# CVE-2026-108592: VulnCheck Source-Review CVEs Hit Agent Tooling: mini-swe-agent's Bubblewrap Sandbox Inherits Host API Keys (CVE-2026-108592), 9router Writes Shell Hooks Into Hermes Agent's config.yaml (CVE-2026-108593), and mcp-remote's Device-Code Flow Sends Secrets Over HTTP (CVE-2026-108716)

> CVE-2026-108592 is a high-severity prompt injection issue (CVSS 4.0 6.0) in mini-swe-agent, a MCP server. Affected: >=1.10.0 <=2.4.6.

- **Canonical URL:** https://catalog.anomity.ai/vuln/cve-2026-108592
- **Aliases:** ti-167
- **Severity:** high
- **CVSS:** 6 (v4.0)
- **Attack type:** Prompt injection
- **Component:** mini-swe-agent (MCP server)
- **Package:** mini-swe-agent
- **Catalog entry:** https://catalog.anomity.ai/agent/mini-swe-agent
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-10-10
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/cve-2026-108592

## Summary

VulnCheck, as CNA, published dozens of CVEs from 10 October 2026 onward for findings from a static source review of MCP servers, agent frameworks and LLM gateways, mostly with no fixed version named; the Unla and mac-shell-mcp records from the same batch are in an earlier entry. Three affect tools that run on developer machines. CVE-2026-108592 (CVSS 4.0 6.0, 10 October): mini-swe-agent 1.10.0 to 2.4.6 starts its optional BubblewrapEnvironment sandbox without --clearenv, so sandboxed commands inherit the host environment, and prompt injection in task content can make the agent read API keys from it and send them out over the shared network; 2.4.6 is still the latest release on PyPI. CVE-2026-108593 (CVSS 4.0 7.3, 10 October): the 9router dashboard's POST /api/cli-tools/hermes-settings endpoint, in 0.4.1 to 0.5.99, writes a submitted baseUrl into Hermes Agent's config.yaml without encoding, so an authenticated dashboard user can add hooks_auto_accept and a hooks.post_llm_call shell command that Hermes runs without approval after its next LLM call. CVE-2026-108716 (CVSS 4.0 6.0, 11 October): mcp-remote 0.8.0 to 0.14.3, with --device-code, sends the client secret and receives access and refresh tokens without requiring HTTPS, so when discovery returns non-loopback http:// device-authorization and token endpoints, anyone on the network path can read all three. The researchers reviewed source only, and the write-ups record no maintainer response.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| >=1.10.0 <=2.4.6 | no fixed version listed |

## Am I affected by CVE-2026-108592?

You are affected if you run mini-swe-agent >=1.10.0 <=2.4.6.

## How do I fix CVE-2026-108592?

For mini-swe-agent, keep API keys out of the environment the agent runs in (or wrap bwrap with --clearenv and --unshare-net and pass in only what a task needs), and rotate keys that were present while it processed untrusted tasks. For 9router, keep dashboard login on, restrict who can reach the dashboard, check ~/.hermes/config.yaml for hooks or hooks_auto_accept entries you did not write, and confirm that a release later than 0.5.99 actually encodes the value before relying on an upgrade. For mcp-remote, do not use --device-code against a server whose discovery metadata returns plain-HTTP endpoints, and revoke tokens issued through such a flow.

## How do I find every machine running mini-swe-agent?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run mini-swe-agent and which version, then enforce a policy on it.

## References

- advisory: https://www.vulncheck.com/advisories/9router-0.4.1-through-0.5.99-config-injection-rce-via-hermes-settings-endpoint
- cve: https://nvd.nist.gov/vuln/detail/CVE-2026-108592

## Related vulnerabilities

- [forever-security-an-agents-md-planted-in-downloads-got-codex-to](https://catalog.anomity.ai/vuln/forever-security-an-agents-md-planted-in-downloads-got-codex-to) — high
- [CVE-2026-103572](https://catalog.anomity.ai/vuln/cve-2026-103572) — high
- [CVE-2026-104120](https://catalog.anomity.ai/vuln/cve-2026-104120) — medium
- [mcp-server-discover-instructions-field-can-inject-before-the-first-tool](https://catalog.anomity.ai/vuln/mcp-server-discover-instructions-field-can-inject-before-the-first-tool) — high
- [CVE-2026-75130](https://catalog.anomity.ai/vuln/cve-2026-75130) — critical
- [ghostsplice-malicious-mcp-servers-split-one-instruction-across-two](https://catalog.anomity.ai/vuln/ghostsplice-malicious-mcp-servers-split-one-instruction-across-two) — high

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=cve-2026-108592