container sandbox rather than relying on its command-approval logic as the boundary.", "detectedByAnomity": false } }, { "kind": "vuln", "slug": "cve-2026-102911", "name": "CVE-2026-102911", "vendor": "@zosmaai/pi-llm-wiki", "description": "NVD published two OS command injection CVEs in MCP servers on 30 September 2026, both assigned by VulDB from public issue reports with PoCs. CVE-2026-102911 (CVSS 3.1 9.9, CVSS 4.0 8.6) affects zosmaai pi-llm-wiki up to 0.11.7, a knowledge-base extension for the Pi coding agent: its wiki_capture_source MCP tool interpolated the `url` argument into a `sh -c` command running markitdown, so a crafted URL, which an agent can be talked into passing from untrusted content, ran shell commands as the developer. The maintainer fixed it within about a day of the 31 August report, in 0.11.8 (1 September), by passing argv directly, but the fix appeared as a single changelog line with no advisory. CVE-2026-102906 (CVSS 3.1 6.3) affects 0xshariq github-mcp-server up to commit 52e764a: its git_remove tool builds `git reset HEAD \"${file}\"` and hands it to child_process.exec without the sanitiser some other tools in the same file call. The project uses rolling releases, the report has been open since 31 August without a maintainer response, and there is no fix. Both GitHub advisories (GHSA-jcgm-7m3g-h3cx, GHSA-7v7v-c4gg-gf73) are unreviewed with no package mapping, so npm audit and OSV return nothing for the affected versions. Not to be confused with GitHub's official github-mcp-server.", "website": "https://nvd.nist.gov/vuln/detail/CVE-2026-102911", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "advisory", "capabilities": [], "packaging": { "manager": "unknown", "packageName": "@zosmaai/pi-llm-wiki", "command": null }, "configFiles": null, "category": "mcp-server", "updatedAt": "2026-09-30", "risk": { "score": 99, "band": "critical", "signals": [], "dangerousCombos": [] }, "dangerousCombos": [], "vuln": { "id": "CVE-2026-102911", "aliases": [ "ti-118", "GHSA-jcgm-7m3g-h3cx" ], "title": "CVE-2026-102911: pi-llm-wiki's wiki_capture_source MCP Tool Put a URL Inside `sh -c` (CVSS 9.9); github-mcp-server git_remove Is Unpatched", "summary": "NVD published two OS command injection CVEs in MCP servers on 30 September 2026, both assigned by VulDB from public issue reports with PoCs. CVE-2026-102911 (CVSS 3.1 9.9, CVSS 4.0 8.6) affects zosmaai pi-llm-wiki up to 0.11.7, a knowledge-base extension for the Pi coding agent: its wiki_capture_source MCP tool interpolated the `url` argument into a `sh -c` command running markitdown, so a crafted URL, which an agent can be talked into passing from untrusted content, ran shell commands as the developer. The maintainer fixed it within about a day of the 31 August report, in 0.11.8 (1 September), by passing argv directly, but the fix appeared as a single changelog line with no advisory. CVE-2026-102906 (CVSS 3.1 6.3) affects 0xshariq github-mcp-server up to commit 52e764a: its git_remove tool builds `git reset HEAD \"${file}\"` and hands it to child_process.exec without the sanitiser some other tools in the same file call. The project uses rolling releases, the report has been open since 31 August without a maintainer response, and there is no fix. Both GitHub advisories (GHSA-jcgm-7m3g-h3cx, GHSA-7v7v-c4gg-gf73) are unreviewed with no package mapping, so npm audit and OSV return nothing for the affected versions. Not to be confused with GitHub's official github-mcp-server.", "severity": "critical", "cvss": { "score": 9.9, "vector": null, "version": null }, "cwe": [], "attackType": [ "Command injection" ], "componentType": "mcp-server", "component": { "name": "@zosmaai/pi-llm-wiki", "vendor": null, "package": "@zosmaai/pi-llm-wiki", "ecosystem": null, "catalogSlug": null }, "affected": [ { "range": "<0.11.8", "fixed": "0.11.8" } ], "exploited": false, "exploitPublic": false, "publishedAt": "2026-09-30", "modifiedAt": "2026-09-30", "lastVerified": "2026-11-01", "references": [ { "type": "cve", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102911" }, { "type": "advisory", "url": "https://github.com/advisories/GHSA-jcgm-7m3g-h3cx" } ], "mitigation": "Upgrade pi-llm-wiki to 0.11.8 or later and check the version actually pinned in Pi's extension config rather than the changelog. Remove 0xshariq/github-mcp-server or at least disable its git_remove tool: there is no patch and the maintainer has not responded; confirm you are not confusing it with GitHub's official github-mcp-server before acting. Inventory MCP servers from agent host configs and extension directories rather than package manifests, since these advisories carry no package mapping and SCA tools report them clean. Require approval for MCP tools that take URLs or file names and touch a shell, and treat any MCP tool argument as attacker-influenced when the agent has read untrusted content.", "detectedByAnomity": true } }, { "kind": "vuln", "slug": "cve-2026-105697", "name": "CVE-2026-105697", "vendor": "langflow", "description": "Langflow published GHSA-w794-rj3p-xv45 on 28 September 2026, and NVD published CVE-2026-105697 on 5 October with a CVSS 3.1 score of 9.9. Before 1.10.3, the MCP stdio transport launched whatever command and args a user put in an MCP server configuration, with no allowlist, wrapped in `bash -c \"exec {command} ...\"`. Any user who could reach Settings > MCP Servers, the POST/PATCH /api/v2/mcp/servers/{server_name} API, or the MCP Tools component in a flow could run a command as the Langflow process user, and it runs as soon as Langflow tries to connect, even when the UI reports that the server failed to start. With the default LANGFLOW_AUTO_LOGIN=true, GET /api/v1/auto_login issues a token without credentials, so an exposed default instance needs no account; with auto-login off, any authenticated non-admin user can exploit it. An earlier advisory (GHSA-7w94-79vh-5mr2, CVE-2026-105740, 10 September) was fixed in 1.9.0 by an allowlist at the REST model only, so 1.9.0 to 1.10.2 remain exploitable through MCP configs embedded in flows or passed as tweaks; 1.10.3 enforces the policy at execution and removes the shell. The advisory is in the GitHub Advisory Database and OSV, and the reporter says they found several internet-facing vulnerable servers.", "website": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-w794-rj3p-xv45", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "advisory", "capabilities": [], "packaging": { "manager": "unknown", "packageName": "langflow", "command": null }, "configFiles": null, "category": "mcp-server", "updatedAt": "2026-09-28", "risk": { "score": 99, "band": "critical", "signals": [], "dangerousCombos": [] }, "dangerousCombos": [], "vuln": { "id": "CVE-2026-105697", "aliases": [ "ti-126", "GHSA-w794-rj3p-xv45" ], "title": "CVE-2026-105697: Langflow Ran Any OS Command Placed in an MCP stdio Server Config (CVSS 9.9); the 1.9.0 Fix Was Incomplete Until 1.10.3", "summary": "Langflow published GHSA-w794-rj3p-xv45 on 28 September 2026, and NVD published CVE-2026-105697 on 5 October with a CVSS 3.1 score of 9.9. Before 1.10.3, the MCP stdio transport launched whatever command and args a user put in an MCP server configuration, with no allowlist, wrapped in `bash -c \"exec {command} ...\"`. Any user who could reach Settings > MCP Servers, the POST/PATCH /api/v2/mcp/servers/{server_name} API, or the MCP Tools component in a flow could run a command as the Langflow process user, and it runs as soon as Langflow tries to connect, even when the UI reports that the server failed to start. With the default LANGFLOW_AUTO_LOGIN=true, GET /api/v1/auto_login issues a token without credentials, so an exposed default instance needs no account; with auto-login off, any authenticated non-admin user can exploit it. An earlier advisory (GHSA-7w94-79vh-5mr2, CVE-2026-105740, 10 September) was fixed in 1.9.0 by an allowlist at the REST model only, so 1.9.0 to 1.10.2 remain exploitable through MCP configs embedded in flows or passed as tweaks; 1.10.3 enforces the policy at execution and removes the shell. The advisory is in the GitHub Advisory Database and OSV, and the reporter says they found several internet-facing vulnerable servers.", "severity": "critical", "cvss": { "score": 9.9, "vector": null, "version": null }, "cwe": [], "attackType": [ "Remote code execution", "Command injection" ], "componentType": "mcp-server", "component": { "name": "langflow", "vendor": null, "package": "langflow", "ecosystem": null, "catalogSlug": null }, "affected": [ { "range": ">=1.1.2 <1.10.3", "fixed": "1.10.3" } ], "exploited": false, "exploitPublic": false, "publishedAt": "2026-09-28", "modifiedAt": "2026-09-28", "lastVerified": "2026-11-01", "references": [ { "type": "advisory", "url": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-w794-rj3p-xv45" }, { "type": "cve", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105697" } ], "mitigation": "Upgrade langflow and lfx to 1.10.3 or later and langflow-base to 0.10.3 or later; do not treat 1.9.x as safe. Set LANGFLOW_AUTO_LOGIN=false on any instance reachable from a network and remove direct internet exposure. On multi-tenant deployments set LANGFLOW_MCP_SERVER_ALLOWED_PACKAGES, LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING=true and LANGFLOW_MCP_SERVER_DOCKER_HARDENING=true, and on 1.11.1+ restrict custom code (LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY=true), which also limits MCP stdio servers to superusers. Review existing MCP server configs and flows for unexpected stdio commands, and treat any exposed vulnerable host as possibly compromised.", "detectedByAnomity": true } }, { "kind": "vuln", "slug": "cve-2026-105740", "name": "CVE-2026-105740", "vendor": "langflow", "description": "Previdian reported on 15 October 2026 that CVE-2026-105740 (GHSA-7w94-79vh-5mr2, CVSS 9.9) is being exploited. It is the Langflow flaw in which any authenticated user could add an MCP server with the stdio transport and have its command field run through bash -c. Previdian rates the exploitation confirmed from its own sensors, first