August 2026 agent-framework and MCP-server CVE batch — Spring AI tool-authorization bypass, PyCharm's unauthenticated Jupyter MCP, Splunk MCP RCE, LangChain SitemapLoader SSRF, and an LLM proxy that trusts a header for identity

View raw markdownEdit on GitHub ↗

TL;DR

One week's worth of CVEs across the AI-agent and MCP-server surface, grouped because they repeat the same four mistakes rather than because they share an actor. Headline items:

  • Spring AI — CVE-2026-59318: the per-request tool list Spring AI advertises to the model as a boundary isn't fully enforced at dispatch, so a tool not made available to the current request can still be invoked.
  • JetBrains PyCharm — CVE-2026-75060 (CVSS 8.4): the IDE exposed Jupyter MCP tools with no authentication, giving local code execution with no auth and no user interaction. Fixed in 2026.2.1.
  • Splunk MCP Server app — CVE-2026-76404 (CVSS 9.1, critical): unsafe deserialization in credential management → OS command execution. Fixed in 1.2.1, alongside nine Splunk AI Toolkit CVEs.
  • langchain-community — CVE-2026-72848 (CVSS 7.7): SitemapLoader applies restrict_to_same_domain only to leaf entries, so nested sitemaps SSRF into internal addresses — and the response comes back inside the returned Documents, making it a read-SSRF.
  • Headroom LLM proxy — CVE-2026-77776 (CVSS 9.3, critical): the proxy takes the memory owner from a client-supplied x-headroom-user-id header with no binding to the caller's credentials.

What happened

Spring AI — the advertised tool list is not the enforced one (2026-08-20/21)

CVE-2026-59318 / GHSA-wmqr-wxf2-6449 (Moderate, CVSS 6.5, CWE-863). Spring AI presents a per-request tool list to the model as a boundary, but does not fully enforce it at dispatch — a tool that was not made available to the current request can nonetheless be invoked, which is privilege escalation whenever request-scoped tool sets are how you separate privilege levels. Affects Spring AI 2.0.0, 1.1.0–1.1.8, and 1.0.0–1.0.9; fixed in 2.0.1 for open source, with 2.0.0.1 / 1.1.9 / 1.0.10 as Enterprise-Support-only backports.

This is the "decorator-as-documentation" class this repo has tracked since Semantic Kernel, now aimed at the request-scoped tool list rather than an SDK annotation. The general form: anything a framework shows the model as a constraint must also be checked where the call is actually dispatched. Telling the model about a limit is prompt engineering; enforcing it at dispatch is security.

Two siblings in the same batch:

  • CVE-2026-59279 / GHSA-2g9x-r8w8-qjff (High, CVSS 7.5, CWE-770) — the MCP Streamable HTTP server transport (WebFlux and WebMvc) puts no limit on retained sessions and requires no client authentication by default → unauthenticated remote memory exhaustion. Another entry in this repo's standing "MCP servers are unauthenticated network services by default" pattern. Affects Spring AI 2.0.0; the GHSA page does not state a patched version.
  • CVE-2026-59308 / GHSA-h4jw-w55g-65gf (Moderate, CVSS 4.2, CWE-668) — the Semantic Cache context hash doesn't isolate cached responses across different system prompts, so responses leak between unrelated contexts. Low CVSS, but for a multi-tenant deployment "another tenant's cached answer" is a data-isolation failure, not a caching quirk.

JetBrains PyCharm — an IDE shipping an MCP surface with the auth step missing (2026-08-17)

CVE-2026-75060 / GHSA-5686-8wvm-pm8w (High, CVSS 8.4, CWE-306 Missing Authentication for Critical Function). PyCharm exposed Jupyter MCP tools without authentication, letting a local attacker execute arbitrary code with no authentication and no user interaction. Fixed in PyCharm 2026.2.1.

Same shape as the Cline, OpenCode, Marimo, and AutoJack/AutoGen Studio entries in this repo's localhost cluster — and a reminder that the MCP surface an IDE opens on your behalf is one you did not choose to run and probably do not know is listening.

Splunk MCP Server — deserialization to OS command execution (2026-08-19)

CVE-2026-76404 / GHSA-3v49-2fcm-3rcj (Critical, CVSS 9.1), Splunk advisory SVD-2026-0808. The MCP Server app's credential-management component deserializes stored data without type validation; a user holding the Splunk admin role can supply or influence crafted serialized data and execute arbitrary OS commands on the host. Affects the Splunk MCP Server app < 1.2.1; fixed in 1.2.1.

The same advisory batch carries nine Splunk AI Toolkit CVEs (CVE-2026-76391 … CVE-2026-76399, CVSS 4.3–8.8), fixed in 6.0.0 / 6.0.1 — including CVE-2026-76395 (RCE via untrusted deserialization, 8.8), CVE-2026-76391 and CVE-2026-76394 (8.3, privilege management / missing authorization), and CVE-2026-76397 / CVE-2026-76399 (8.1, access control on experiment history and searches).

Authentication as admin is required for CVE-2026-76404, which lowers standalone urgency — but note the composition risk this repo keeps flagging: an MCP server is precisely the component an agent drives on your behalf, so "requires admin" means "requires the privilege the agent is probably already running with."

langchain-community — SitemapLoader read-SSRF (2026-08-21)

CVE-2026-72848 / GHSA-vg8m-4p2q-gcjh (High, CVSS 7.7, CWE-918). SitemapLoader.parse_sitemap applies the documented restrict_to_same_domain control only to leaf url entries — nested sitemap loc values go straight through to scrape_all([loc.text], "xml") unchecked. Anyone who controls or influences an ingested sitemap can steer the server at loopback, link-local, or RFC1918 addresses.

