MCP Servers on Developer Machines: Trigger.dev's Dev MCP Server Listened on All Interfaces With No Auth (CVE-2026-114090), obsidian-tc Ran Destructive Tools After the Human Said No, and Three Unpatched npm MCP Servers Allow Code Execution

Several MCP server CVEs published 21 to 23 October 2026 affect servers developers run locally. CVE-2026-114090 (CVSS 7.6): `trigger dev --mcp` in Trigger.dev cli-v3 3.0.0 to before 4.5.4 bound its MCP server to all network interfaces and exposed /sse and /messages without authentication, so anyone on the LAN, or a malicious web page, could call trigger-task, cancel-run, list-runs and get-run-logs with the developer's stored Trigger.dev access token; fixed in 4.5.4. obsidian-tc, an MCP server for Obsidian vaults, published two advisories on 23 October: CVE-2026-115477 (CVSS 7.1), where a destructive tool call over Streamable HTTP still completed after the human declined or cancelled the confirmation, because the server took the echoed request state as proof of approval, and CVE-2026-115478, where memory tools overwrote hand-written notes sitting at the same path; both are fixed in 1.31.4. NVD also published CVE-2026-106765 (@rog0x/mcp-docker-tools 1.0.1, handleImageList), CVE-2026-106764 (@rog0x/mcp-git-tools 1.0.1, resolveBaseBranch) and CVE-2026-106763 (@justice8096/sagemath-mcp-server 1.0.1, escapeShellString and sanitizeCode), each described as allowing arbitrary code execution, with no fixed version published.

You are affected if you run obsidian-tc >=1.0.1 <1.31.4. Versions 1.31.4 and later include the fix.

Upgrade the Trigger.dev CLI to 4.5.4 or later and rotate the Trigger.dev access token on machines that ran trigger dev --mcp on an untrusted network. Upgrade obsidian-tc to 1.31.4 or later and back up any vault it can write. Remove @rog0x/mcp-docker-tools, @rog0x/mcp-git-tools and @justice8096/sagemath-mcp-server from MCP client configs. In general, run local MCP servers over stdio where the client supports it; when HTTP is needed, bind to 127.0.0.1, require a token and check the Origin header.

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run obsidian-tc and which version, then enforce a policy on it.