observed on 19 September 2026 and still observed on 19 October, and notes that the CVE is not in CISA KEV; its exploitation-signals table listed about 2,000 attempts by 19 October. According to reporting on Previdian's findings, the attackers checked the Langflow version, tried /api/v1/auto_login and signed in with common credentials before registering the MCP server, then read environment variables including LANGFLOW_SECRET_KEY and LANGFLOW_SUPERUSER_PASSWORD and sent them to an external host. Because a stored command runs whenever the server list is fetched, a planted entry also fires for other users and for admins. The flaw is fixed in 1.9.0, but a second command injection in the same transport, CVE-2026-105697 (covered in an earlier entry), needs 1.10.3.", "website": "https://previdian.com/CVE-2026-105740", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "advisory", "capabilities": [], "packaging": { "manager": "unknown", "packageName": "langflow", "command": null }, "configFiles": null, "category": "mcp-server", "updatedAt": "2026-10-15", "risk": { "score": 99, "band": "critical", "signals": [], "dangerousCombos": [] }, "dangerousCombos": [], "vuln": { "id": "CVE-2026-105740", "aliases": [ "ti-144", "GHSA-7w94-79vh-5mr2" ], "title": "CVE-2026-105740: Langflow's MCP Stdio Command Injection Is Exploited in the Wild, With Payloads Reading LANGFLOW_SECRET_KEY", "summary": "Previdian reported on 15 October 2026 that CVE-2026-105740 (GHSA-7w94-79vh-5mr2, CVSS 9.9) is being exploited. It is the Langflow flaw in which any authenticated user could add an MCP server with the stdio transport and have its command field run through bash -c. Previdian rates the exploitation confirmed from its own sensors, first observed on 19 September 2026 and still observed on 19 October, and notes that the CVE is not in CISA KEV; its exploitation-signals table listed about 2,000 attempts by 19 October. According to reporting on Previdian's findings, the attackers checked the Langflow version, tried /api/v1/auto_login and signed in with common credentials before registering the MCP server, then read environment variables including LANGFLOW_SECRET_KEY and LANGFLOW_SUPERUSER_PASSWORD and sent them to an external host. Because a stored command runs whenever the server list is fetched, a planted entry also fires for other users and for admins. The flaw is fixed in 1.9.0, but a second command injection in the same transport, CVE-2026-105697 (covered in an earlier entry), needs 1.10.3.", "severity": "critical", "cvss": { "score": 9.9, "vector": null, "version": null }, "cwe": [], "attackType": [ "Remote code execution" ], "componentType": "mcp-server", "component": { "name": "langflow", "vendor": null, "package": "langflow", "ecosystem": null, "catalogSlug": null }, "affected": [ { "range": "<1.9.0", "fixed": "1.10.3" } ], "exploited": true, "exploitPublic": false, "publishedAt": "2026-10-15", "modifiedAt": "2026-10-15", "lastVerified": "2026-11-01", "references": [ { "type": "article", "url": "https://previdian.com/CVE-2026-105740" }, { "type": "cve", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105740" }, { "type": "advisory", "url": "https://github.com/advisories/GHSA-7w94-79vh-5mr2" } ], "mitigation": "Upgrade Langflow to 1.10.3 or later, which closes both MCP stdio command injections. Until then, take internet-facing instances offline or put them behind authentication, disable auto-login (LANGFLOW_AUTO_LOGIN=false), and replace default or weak passwords. Review stored MCP server entries for ones nobody added, and logs for requests to /api/v1/auto_login and /api/v2/mcp/servers/. On any instance that was reachable while unpatched, rotate LANGFLOW_SECRET_KEY, the superuser password and every API key or credential stored in flows, and check the host for further compromise.", "detectedByAnomity": true } }, { "kind": "vuln", "slug": "cve-2026-114612", "name": "CVE-2026-114612", "vendor": "litellm", "description": "NVD published CVE-2026-114612 on 22 October 2026 (CVSS 9.9, GitHub advisory GHSA-7hp6-4w63-5g45). From 1.87.0, the LiteLLM proxy used one cryptographic context both to encrypt secrets at rest and to issue session tokens. An authenticated internal user could put crafted metadata containing a forged proxy-administrator credential through the API-key flow, get it back encrypted, and replay that ciphertext as a bearer token; the proxy then trusted the forged admin identity, which gave administrative access and arbitrary commands through the MCP stdio endpoint. Versions 1.87.0 to 1.90.x are exposed only with EXPERIMENTAL_UI_LOGIN enabled; from 1.91.0 the default configuration is exploitable. It is fixed in 1.100.4, 1.101.3, 1.102.2, 1.103.1 and 1.104.0-rc.2. This is separate from the 1.107.0 supply-chain compromise published the day before.", "website": "https://nvd.nist.gov/vuln/detail/CVE-2026-114612", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "advisory", "capabilities": [], "packaging": { "manager": "unknown", "packageName": "litellm", "command": null }, "configFiles": null, "category": "mcp-server", "updatedAt": "2026-10-22", "risk": { "score": 99, "band": "critical", "signals": [], "dangerousCombos": [] }, "dangerousCombos": [], "vuln": { "id": "CVE-2026-114612", "aliases": [ "ti-151", "GHSA-7hp6-4w63-5g45" ], "title": "CVE-2026-114612: LiteLLM Proxy Encrypted a Forged Admin Credential With the Key It Trusts for Sessions, Giving Any Internal User Admin and Command Execution Through MCP stdio (CVSS 9.9)", "summary": "NVD published CVE-2026-114612 on 22 October 2026 (CVSS 9.9, GitHub advisory GHSA-7hp6-4w63-5g45). From 1.87.0, the LiteLLM proxy used one cryptographic context both to encrypt secrets at rest and to issue session tokens. An authenticated internal user could put crafted metadata containing a forged proxy-administrator credential through the API-key flow, get it back encrypted, and replay that ciphertext as a bearer token; the proxy then trusted the forged admin identity, which gave administrative access and arbitrary commands through the MCP stdio endpoint. Versions 1.87.0 to 1.90.x are exposed only with EXPERIMENTAL_UI_LOGIN enabled; from 1.91.0 the default configuration is exploitable. It is fixed in 1.100.4, 1.101.3, 1.102.2, 1.103.1 and 1.104.0-rc.2. This is separate from the 1.107.0 supply-chain compromise published the day before.", "severity": "critical", "cvss": { "score": 9.9, "vector": null, "version": null }, "cwe": [], "attackType": [ "Remote code execution", "Authentication bypass", "Privilege escalation" ], "componentType": "mcp-server", "component": { "name": "litellm", "vendor": null, "package": "litellm", "ecosystem": null, "catalogSlug": null }, "affected": [ { "range": ">=1.87.0 <1.100.4 || >=1.101.0 <1.101.3 || >=1.102.0 <1.102.2 || >=1.103.0 <1.103.1 || >=1.104.0-rc.0 <1.104.0-rc.2", "fixed": "1.100.4" } ], "exploited": false, "exploitPublic": false, "publishedAt": "2026-10-22", "modifiedAt": "2026-10-22", "lastVerified": "2026-11-01", "references": [ { "type": "cve", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114612" }, { "type": "advisory", "url": "https://github.com/advisories/GHSA-7hp6-4w63-5g45" } ], "mitigation": "Upgrade the proxy to 1.100.4, 1.101.3, 1.102.2, 1.103.1 or a later release, but not 1.107.0, the compromised build: pin 1.106.2 or a verified later version. Rotate the proxy master key and any keys or session tokens issued while vulnerable, and review the admin audit log for keys created with unexpected metadata, admin actions by non-admin users, and MCP stdio servers added or invoked through the proxy. Because an admin on this proxy can run commands on its host, restrict the UI and API to the networks that need them and treat the proxy host as holding every provider key it stores.", "detectedByAnomity": true } }, { "kind": "vuln", "slug": "ghsa-rqfc-q7j9-5v59", "name": "GHSA-rqfc-q7j9-5v59", "vendor": "omnigent", "description": "Omnigent, an open-source agent meta-harness that orchestrates Claude Code, Codex, Cursor and other agents with policies and sandboxing (omnigent on PyPI), published six GitHub security advisories on 13 and 14 October 2026, none with a CVE. Critical: GHSA-rqfc-q7j9-5v59 (CVSS 3.1 9.9), session imports could use another user's host without authorization (0.13.0.dev20260902 up to 0.18.0); and GHSA-x6v6-fg8x-997h (9.4), the default header authentication trusted a client-controlled X-Forwarded-Email header and allowed remote user impersonation (before 0.7.0). High: GHSA-v3vj-mch3-x6c2 (8.8), a sandbox launcher isolation failure that permitted host-level code execution; GHSA-jw77-57v9-jmcm (8.8), uploaded source tools running code with runner privileges; GHSA-h6vq-3549-mppq (8.3), git commands bypassing repository and branch policies; and GHSA-m3m2-42jg-grrv (CVSS 4.0 7.6), shell commands bypassing configured agent policies. All but the header issue are fixed in 0.18.0, published on 13 October. They follow three September advisories (GHSA-598r-29w2-g93q, critical, and two high) about os_env.cwd workspace escapes, fixed in 0.14.0.", "website": "https://github.com/omnigent-ai/omnigent/security/advisories/GHSA-rqfc-q7j9-5v59", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "advisory", "capabilities": [], "packaging": { "manager": "unknown", "packageName": "omnigent", "command": null }, "configFiles": null, "category": "package", "updatedAt": "2026-10-13", "risk": { "score": 99, "band": "critical", "signals": [], "dangerousCombos": [] }, "dangerousCombos": [], "vuln": { "id": "GHSA-rqfc-q7j9-5v59", "aliases": [ "ti-146" ], "title": "Omnigent 0.18.0 Fixes Six Advisories, Two Critical: Session Imports Could Use Another User's Host, and Header Auth Trusted a Client-Set X-Forwarded-Email", "summary": "Omnigent, an open-source agent meta-harness that orchestrates Claude Code, Codex, Cursor and other agents with policies and sandboxing (omnigent on PyPI), published six GitHub security advisories on 13 and 14 October 2026, none with a CVE. Critical: GHSA-rqfc-q7j9-5v59 (CVSS 3.1 9.9), session imports could use another user's host without authorization (0.13.0.dev20260902 up to 0.18.0); and GHSA-x6v6-fg8x-997h (9.4), the default header authentication trusted a client-controlled X-Forwarded-Email header and allowed remote user impersonation (before 0.7.0). High: GHSA-v3vj-mch3-x6c2 (8.8), a sandbox launcher isolation failure that permitted host-level code execution; GHSA-jw77-57v9-jmcm (8.8), uploaded source tools running code with runner privileges; GHSA-h6vq-3549-mppq (8.3), git commands bypassing repository and branch policies; and GHSA-m3m2-42jg-grrv (CVSS 4.0 7.6), shell commands bypassing configured agent policies. All but the header issue are fixed in 0.18.0, published on 13 October. They follow three September advisories (GHSA-598r-29w2-g93q, critical, and two high) about os_env.cwd workspace escapes, fixed in 0.14.0.", "severity": "critical", "cvss": { "score": 9.9, "vector": null, "version": "3.1" }, "cwe": [], "attackType": [ "Authentication bypass", "Sandbox escape" ], "componentType": "package", "component": { "name": "omnigent", "vendor": null, "package": "omnigent", "ecosystem": null, "catalogSlug": "agent/omnigent" }, "affected": [ { "range": "<0.18.0", "fixed": "0.18.0" } ], "exploited": false, "exploitPublic": false, "publishedAt": "2026-10-13", "modifiedAt": "2026-10-13", "lastVerified": "2026-11-01", "references": [ { "type": "advisory", "url": "https://github.com/omnigent-ai/omnigent/security/advisories/GHSA-rqfc-q7j9-5v59" } ], "mitigation": "Upgrade omnigent to 0.18.0 or later and restart its server, agent and runner processes. If you rely on header authentication, make sure only your authenticating proxy can reach the server and that the proxy strips any client-supplied X-Forwarded-Email. Do not treat Omnigent shell or git policies as a security boundary on unpatched versions. Review session imports, uploaded tools and git activity for actions outside each user's own hosts and repositories, and rotate the credentials available to runners.", "detectedByAnomity": false } }, { "kind": "vuln", "slug": "cve-2025-6514", "name": "CVE-2025-6514", "vendor": "opencode-ai", "description": "Pillar Security (Eilon Cohen) disclosed on 4 October 2026 a remote code execution flaw in opencode (opencode-ai on npm) on Windows and WSL. When a remote MCP server asks for authorization, the client runs OAuth discovery and opens the authorization_endpoint the server supplies in the browser. opencode 1.0.137 to 1.18.32 passed that string, with no scheme or origin check, to the open package pinned at 10.1.2, which on Windows builds a PowerShell -EncodedCommand line without escaping the target. PowerShell expands $(...) inside double-quoted strings, so an ordinary https:// URL carrying a subexpression runs code during the automatic handshake, with no prompt injection and no further user action. Scheme validation does not stop it, including the MCP TypeScript SDK's javascript:/data:/vbscript: denylist and the scheme check opencode itself added; what closed it was upgrading open to 11.0.4, which single-quotes the target. Pillar reported privately on 29 August. The fix (PR 51414, released in 1.18.33 on 28 September) shipped as a refactor, and the vendor, Anomaly, published no advisory and requested no CVE, saying malicious MCP servers are outside its threat model, so scanners and dependency bots will not flag affected installs. A server that was harmless when configured can deliver the payload later, after a compromise, a hijacked registry entry or an expired domain. macOS and Linux are not affected. Pillar proposes CVSS 3.1 9.8; the defect class is the same as CVE-2025-6514 in mcp-remote.", "website": "https://www.pillar.security/blog/open-and-shut-remote-code-execution-in-opencode-via-mcp-oauth", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "advisory", "capabilities": [], "packaging": { "manager": "unknown", "packageName": "opencode-ai", "command": null }, "configFiles": null, "category": "mcp-server", "updatedAt": "2026-10-04", "risk": { "score": 98, "band": "critical", "signals": [], "dangerousCombos": [] }, "dangerousCombos": [], "vuln": { "id": "CVE-2025-6514", "aliases": [ "ti-140" ], "title": "opencode on Windows and WSL: A Remote MCP Server's OAuth authorization_endpoint Ran PowerShell on Connect, Fixed Quietly in 1.18.33 With No Advisory or CVE", "summary": "Pillar Security (Eilon Cohen) disclosed on 4 October 2026 a remote code execution flaw in opencode (opencode-ai on npm) on Windows and WSL. When a remote MCP server asks for authorization, the client runs OAuth discovery and opens the authorization_endpoint the server supplies in the browser. opencode 1.0.137 to 1.18.32 passed that string, with no scheme or origin check, to the open package pinned at 10.1.2, which on Windows builds a PowerShell -EncodedCommand line without escaping the target. PowerShell expands $(...) inside double-quoted strings, so an ordinary https:// URL carrying a subexpression runs code during the automatic handshake, with no prompt injection and no further user action. Scheme validation does not stop it, including the MCP TypeScript SDK's javascript:/data:/vbscript: denylist and the scheme check opencode itself added; what closed it was upgrading open to 11.0.4, which single-quotes the target. Pillar reported privately on 29 August. The fix (PR 51414, released in 1.18.33 on 28 September) shipped as a refactor, and the vendor, Anomaly, published no advisory and requested no CVE, saying malicious MCP servers are outside its threat model, so scanners and dependency bots will not flag affected installs. A server that was harmless when configured can deliver the payload later, after a compromise, a hijacked registry entry or an expired domain. macOS and Linux are not affected. Pillar proposes CVSS 3.1 9.8; the defect class is the same as CVE-2025-6514 in mcp-remote.", "severity": "critical", "cvss": { "score": 9.8, "vector": null, "version": "3.1" }, "cwe": [], "attackType": [ "Remote code execution", "Command injection" ], "componentType": "mcp-server", "component": { "name": "opencode-ai", "vendor": null, "package": "opencode-ai", "ecosystem": null, "catalogSlug": null }, "affected": [ { "range": ">=1.0.137 <1.18.33", "fixed": "1.18.33" } ], "exploited": false, "exploitPublic": false, "publishedAt": "2026-10-04", "modifiedAt": "2026-10-04", "lastVerified": "2026-11-01", "references": [ { "type": "article", "url": "https://www.pillar.security/blog/open-and-shut-remote-code-execution-in-opencode-via-mcp-oauth" }, { "type": "cve", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6514" } ], "mitigation": "Upgrade opencode to 1.18.33 or later (1.19.3 was current on 19 October 2026) on every Windows and WSL machine, and inventory installs directly, because there is no CVE for scanners to match. Until a machine is upgraded, remove remote MCP servers you have not vetted from its opencode config. If you build an MCP client, launch the browser with an argument vector rather than a shell command line, use open 11.x or later, and bind OAuth discovery to the origin of the configured server; a scheme allowlist on its own is not enough.", "detectedByAnomity": true } }, { "kind": "vuln", "slug": "cve-2026-33032", "name": "CVE-2026-33032", "vendor": "nginx-ui", "description": "nginx-ui's MCP message endpoint shipped without any authentication on the command-execution path, allowing unauthenticated attackers to restart the nginx service, modify configuration files, or push arbitrary changes, a complete control-plane takeover. The flaw is reachable from any host that can hit the nginx-ui port, which in many cloud deployments is the public internet. Patched in nginx-ui 2.6.5; CISA flagged it for high-priority remediation.", "website": "https://nvd.nist.gov/vuln/detail/CVE-2026-33032", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "advisory", "capabilities": [], "packaging": { "manager": "unknown", "packageName": "nginx-ui", "command": null }, "configFiles": null, "category": "mcp-server", "updatedAt": "2026-05-07", "risk": { "score": 98, "band": "critical", "signals": [], "dangerousCombos": [] }, "dangerousCombos": [], "vuln": { "id": "CVE-2026-33032", "aliases": [ "ti-020" ], "title": "CVE-2026-33032: nginx-ui MCP Endpoint Authentication Bypass (CVSS 9.8)", "summary": "nginx-ui's MCP message endpoint shipped without any authentication on the command-execution path, allowing unauthenticated attackers to restart the nginx service, modify configuration files, or push arbitrary changes, a complete control-plane takeover. The flaw is reachable from any host that can hit the nginx-ui port, which in many cloud deployments is the public internet. Patched in nginx-ui 2.6.5; CISA flagged it for high-priority remediation.", "severity": "critical", "cvss": { "score": 9.8, "vector": null, "version": null }, "cwe": [], "attackType": [ "Remote code execution", "Authentication bypass" ], "componentType": "mcp-server", "component": { "name": "nginx-ui", "vendor": null, "package": "nginx-ui", "ecosystem": null, "catalogSlug": null }, "affected": [ { "range": "<2.6.5", "fixed": "2.6.5" } ], "exploited": false, "exploitPublic": false, "publishedAt": "2026-05-07", "modifiedAt": "2026-05-07", "lastVerified": "2026-11-01", "references": [ { "type": "cve", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33032" } ], "mitigation": "Upgrade nginx-ui to 2.6.5+. Until patched, block external access to the nginx-ui port and require mutual TLS. Audit nginx config diffs for unauthorized changes since April. Review MCP server configurations for any nginx-ui MCP bridges and disable until confirmed patched.", "detectedByAnomity": true } }, { "kind": "vuln", "slug": "cve-2026-33579", "name": "CVE-2026-33579", "vendor": "OpenClaw", "description": "OpenClaw's /pair approve command path failed to validate the approving user's privilege level, allowing any user with minimal operator.pairing access to silently approve device pairings that granted full admin control. With 135,000+ publicly exposed instances and 63% running with no authentication at all, this was one of March 2026's most critical AI-framework disclosures; patched in OpenClaw 2026.3.28.", "website": "https://www.cvedetails.com/cve/CVE-2026-33579", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "advisory", "capabilities": [], "packaging": null, "configFiles": null, "category": "agent", "updatedAt": "2026-03-29", "risk": { "score": 98, "band": "critical", "signals": [], "dangerousCombos": [] }, "dangerousCombos": [], "vuln": { "id": "CVE-2026-33579", "aliases": [ "ti-002" ], "title": "CVE-2026-33579: OpenClaw Privilege Escalation via /pair approve (CVSS 9.8)", "summary": "OpenClaw's /pair approve command path failed to validate the approving user's privilege level, allowing any user with minimal operator.pairing access to silently approve device pairings that granted full admin control. With 135,000+ publicly exposed instances and 63% running with no authentication at all, this was one of March 2026's most critical AI-framework disclosures; patched in OpenClaw 2026.3.28.", "severity": "critical", "cvss": { "score": 9.8, "vector": null, "version": null }, "cwe": [], "attackType": [ "Privilege escalation" ], "componentType": "agent", "component": { "name": "OpenClaw", "vendor": null, "package": null, "ecosystem": null, "catalogSlug": null }, "affected": [ { "range": "OpenClaw < 2026.3.28", "fixed": null } ], "exploited": false, "exploitPublic": false, "publishedAt": "2026-03-29", "modifiedAt": "2026-03-29", "lastVerified": "2026-11-01", "references": [ { "type": "cve", "url": "https://www.cvedetails.com/cve/CVE-2026-33579" }, { "type": "cve", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33579" } ], "mitigation": "Upgrade to OpenClaw 2026.3.28+. Enable authentication on all OpenClaw instances. Review pairing approvals for unauthorized elevations. Restrict operator.pairing scope to trusted admins only.", "detectedByAnomity": true } }, { "kind": "vuln", "slug": "cve-2026-50548", "name": "CVE-2026-50548", "vendor": "Zero-Click", "description": "Cato AI Labs disclosed DuneSlide, two critical flaws (CVE-2026-50548 and CVE-2026-50549, both CVSS 9.8) that let a single prompt escape Cursor's command sandbox and run arbitrary OS-level code. The trigger is zero-click: an innocuous prompt that ingests an attacker payload from an untrusted source such as an MCP server or web search result, handing over the developer machine and connected cloud/SaaS workspaces.", "website": "https://thehackernews.com/2026/07/critical-cursor-flaws-could-let-prompt.html", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "advisory", "capabilities": [], "packaging": null, "configFiles": null, "category": "agent", "updatedAt": "2026-07-01", "risk": { "score": 98, "band": "critical", "signals": [], "dangerousCombos": [] }, "dangerousCombos": [], "vuln": { "id": "CVE-2026-50548", "aliases": [ "ti-046" ], "title": "DuneSlide: Zero-Click RCE Flaws in Cursor AI Code Editor (CVSS 9.8)", "summary": "Cato AI Labs disclosed DuneSlide, two critical flaws (CVE-2026-50548 and CVE-2026-50549, both CVSS 9.8) that let a single prompt escape Cursor's command sandbox and run arbitrary OS-level code. The trigger is zero-click: an innocuous prompt that ingests an attacker payload from an untrusted source such as an MCP server or web search result, handing over the developer machine and connected cloud/SaaS workspaces.", "severity": "critical", "cvss": { "score": 9.8, "vector": null, "version": null }, "cwe": [], "attackType": [ "Remote code execution", "Prompt injection" ], "componentType": "agent", "component": { "name": "Zero-Click", "vendor": null, "package": null, "ecosystem": null, "catalogSlug": "agent/cursor" }, "affected": [ { "range": "all versions before Cursor 3.0 (patched in 3.0)", "fixed": "3.0" } ], "exploited": false, "exploitPublic": false, "publishedAt": "2026-07-01", "modifiedAt": "2026-07-01", "lastVerified": "2026-11-01", "references": [ { "type": "article", "url": "https://thehackernews.com/2026/07/critical-cursor-flaws-could-let-prompt.html" }, { "type": "cve", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50548" } ], "mitigation": "Upgrade Cursor to 3.0 or later and treat MCP outputs and web search results ingested by the agent as untrusted.", "detectedByAnomity": true } }, { "kind": "vuln", "slug": "cve-2026-90999", "name": "CVE-2026-90999", "vendor": "sentry-seer", "description": "CERT/CC vulnerability note VU#212479 (published 16 September 2026; researchers Nikita Benkovich and Vitalii Valkov of agyn, who also wrote it up as PhantomFix on 14 September) tracks CVE-2026-90999 in Sentry Seer's autonomous remediation path. When Seer is configured to hand issues to a coding agent automatically, an unauthenticated attacker who can POST to a project's public DSN (the normal browser telemetry endpoint) submits a fabricated exception event. Seer builds a root-cause analysis from attacker-controlled fields (exception messages, stack traces, source context, breadcrumbs), embeds that analysis in the coding agent's initial prompt, and the agent treats it as a legitimate description of the victim codebase — then downloads and executes an attacker-controlled package inside the agent environment before any human reviews a pull request, with access to connected source repositories. CVSS 3.1 is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). This is distinct from the June 2026 AgentJacking write-up already in this feed (ti-035), which described intercepting/proxying agent Sentry MCP traffic via an exposed DSN; PhantomFix is vendor-hosted Seer autofix turning untrusted telemetry into agent tasking with no account on the victim org required. At advisory time no vendor-supplied customer patch was published (Sentry Seer is SaaS \"Web site\" per NVD); exploit specifics were held pending a fix.", "website": "https://www.kb.cert.org/vuls/id/212479", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "advisory", "capabilities": [], "packaging": { "manager": "unknown", "packageName": "sentry-seer", "command": null }, "configFiles": null, "category": "package", "updatedAt": "2026-09-16", "risk": { "score": 98, "band": "critical", "signals": [], "dangerousCombos": [] }, "dangerousCombos": [], "vuln": { "id": "CVE-2026-90999", "aliases": [ "ti-106" ], "title": "CVE-2026-90999 (PhantomFix): Fabricated Sentry Events Steer Seer Autofix Into Coding-Agent RCE (CVSS 9.8)", "summary": "CERT/CC vulnerability note VU#212479 (published 16 September 2026; researchers Nikita Benkovich and Vitalii Valkov of agyn, who also wrote it up as PhantomFix on 14 September) tracks CVE-2026-90999 in Sentry Seer's autonomous remediation path. When Seer is configured to hand issues to a coding agent automatically, an unauthenticated attacker who can POST to a project's public DSN (the normal browser telemetry endpoint) submits a fabricated exception event. Seer builds a root-cause analysis from attacker-controlled fields (exception messages, stack traces, source context, breadcrumbs), embeds that analysis in the coding agent's initial prompt, and the agent treats it as a legitimate description of the victim codebase — then downloads and executes an attacker-controlled package inside the agent environment before any human reviews a pull request, with access to connected source repositories. CVSS 3.1 is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). This is distinct from the June 2026 AgentJacking write-up already in this feed (ti-035), which described intercepting/proxying agent Sentry MCP traffic via an exposed DSN; PhantomFix is vendor-hosted Seer autofix turning untrusted telemetry into agent tasking with no account on the victim org required. At advisory time no vendor-supplied customer patch was published (Sentry Seer is SaaS \"Web site\" per NVD); exploit specifics were held pending a fix.", "severity": "critical", "cvss": { "score": 9.8, "vector": null, "version": null }, "cwe": [], "attackType": [ "Remote code execution", "Prompt injection" ], "componentType": "package", "component": { "name": "sentry-seer", "vendor": null, "package": "sentry-seer", "ecosystem": null, "catalogSlug": null }, "affected": [ { "range": "Sentry Seer autonomous remediation / coding-agent handoff (SaaS; NVD lists version as \"Web site\"). Exposure requires Seer auto-handoff plus a public DSN (typical for frontend projects). Not a defect in Claude Code, Cursor, or Codex themselves — those agents are the execution environment Seer can invoke.", "fixed": null } ], "exploited": false, "exploitPublic": false, "publishedAt": "2026-09-16", "modifiedAt": "2026-09-16", "lastVerified": "2026-11-01", "references": [ { "type": "advisory", "url": "https://www.kb.cert.org/vuls/id/212479" }, { "type": "cve", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90999" } ], "mitigation": "If you use Sentry Seer with automatic coding-agent remediation on a project that has a public DSN, disable automated remediation / Seer handoff until Sentry confirms a fix — that is the CERT/CC primary mitigation. Restrict the coding agent's ability to install new packages without approval, and keep repository credentials scoped as narrowly as possible. Rotate any project DSN that has lived in client-side bundles or public repos (raises the bar for targeting a specific project; does not remove the class). Treat untrusted telemetry (exception messages, breadcrumbs, source context) as untrusted input to any agent prompt — never pass Seer analysis into an agent as if it were a trusted task description. Monitor CERT/CC VU#212479 and Sentry status for vendor remediation confirmation. Distinct from ti-035 AgentJacking: rotating the DSN alone does not close Seer autofix.", "detectedByAnomity": false } }, { "kind": "vuln", "slug": "cve-2025-49596", "name": "CVE-2025-49596", "vendor": "@modelcontextprotocol/inspector", "description": "The maintainers of @modelcontextprotocol/inspector, the official MCP debugging client, published nine GitHub security advisories on 21 October 2026, fixed in 1.0.3 on the v1 line and 2.12.0 on the v2 line, and none has a CVE. Critical GHSA-4fc4-wcmh-4g86 (0.13.0 to 1.0.2): a remote MCP server answers with an OAuth challenge pointing at an attacker authorization server, which redirects the browser back to Inspector's /oauth/callback with transport=stdio&serverCommand=... appended; the callback page initialized its connection settings from the URL and reconnected after the token exchange, so the proxy spawned the attacker's command on macOS, Linux and Windows, with no tool call. Critical GHSA-6x67-4w4w-9f3w (CVSS 9.6, 0.20.0 to 1.0.2): a remote server's MCP App, rendered in a sandbox on the proxy's own origin, used ui/open-link to open an Inspector page with MCP_PROXY_FULL_ADDRESS pointing at the attacker, which leaked the proxy auth token from sessionStorage, then called the local /stdio endpoint with it. High GHSA-q978-78c7-phqw (2.0.0 to 2.11.0): on Windows and WSL a server-chosen OAuth authorization_endpoint containing a PowerShell $(...) subexpression ran code through open@10 while connecting, the same flaw as opencode's. High GHSA-vcc9-3xgm-p9v4 (2.0.0 to 2.11.0) and GHSA-wmjf-2m46-2352 (0.14.1 to 1.0.2) are incomplete fixes for CVE-2025-49596: requests without an Origin header passed the Origin check, so DNS rebinding could read the API token and stored OAuth tokens on 2.x, and with DANGEROUSLY_OMIT_AUTH set any local client could launch processes. The other four cover header leaks on cross-origin redirects, a token leak to a query-chosen proxy origin, verbatim logging of SSE auth headers, and an unbounded /api/fetch response.", "website": "https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-4fc4-wcmh-4g86", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "advisory", "capabilities": [], "packaging": { "manager": "unknown", "packageName": "@modelcontextprotocol/inspector", "command": null }, "configFiles": null, "category": "mcp-server", "updatedAt": "2026-10-21", "risk": { "score": 96, "band": "critical", "signals": [], "dangerousCombos": [] }, "dangerousCombos": [], "vuln": { "id": "CVE-2025-49596", "aliases": [ "ti-163", "GHSA-4fc4-wcmh-4g86" ], "title": "MCP Inspector Fixes Nine Advisories on 21 October, Two Critical: a Malicious Server's OAuth Callback Switched Inspector to stdio and Ran a Local Command, and a Remote MCP App Stole the Proxy Token (CVSS 9.6)", "summary": "The maintainers of @modelcontextprotocol/inspector, the official MCP debugging client, published nine GitHub security advisories on 21 October 2026, fixed in 1.0.3 on the v1 line and 2.12.0 on the v2 line, and none has a CVE. Critical GHSA-4fc4-wcmh-4g86 (0.13.0 to 1.0.2): a remote MCP server answers with an OAuth challenge pointing at an attacker authorization server, which redirects the browser back to Inspector's /oauth/callback with transport=stdio&serverCommand=... appended; the callback page initialized its connection settings from the URL and reconnected after the token exchange, so the proxy spawned the attacker's command on macOS, Linux and Windows, with no tool call. Critical GHSA-6x67-4w4w-9f3w (CVSS 9.6, 0.20.0 to 1.0.2): a remote server's MCP App, rendered in a sandbox on the proxy's own origin, used ui/open-link to open an Inspector page with MCP_PROXY_FULL_ADDRESS pointing at the attacker, which leaked the proxy auth token from sessionStorage, then called the local /stdio endpoint with it. High GHSA-q978-78c7-phqw (2.0.0 to 2.11.0): on Windows and WSL a server-chosen OAuth authorization_endpoint containing a PowerShell $(...) subexpression ran code through open@10 while connecting, the same flaw as opencode's. High GHSA-vcc9-3xgm-p9v4 (2.0.0 to 2.11.0) and GHSA-wmjf-2m46-2352 (0.14.1 to 1.0.2) are incomplete fixes for CVE-2025-49596: requests without an Origin header passed the Origin check, so DNS rebinding could read the API token and stored OAuth tokens on 2.x, and with DANGEROUSLY_OMIT_AUTH set any local client could launch processes. The other four cover header leaks on cross-origin redirects, a token leak to a query-chosen proxy origin, verbatim logging of SSE auth headers, and an unbounded /api/fetch response.", "severity": "critical", "cvss": { "score": 9.6, "vector": null, "version": null }, "cwe": [], "attackType": [ "Remote code execution" ], "componentType": "mcp-server", "component": { "name": "@modelcontextprotocol/inspector", "vendor": null, "package": "@modelcontextprotocol/inspector", "ecosystem": null, "catalogSlug": null }, "affected": [ { "range": ">=0.13.0 <1.0.3 || >=2.0.0 <2.12.0", "fixed": "2.12.0" } ], "exploited": false, "exploitPublic": false, "publishedAt": "2026-10-21", "modifiedAt": "2026-10-21", "lastVerified": "2026-11-01", "references": [ { "type": "advisory", "url": "https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-4fc4-wcmh-4g86" }, { "type": "cve", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49596" } ], "mitigation": "Upgrade MCP Inspector to 2.12.0 (latest) or 1.0.3 (v1-latest) on every developer machine, and remember that npx @modelcontextprotocol/inspector resolves whatever is cached locally unless you pin the version. Do not point Inspector at remote MCP servers you do not trust on an older version, never run it with DANGEROUSLY_OMIT_AUTH, and keep it bound to loopback. If an older Inspector connected to an untrusted remote server, treat the machine as possibly compromised and revoke the OAuth tokens Inspector stored for connected servers.", "detectedByAnomity": true } }, { "kind": "vuln", "slug": "cve-2026-57496", "name": "CVE-2026-57496", "vendor": "netlicensing-mcp", "description": "Several MCP servers received CVEs between 7 and 15 October 2026. CVE-2026-57496 (NVD 15 October, CVSS 3.1 9.6; GHSA-hxpf-9xvq-wph8): in Labs64's netlicensing-mcp before 0.1.8, netlicensing_get_product put the caller's product_number into a REST path without validating it. A traversal value reached the /token endpoint, and the response skipped the redaction that masks APIKEY numbers and SHOP URLs, so a client with a non-admin API key could read plaintext tokens, including administrative ones that grant read, write and delete access to the NetLicensing account. CVE-2026-108865 (11 October, CVSS 3.1 8.2, CVSS 4.0 8.8): the OAuth2 server in AmoyLab Unla, an MCP gateway, never authenticated the resource owner through version 0.10.0. Anyone could register a client, request a code from /authorize and exchange it at /token for access to the OAuth-protected MCP prefixes, the proxied upstream APIs and the credentials the gateway injects; NVD lists no fixed version. CVE-2026-108953 (12 October, CVSS 4.0 8.5): mac-shell-mcp before 2.0.0 let shell metacharacters through in execute_command arguments, so an allowed command such as pwd followed by ; ran forbidden commands without approval, and a malicious prompt could trigger it. The fix is in the GitHub repository, but the newest npm release is still 1.0.4. CVE-2026-76286 (Splunk SVD-2026-1004, 7 October, CVSS 5.3): in Splunk MCP Server below 1.2.1, running a custom API tool that another user configured sent the runner's Splunk authentication token to that tool's URL.", "website": "https://nvd.nist.gov/vuln/detail/CVE-2026-57496", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "advisory", "capabilities": [], "packaging": { "manager": "unknown", "packageName": "netlicensing-mcp", "command": null }, "configFiles": null, "category": "mcp-server", "updatedAt": "2026-10-15", "risk": { "score": 96, "band": "high", "signals": [], "dangerousCombos": [] }, "dangerousCombos": [], "vuln": { "id": "CVE-2026-57496", "aliases": [ "ti-145", "GHSA-hxpf-9xvq-wph8" ], "title": "Four MCP Server CVEs: NetLicensing Path Traversal Unredacts Admin Tokens (CVSS 9.6), Unla Gateway Issues OAuth Tokens Without a Login, mac-shell-mcp Allowlist Bypass, Splunk MCP Server Token Leak", "summary": "Several MCP servers received CVEs between 7 and 15 October 2026. CVE-2026-57496 (NVD 15 October, CVSS 3.1 9.6; GHSA-hxpf-9xvq-wph8): in Labs64's netlicensing-mcp before 0.1.8, netlicensing_get_product put the caller's product_number into a REST path without validating it. A traversal value reached the /token endpoint, and the response skipped the redaction that masks APIKEY numbers and SHOP URLs, so a client with a non-admin API key could read plaintext tokens, including administrative ones that grant read, write and delete access to the NetLicensing account. CVE-2026-108865 (11 October, CVSS 3.1 8.2, CVSS 4.0 8.8): the OAuth2 server in AmoyLab Unla, an MCP gateway, never authenticated the resource owner through version 0.10.0. Anyone could register a client, request a code from /authorize and exchange it at /token for access to the OAuth-protected MCP prefixes, the proxied upstream APIs and the credentials the gateway injects; NVD lists no fixed version. CVE-2026-108953 (12 October, CVSS 4.0 8.5): mac-shell-mcp before 2.0.0 let shell metacharacters through in execute_command arguments, so an allowed command such as pwd followed by ; ran forbidden commands without approval, and a malicious prompt could trigger it. The fix is in the GitHub repository, but the newest npm release is still 1.0.4. CVE-2026-76286 (Splunk SVD-2026-1004, 7 October, CVSS 5.3): in Splunk MCP Server below 1.2.1, running a custom API tool that another user configured sent the runner's Splunk authentication token to that tool's URL.", "severity": "high", "cvss": { "score": 9.6, "vector": null, "version": "3.1" }, "cwe": [], "attackType": [ "Command injection", "Authentication bypass", "Path traversal" ], "componentType": "mcp-server", "component": { "name": "netlicensing-mcp", "vendor": null, "package": "netlicensing-mcp", "ecosystem": null, "catalogSlug": null }, "affected": [ { "range": "<0.1.8", "fixed": "0.1.8" } ], "exploited": false, "exploitPublic": false, "publishedAt": "2026-10-15", "modifiedAt": "2026-10-15", "lastVerified": "2026-11-01", "references": [ { "type": "cve", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57496" }, { "type": "advisory", "url": "https://github.com/advisories/GHSA-hxpf-9xvq-wph8" } ], "mitigation": "Upgrade netlicensing-mcp to 0.1.8 or later and rotate NetLicensing API keys that an MCP client could have read, starting with administrative ones. Keep Unla gateways off untrusted networks, or put authentication in front of /authorize and /token, until a fix is published, and rotate the credentials the gateway injects. Replace npm installs of mac-shell-mcp with a build of 2.0.0 or later from the GitHub repository, or remove it. Upgrade Splunk MCP Server to 1.2.1 or later, limit mcp_tool_admin to trusted users, review custom API tools for external URLs, and rotate the tokens of users who ran tools that someone else created.", "detectedByAnomity": true } }, { "kind": "vuln", "slug": "comment-and-control-claude-code-gemini-cli-copilot-agents-vulnerable-to", "name": "comment-and-control-claude-code-gemini-cli-copilot-agents-vulnerable-to", "vendor": "Claude Code Security Review", "description": "Johns Hopkins University researchers discovered that AI coding agents processing GitHub data (PR titles, comments, issue bodies) are vulnerable to prompt injection that triggers unauthorized command execution and credential theft. Claude Code Security Review allowed shell command injection via unsanitized PR titles (CVSS 9.4). Gemini CLI Action and GitHub Copilot Agent were similarly affected. Copilot payloads hidden in HTML comments bypassed filtering entirely.", "website": "https://www.securityweek.com/claude-code-gemini-cli-github-copilot-agents-vulnerable-to-prompt-injection-via-comments/", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "advisory", "capabilities": [], "packaging": null, "configFiles": null, "category": "agent", "updatedAt": "2026-04-16", "risk": { "score": 94, "band": "critical", "signals": [], "dangerousCombos": [] }, "dangerousCombos": [], "vuln": { "id": "comment-and-control-claude-code-gemini-cli-copilot-agents-vulnerable-to", "aliases": [ "ti-012" ], "title": "\"Comment and Control\": Claude Code, Gemini CLI, Copilot Agents Vulnerable to Prompt Injection via GitHub Comments", "summary": "Johns Hopkins University researchers discovered that AI coding agents processing GitHub data (PR titles, comments, issue bodies) are vulnerable to prompt injection that triggers unauthorized command execution and credential theft. Claude Code Security Review allowed shell command injection via unsanitized PR titles (CVSS 9.4). Gemini CLI Action and GitHub Copilot Agent were similarly affected. Copilot payloads hidden in HTML comments bypassed filtering entirely.", "severity": "critical", "cvss": { "score": 9.4, "vector": null, "version": null }, "cwe": [], "attackType": [ "Prompt injection", "Data exfiltration" ], "componentType": "agent", "component": { "name": "Claude Code Security Review", "vendor": null, "package": null, "ecosystem": null, "catalogSlug": "agent/gemini-cli" }, "affected": [ { "range": "Claude Code Security Review, Gemini CLI Action, GitHub Copilot Agent (pre-patch)", "fixed": null } ], "exploited": false, "exploitPublic": false, "publishedAt": "2026-04-16", "modifiedAt": "2026-04-16", "lastVerified": "2026-11-01", "references": [ { "type": "article", "url": "https://www.securityweek.com/claude-code-gemini-cli-github-copilot-agents-vulnerable-to-prompt-injection-via-comments/" } ], "mitigation": "Update to patched agent versions. Never grant AI agents write access to repos processing untrusted PRs. Sanitize all GitHub-sourced input before passing to AI agents. Adopt least-privilege tool access for CI/CD AI integrations.", "detectedByAnomity": true } }, { "kind": "vuln", "slug": "cve-2026-40576", "name": "CVE-2026-40576", "vendor": "excel-mcp-server", "description": "A path traversal flaw in excel-mcp-server let unauthenticated attackers read, write and overwrite arbitrary files. Its get_excel_path() passed absolute paths through without validation and failed to resolve ../ traversal sequences, and because the server binds to all network interfaces with no authentication by default, remote exploitation was straightforward. This is the recurring shape of MCP server risk: the code flaw is ordinary, but the default deployment posture turns it into remote file write.", "website": "https://www.sentinelone.com/vulnerability-database/cve-2026-40576/", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "advisory", "capabilities": [], "packaging": null, "configFiles": null, "category": "mcp-server", "updatedAt": "2026-04-23", "risk": { "score": 94, "band": "critical", "signals": [], "dangerousCombos": [] }, "dangerousCombos": [], "vuln": { "id": "CVE-2026-40576", "aliases": [ "ti-060" ], "title": "CVE-2026-40576: excel-mcp-server Path Traversal Allows Unauthenticated File Read and Overwrite (CVSS 9.4)", "summary": "A path traversal flaw in excel-mcp-server let unauthenticated attackers read, write and overwrite arbitrary files. Its get_excel_path() passed absolute paths through without validation and failed to resolve ../ traversal sequences, and because the server binds to all network interfaces with no authentication by default, remote exploitation was straightforward. This is the recurring shape of MCP server risk: the code flaw is ordinary, but the default deployment posture turns it into remote file write.", "severity": "critical", "cvss": { "score": 9.4, "vector": null, "version": null }, "cwe": [], "attackType": [ "Path traversal" ], "componentType": "mcp-server", "component": { "name": "excel-mcp-server", "vendor": null, "package": null, "ecosystem": null, "catalogSlug": null }, "affected": [ { "range": "excel-mcp-server <= 0.1.7 (fixed in 0.1.8)", "fixed": "0.1.8" } ], "exploited": false, "exploitPublic": false, "publishedAt": "2026-04-23", "modifiedAt": "2026-04-23", "lastVerified": "2026-11-01", "references": [ { "type": "article", "url": "https://www.sentinelone.com/vulnerability-database/cve-2026-40576/" }, { "type": "cve", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40576" } ], "mitigation": "Upgrade excel-mcp-server to 0.1.8+. Bind MCP servers to 127.0.0.1 rather than 0.0.0.0, put authentication in front of any MCP server reachable off-host, and run file-handling MCP servers against a scoped or read-only filesystem.", "detectedByAnomity": true } }, { "kind": "vuln", "slug": "cve-2026-82533", "name": "CVE-2026-82533", "vendor": "DeepSeek Harness", "description": "OX Security researchers Nir Zadok and Moshe Siman Tov Bustan found an authentication bypass in the local agent-control HTTP API of DeepSeek Harness (dsh), which listens on 127.0.0.1:3080. Its isTrustedApiRequest check trusted the client-supplied Host header and never checked the real TCP peer address. The OS sandbox (bubblewrap, Landlock or Seatbelt) limited file writes but left loopback networking open, and Bash tool calls needed no approval, so a process inside the sandbox could call its own control API, switch its session to danger-full-access and turn off approval prompts, on the default configuration. If the port was reachable through a tunnel, SSH forward or reverse proxy, a remote attacker with no credentials could create sessions, run arbitrary commands and export stored conversation transcripts. The fix shipped in 0.1.2-alpha.1 on 27 August 2026, and VulnCheck, as CNA, published CVE-2026-82533 (CVSS 4.0 9.4, CWE-807) on 8 September covering all earlier versions. Neither source includes a statement from DeepSeek.", "website": "https://www.ox.security/blog/cve-2026-82533-deepseek-harness-ai-agent-sandbox-escape/", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "advisory", "capabilities": [], "packaging": null, "configFiles": null, "category": "agent", "updatedAt": "2026-09-08", "risk": { "score": 94, "band": "critical", "signals": [], "dangerousCombos": [] }, "dangerousCombos": [], "vuln": { "id": "CVE-2026-82533", "aliases": [ "ti-120" ], "title": "CVE-2026-82533: DeepSeek Harness's Unauthenticated Local Control API Let a Sandboxed Agent Turn Off Its Own Sandbox (CVSS 9.4)", "summary": "OX Security researchers Nir Zadok and Moshe Siman Tov Bustan found an authentication bypass in the local agent-control HTTP API of DeepSeek Harness (dsh), which listens on 127.0.0.1:3080. Its isTrustedApiRequest check trusted the client-supplied Host header and never checked the real TCP peer address. The OS sandbox (bubblewrap, Landlock or Seatbelt) limited file writes but left loopback networking open, and Bash tool calls needed no approval, so a process inside the sandbox could call its own control API, switch its session to danger-full-access and turn off approval prompts, on the default configuration. If the port was reachable through a tunnel, SSH forward or reverse proxy, a remote attacker with no credentials could create sessions, run arbitrary commands and export stored conversation transcripts. The fix shipped in 0.1.2-alpha.1 on 27 August 2026, and VulnCheck, as CNA, published CVE-2026-82533 (CVSS 4.0 9.4, CWE-807) on 8 September covering all earlier versions. Neither source includes a statement from DeepSeek.", "severity": "critical", "cvss": { "score": 9.4, "vector": null, "version": null }, "cwe": [ "CWE-807" ], "attackType": [ "Remote code execution", "Authentication bypass", "Sandbox escape" ], "componentType": "agent", "component": { "name": "DeepSeek Harness", "vendor": null, "package": null, "ecosystem": null, "catalogSlug": null }, "affected": [ { "range": "DeepSeek Harness before 0.1.2-alpha.1 (fixed 27 August 2026).", "fixed": "0.1.2-alpha.1" } ], "exploited": false, "exploitPublic": false, "publishedAt": "2026-09-08", "modifiedAt": "2026-09-08", "lastVerified": "2026-11-01", "references": [ { "type": "article", "url": "https://www.ox.security/blog/cve-2026-82533-deepseek-harness-ai-agent-sandbox-escape/" }, { "type": "cve", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82533" } ], "mitigation": "Upgrade DeepSeek Harness to 0.1.2-alpha.1 or later on every machine where developers run it. Until each install is upgraded, never expose the control port (127.0.0.1:3080) through tunnels, SSH port forwards or reverse proxies, which makes the bug remotely exploitable with no credentials. On hosts that ran a vulnerable version with the port exposed, treat stored conversation transcripts as exfiltrated and rotate any secrets they contained. Do not treat an agent's OS sandbox alone as a boundary while loopback networking stays open to the agent.", "detectedByAnomity": true } }, { "kind": "vuln", "slug": "cve-2026-103091", "name": "CVE-2026-103091", "vendor": "Google OSS Agent Mesh", "description": "CVE-2026-103091 (published 19 October 2026, CVSS 9.3): in Google OSS Agent Mesh (SAM) 0.1.0-alpha.1 to alpha.8, GET /info disclosed the OIDC configuration, POST /register auto-enrolled any valid OIDC token holder without claim filtering or ban checks, and the default policy bound every authenticated identity to all services, so an outsider could self-enroll and invoke arbitrary tools on every connected MCP backend; 0.1.0-alpha.9 enforces a fail-closed default. GHSA-953h-535j-jg2v (19 October, CVSS 6.8): the MCP proxy in Envoy AI Gateway (agent-router) embeds the caller's JWT subject in the session ID to prevent hijacking but never compared it on resume, and the Helm chart shipped the literal seed default-insecure-seed for the key that encrypts those IDs, so a session ID could be forged and another user's backend MCP session resumed; fixed in 1.2.0-rc1. Also published this week: CVE-2026-114123, where the documented Azure one-click deployment of the D365 F&O MCP Server left API_KEY empty, which disables authentication, on a public App Service (fixed in 1.11.0); CVE-2026-57207, where NetBox MCP Server with TRANSPORT=http had no authentication at all (fixed in 1.2.1); CVE-2026-115750 and CVE-2026-115751, where mcp-from-openapi forwarded Authorization and Cookie headers on cross-origin redirects and its SSRF denylist could be bypassed (fixed in 2.9.0); and CVE-2026-115845, a validator gap in the run_script tool of the AWS MCP Server that AWS fixed service-side.", "website": "https://nvd.nist.gov/vuln/detail/CVE-2026-103091", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "advisory", "capabilities": [], "packaging": null, "configFiles": null, "category": "mcp-server", "updatedAt": "2026-10-19", "risk": { "score": 93, "band": "critical", "signals": [], "dangerousCombos": [] }, "dangerousCombos": [], "vuln": { "id": "CVE-2026-103091", "aliases": [ "ti-155", "GHSA-953h-535j-jg2v" ], "title": "MCP Gateways and Hosted Servers: Google's Agent Mesh Let Any OIDC Token Holder Enroll and Call Every Backend Tool (CVE-2026-103091, CVSS 9.3), Envoy AI Gateway Resumed Other Users' MCP Sessions, and Three Servers Shipped Without Authentication or Leaked Tokens", "summary": "CVE-2026-103091 (published 19 October 2026, CVSS 9.3): in Google OSS Agent Mesh (SAM) 0.1.0-alpha.1 to alpha.8, GET /info disclosed the OIDC configuration, POST /register auto-enrolled any valid OIDC token holder without claim filtering or ban checks, and the default policy bound every authenticated identity to all services, so an outsider could self-enroll and invoke arbitrary tools on every connected MCP backend; 0.1.0-alpha.9 enforces a fail-closed default. GHSA-953h-535j-jg2v (19 October, CVSS 6.8): the MCP proxy in Envoy AI Gateway (agent-router) embeds the caller's JWT subject in the session ID to prevent hijacking but never compared it on resume, and the Helm chart shipped the literal seed default-insecure-seed for the key that encrypts those IDs, so a session ID could be forged and another user's backend MCP session resumed; fixed in 1.2.0-rc1. Also published this week: CVE-2026-114123, where the documented Azure one-click deployment of the D365 F&O MCP Server left API_KEY empty, which disables authentication, on a public App Service (fixed in 1.11.0); CVE-2026-57207, where NetBox MCP Server with TRANSPORT=http had no authentication at all (fixed in 1.2.1); CVE-2026-115750 and CVE-2026-115751, where mcp-from-openapi forwarded Authorization and Cookie headers on cross-origin redirects and its SSRF denylist could be bypassed (fixed in 2.9.0); and CVE-2026-115845, a validator gap in the run_script tool of the AWS MCP Server that AWS fixed service-side.", "severity": "critical", "cvss": { "score": 9.3, "vector": null, "version": null }, "cwe": [], "attackType": [ "Authentication bypass", "Server-side request forgery" ], "componentType": "mcp-server", "component": { "name": "Google OSS Agent Mesh", "vendor": null, "package": null, "ecosystem": null, "catalogSlug": null }, "affected": [ { "range": "Google OSS Agent Mesh (SAM) 0.1.0-alpha.1 to alpha.8; Envoy AI Gateway 0.4.0-rc1 to before 1.2.0-rc1; D365 F&O MCP Server before 1.11.0 (Azure one-click deployment); NetBox MCP Server before 1.2.1 with TRANSPORT=http; mcp-from-openapi 2.2.0 to before 2.9.0; AWS MCP Server (fixed service-side, no action needed).", "fixed": "0.1.0-alpha.9" } ], "exploited": false, "exploitPublic": false, "publishedAt": "2026-10-19", "modifiedAt": "2026-10-19", "lastVerified": "2026-11-01", "references": [ { "type": "cve", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103091" }, { "type": "advisory", "url": "https://github.com/advisories/GHSA-953h-535j-jg2v" } ], "mitigation": "Upgrade SAM to 0.1.0-alpha.9 or later and review enrolled identities and policy bindings. Upgrade Envoy AI Gateway to 1.2.0-rc1 or later and replace the default session-encryption seed with a random secret, since the shipped default makes session IDs forgeable. Upgrade D365 F&O MCP Server to 1.11.0, NetBox MCP Server to 1.2.1 and mcp-from-openapi to 2.9.0, and rotate any API key or bearer token that passed through an exposed instance. Never expose a remote MCP server without authentication or a network restriction, and keep an inventory of which remote MCP servers your users connect to.", "detectedByAnomity": true } }, { "kind": "vuln", "slug": "cve-2026-107824", "name": "CVE-2026-107824", "vendor": "x", "description": "NVD published CVE-2026-107824 on 9 October 2026 with a CVSS 4.0 score of 9.3, from repository advisory GHSA-4478-h5jv-647m that the maintainer of duty1g/x64dbg-mcp-server had published on 24 August 2026 (credited to avishaigonen-pluto). The project is a native MCP plugin for the x64dbg debugger, used by reverse engineers and malware analysts to drive the debugger from an AI client over HTTP and SSE. Out of the box it required no authentication and listened on 0.0.0.0, on port 9094 (x64) and 9095 (x32), so any host that could reach the port got all 71 registered MCP tools: arbitrary x64dbg command execution, attaching to any process by PID, reading and patching debuggee memory, and writing files to arbitrary paths through the dump commands. The fix makes a bearer token mandatory, auto-generated on first run, and returns 401 without it. The sources disagree on the fixed version: the repository advisory says 1.0, NVD says 1.1. A separate advisory, GHSA-jgj3-97w2-9v9r (CVE-2026-107820, CVSS 5.3), is an unauthenticated Content-Length integer-overflow denial of service fixed in 1.2. Neither advisory is in the global GitHub Advisory Database, so dependency scanners will not flag them; no exploitation has been reported.", "website": "https://github.com/duty1g/x64dbg-mcp-server/security/advisories/GHSA-4478-h5jv-647m", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "advisory", "capabilities": [], "packaging": null, "configFiles": null, "category": "mcp-server", "updatedAt": "2026-10-09", "risk": { "score": 93, "band": "critical", "signals": [], "dangerousCombos": [] }, "dangerousCombos": [], "vuln": { "id": "CVE-2026-107824", "aliases": [ "ti-130", "GHSA-4478-h5jv-647m" ], "title": "CVE-2026-107824: x64dbg-MCP Server Exposed All 71 Debugger Tools Unauthenticated on 0.0.0.0 (CVSS 4.0 9.3)", "summary": "NVD published CVE-2026-107824 on 9 October 2026 with a CVSS 4.0 score of 9.3, from repository advisory GHSA-4478-h5jv-647m that the maintainer of duty1g/x64dbg-mcp-server had published on 24 August 2026 (credited to avishaigonen-pluto). The project is a native MCP plugin for the x64dbg debugger, used by reverse engineers and malware analysts to drive the debugger from an AI client over HTTP and SSE. Out of the box it required no authentication and listened on 0.0.0.0, on port 9094 (x64) and 9095 (x32), so any host that could reach the port got all 71 registered MCP tools: arbitrary x64dbg command execution, attaching to any process by PID, reading and patching debuggee memory, and writing files to arbitrary paths through the dump commands. The fix makes a bearer token mandatory, auto-generated on first run, and returns 401 without it. The sources disagree on the fixed version: the repository advisory says 1.0, NVD says 1.1. A separate advisory, GHSA-jgj3-97w2-9v9r (CVE-2026-107820, CVSS 5.3), is an unauthenticated Content-Length integer-overflow denial of service fixed in 1.2. Neither advisory is in the global GitHub Advisory Database, so dependency scanners will not flag them; no exploitation has been reported.", "severity": "critical", "cvss": { "score": 9.3, "vector": null, "version": "4.0" }, "cwe": [], "attackType": [ "Remote code execution", "Authentication bypass" ], "componentType": "mcp-server", "component": { "name": "x", "vendor": null, "package": null, "ecosystem": null, "catalogSlug": null }, "affected": [ { "range": "x64dbg-MCP Server before 1.0 per the repository advisory (NVD says before 1.1); the related DoS is fixed in 1.2.", "fixed": "1.2" } ], "exploited": false, "exploitPublic": false, "publishedAt": "2026-10-09", "modifiedAt": "2026-10-09", "lastVerified": "2026-11-01", "references": [ { "type": "advisory", "url": "https://github.com/duty1g/x64dbg-mcp-server/security/advisories/GHSA-4478-h5jv-647m" }, { "type": "cve", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107824" } ], "mitigation": "Upgrade x64dbg-MCP Server to 1.2 or later, which covers both the authentication fix (1.0 or 1.1, depending on the source) and the denial-of-service fix, and confirm that requests without the bearer token are refused with 401. Do not expose ports 9094 or 9095 beyond localhost: block them at the host firewall and look for listeners on those ports on analyst and reverse-engineering workstations. Keep the auto-generated token secret and give it only to the MCP client that needs it. If an unpatched instance was reachable from a network, treat the workstation and any process it could attach to as possibly compromised.", "detectedByAnomity": true } }, { "kind": "vuln", "slug": "cve-2026-64849", "name": "CVE-2026-64849", "vendor": "MLflow", "description": "An unauthenticated server-side request forgery in MLflow's model-registry webhooks lets an attacker proxy requests through the server into internal services, including cloud metadata endpoints, and leave with cloud credentials and secrets. It defeats the earlier fixes for this class through the way it handles redirects. Honeypot telemetry showed indiscriminate scanning for exposed MLflow instances within hours of the CVE being assigned on 17 August, and CISA added it to the Known Exploited Vulnerabilities catalog on 19 August with a 2 September federal remediation deadline.", "website": "https://thehackernews.com/2026/08/attackers-exploit-mlflow-ssrf-flaw-to.html", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "advisory", "capabilities": [], "packaging": null, "configFiles": null, "category": "agent", "updatedAt": "2026-08-18", "risk": { "score": 93, "band": "critical", "signals": [], "dangerousCombos": [] }, "dangerousCombos": [], "vuln": { "id": "CVE-2026-64849", "aliases": [ "ti-079" ], "title": "CVE-2026-64849: MLflow SSRF Exploited Within Hours and Added to CISA KEV (CVSS 9.3)", "summary": "An unauthenticated server-side request forgery in MLflow's model-registry webhooks lets an attacker proxy requests through the server into internal services, including cloud metadata endpoints, and leave with cloud credentials and secrets. It defeats the earlier fixes for this class through the way it handles redirects. Honeypot telemetry showed indiscriminate scanning for exposed MLflow instances within hours of the CVE being assigned on 17 August, and CISA added it to the Known Exploited Vulnerabilities catalog on 19 August with a 2 September federal remediation deadline.", "severity": "critical", "cvss": { "score": 9.3, "vector": null, "version": null }, "cwe": [], "attackType": [ "Server-side request forgery" ], "componentType": "agent", "component": { "name": "MLflow", "vendor": null, "package": null, "ecosystem": null, "catalogSlug": null }, "affected": [ { "range": "MLflow < 3.15.0", "fixed": "3.15.0" } ], "exploited": true, "exploitPublic": false, "publishedAt": "2026-08-18", "modifiedAt": "2026-08-18", "lastVerified": "2026-11-01", "references": [ { "type": "article", "url": "https://thehackernews.com/2026/08/attackers-exploit-mlflow-ssrf-flaw-to.html" }, { "type": "cve", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64849" } ], "mitigation": "Upgrade MLflow to 3.15.0 or later now, because this is being scanned for indiscriminately rather than targeted. Take any MLflow instance off the public internet and block its egress to cloud metadata endpoints (169.254.169.254) so an SSRF cannot convert into cloud credentials. Rotate the instance role credentials if it was internet-reachable before patching.", "detectedByAnomity": true } }, { "kind": "vuln", "slug": "cve-2026-43631", "name": "CVE-2026-43631", "vendor": "llama.cpp builds b", "description": "A use-after-free on the vocab pointer in llama.cpp's llama-server lets an unauthenticated remote attacker run code by sending requests while the server is transitioning into sleep mode, a window in which concurrent worker threads dereference memory that has already been freed and that the attacker can reclaim with data of their own. It affects builds b7492 through b9060 and needs the --sleep-idle-seconds feature active, a flag commonly set on exactly the shared internal inference hosts that see the most sensitive prompts. Local inference also changes the exposure shape: these servers are usually stood up by a team rather than provisioned by IT, and frequently listen on the internal network with nothing authenticating in front of them.", "website": "https://github.com/advisories/GHSA-6hc7-9rph-cm99", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "advisory", "capabilities": [], "packaging": null, "configFiles": null, "category": "agent", "updatedAt": "2026-08-07", "risk": { "score": 92, "band": "critical", "signals": [], "dangerousCombos": [] }, "dangerousCombos": [], "vuln": { "id": "CVE-2026-43631", "aliases": [ "ti-082", "GHSA-6hc7-9rph-cm99" ], "title": "CVE-2026-43631: Unauthenticated RCE in llama-server When Idle Sleep Is Enabled (CVSS 9.2)", "summary": "A use-after-free on the vocab pointer in llama.cpp's llama-server lets an unauthenticated remote attacker run code by sending requests while the server is transitioning into sleep mode, a window in which concurrent worker threads dereference memory that has already been freed and that the attacker can reclaim with data of their own. It affects builds b7492 through b9060 and needs the --sleep-idle-seconds feature active, a flag commonly set on exactly the shared internal inference hosts that see the most sensitive prompts. Local inference also changes the exposure shape: these servers are usually stood up by a team rather than provisioned by IT, and frequently listen on the internal network with nothing authenticating in front of them.", "severity": "critical", "cvss": { "score": 9.2, "vector": null, "version": null }, "cwe": [], "attackType": [ "Remote code execution" ], "componentType": "agent", "component": { "name": "llama.cpp builds b", "vendor": null, "package": null, "ecosystem": null, "catalogSlug": null }, "affected": [ { "range": "llama.cpp builds b7492 to b9060 with --sleep-idle-seconds enabled", "fixed": null } ], "exploited": false, "exploitPublic": false, "publishedAt": "2026-08-07", "modifiedAt": "2026-08-07", "lastVerified": "2026-11-01", "references": [ { "type": "advisory", "url": "https://github.com/advisories/GHSA-6hc7-9rph-cm99" }, { "type": "cve", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43631" } ], "mitigation": "Update llama.cpp past b9060, or disable --sleep-idle-seconds as an immediate workaround. Then go and find the instances: local inference servers are typically stood up by a team rather than provisioned centrally, so inventory which machines run llama-server, check whether any is listening on a non-loopback interface, and put authentication and network policy in front of the ones that are.", "detectedByAnomity": true } }, { "kind": "vuln", "slug": "cve-2026-96620", "name": "CVE-2026-96620", "vendor": "claude-agent-sdk", "description": "Anthropic published GHSA-h4mw-j7qp-8mwm for the Claude Agent SDK for Python (claude-agent-sdk on PyPI) on 12 September 2026, rated critical, and NVD published it as CVE-2026-96620 on 16 October with GitHub as CNA and a CVSS 4.0 score of 9.2. Before 0.2.121 the SDK passed its resume option to the Claude Code CLI as a separate argument without validating it, so a session ID that began with a dash was read as a flag of its own. An attacker who controls that value can inject --mcp-config to define a stdio MCP server, and the CLI runs that server's command at startup, outside the SDK's permission controls. It can only be exploited where an application passes untrusted input, such as a session ID taken from a request or a URL, as the resume value. The fix is in 0.2.121 (PR 1123). No exploitation has been reported. Scanners keyed on the CVE will only have flagged it since October, about a month after the advisory.", "website": "https://github.com/anthropics/claude-agent-sdk-python/security/advisories/GHSA-h4mw-j7qp-8mwm", "repository": null, "documentationUrl": null, "license": null, "version": null, "trustLevel": "advisory", "capabilities": [], "packaging": { "manager": "unknown", "packageName": "claude-agent-sdk", "command": null }, "configFiles": null, "category": "mcp-server", "updatedAt": "2026-10-16", "risk": { "score": 92, "band": "critical", "signals": [], "dangerousCombos": [] }, "dangerousCombos": [], "vuln": { "id": "CVE-2026-96620", "aliases": [ "ti-137", "GHSA-h4mw-j7qp-8mwm" ], "title": "CVE-2026-96620: A Dash-Leading Resume ID in the Claude Agent SDK for Python Became a CLI Flag That Defined a Command-Running MCP Server (CVSS 9.2)", "summary": "Anthropic published GHSA-h4mw-j7qp-8mwm for the Claude Agent SDK for Python (claude-agent-sdk on PyPI) on 12 September 2026, rated critical, and NVD published it as CVE-2026-96620 on 16 October with GitHub as CNA and a CVSS 4.0 score of 9.2. Before 0.2.121 the SDK passed its resume option to the Claude Code CLI as a separate argument without validating it, so a session ID that began with a dash was read as a flag of its own. An attacker who controls that value can inject --mcp-config to define a stdio MCP server, and the CLI runs that server's command at startup, outside the SDK's permission controls. It can only be exploited where an application passes untrusted input, such as a session ID taken from a request or a URL, as the resume value. The fix is in 0.2.121 (PR 1123). No exploitation has been reported. Scanners keyed on the CVE will only have flagged it since October, about a month after the advisory.", "severity": "critical", "cvss": { "score": 9.2, "vector": null, "version": null }, "cwe": [], "attackType": [ "Remote code execution" ], "componentType": "mcp-server", "component": { "name": "claude-agent-sdk", "vendor": null, "package": "claude-agent-sdk", "ecosystem": null, "catalogSlug": null }, "affected": [ { "range": "<0.2.121", "fixed": "0.2.121" } ], "exploited": false, "exploitPublic": false, "publishedAt": "2026-10-16", "modifiedAt": "2026-10-16", "lastVerified": "2026-11-01", "references": [ { "type": "advisory", "url": "https://github.com/anthropics/claude-agent-sdk-python/security/advisories/GHSA-h4mw-j7qp-8mwm" }, { "type": "cve", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96620" } ], "mitigation": "Upgrade claude-agent-sdk to 0.2.121 or later (0.2.168 was current on 19 October 2026). In applications built on the SDK, never pass user-supplied values straight to resume: accept only session IDs your application issued, check them against the expected format and reject anything that starts with a dash, and look the real ID up server-side. On hosts that run SDK-based services, review for unexpected --mcp-config arguments, MCP server definitions or child processes started by the Claude CLI.", "detectedByAnomity": true } } ] }