The aggravating detail: the fetched content is returned inside the resulting Documents, so this is a read-SSRF, not a blind one — cloud metadata, internal admin pages, and anything else reachable comes back into the pipeline (and, in a RAG setup, quite possibly into a model's context and then a user's answer). The GHSA page does not state affected or patched version ranges, so check langchain-community against the advisory directly rather than assuming a version is clean.

Same root shape as MLflow CVE-2026-64849: an SSRF guard that covers the obvious path and not the indirection one hop away.

Headroom LLM proxy — a header is not an identity (2026-08-21)

Two flaws in an LLM proxy, both amplified by a reference Docker Compose that binds 0.0.0.0 with no auth:

  • CVE-2026-77776 / GHSA-5vg3-c628-vf56 (Critical, CVSS 9.3) — the proxy derives the memory owner from the client-supplied x-headroom-user-id header without binding it to the caller's credentials (headroom/proxy/handlers/openai.py, chat-completion and WebSocket endpoints) → cross-user impersonation and access to other users' agent memory.
  • CVE-2026-77775 / GHSA-4j5r-9p93-j2px (High, CVSS 7.7, CWE-918) — clients choose the upstream via x-headroom-base-url; validation covers only scheme and hostname, so loopback, link-local, and RFC1918 destinations are reachable, responses are relayed back, and Authorization headers are forwarded unchanged to the attacker-chosen host. That last clause is the serious part: it hands your upstream LLM provider key to whatever host the caller names.

Neither GHSA page states affected or patched versions. This is a textbook instance of this repo's "central credentials cache" framing — an LLM proxy holds every upstream provider key for an org, so one header-trust bug is the union of every provider's API surface.

Also this window — MCP advisories entering the GHSA database

A cluster of MCP-server advisories was published to the GitHub Advisory Database between 2026-08-14 and 2026-08-19, but for several the original disclosure was June 2026 — the recent date is database ingestion, not discovery. Worth knowing so you don't read them as a fresh wave:

  • @contentful/mcp-server < 1.7.19 / @contentful/mcp-tools < 0.4.5 — CVE-2026-53957 / GHSA-2xhg-73j7-rrgx (CVSS 7.7). export_space / import_space pass LLM-controlled host and proxy arguments straight to the Contentful Management API client, so a prompt injection redirects the request — and the server's Personal Access Token — to an attacker endpoint. DB-published 2026-08-19; originally 2026-06-12.
  • chrome-devtools-mcp ≥ 0.24.0, ≤ 1.0.1 — CVE-2026-53766 / GHSA-8qf9-62x2-82pp (CVSS 6.1), patched 1.1.0. validatePath() uses path.resolve() instead of fs.realpath(), so a symlink that textually sits inside the workspace root escapes it, bypassing the MCP roots capability model. Notable because it is Google's own MCP server. DB-published 2026-08-17; originally 2026-06-16.
  • claude-faf-mcp ≤ 5.7.1, patched 5.7.2 — GHSA-rr55-jp92-8wp2 (CVSS 7.5, no CVE): arbitrary local file read/write via an unconfined path argument accepting absolute paths and ../. The advisory explicitly names prompt injection as the exploitation path (SSH keys, cloud credentials). Sibling advisories exist for faf-mcp (GHSA-j4r7-8ph4-43g3) and grok-faf-mcp (GHSA-cc2g-gq8c-r332).

@ooples/token-optimizer-mcp CVE-2026-55157 also entered the database on 2026-08-14; it is already tracked in the systemic MCP advisory.

Update 2026-08-30 — a second week, same four mistakes: seven more MCP servers bind every interface with optional-at-best auth (2026-08-22 to 2026-08-29)

A researcher/scanning effort surfaced via VulnCheck (each confirmed directly on NVD for this update) found seven more MCP-adjacent servers shipping the exact "listens on 0.0.0.0/:: by default, authentication is opt-in" pattern this advisory already names as mistake #2 — none share an actor or a codebase; they repeat the same default because it's the path of least resistance for an MCP server author, not because anyone copied anyone:

  • mcp-router CLI — CVE-2026-81094 / GHSA-rx55-5c7h-r56r (CVSS 3.1 9.1 critical, CVSS 4.0 9.3). The serve command (apps/cli/src/commands/serve.ts) defaulted its host to the all-interfaces address and required a caller token only if the operator passed the flag for it — a default invocation exposed the aggregator, and every MCP server it fronts, to the network. Affects < 0.6.3; fixed in 0.6.3.
  • ToolUniverse — CVE-2026-81096 / GHSA-pxwq-22vf-87fm (CVSS 3.1 10.0 critical). The python_code_executor tool's sandbox (python_executor_tool.py) denylisted specific attribute names/calls but left attribute-lookup builtins reachable via a string-based dunder lookup, and the server itself required no authentication — unauthenticated sandbox escape to arbitrary code execution. Affects ≤ 1.2.6; the GHSA page returned 404 to direct fetch during this sweep, so no fixed version is confirmed here — check the upstream repo directly.
  • Telnyx MCP server — CVE-2026-81098 / GHSA-46jp-xr2h-fw7h (CVSS 3.1 9.1 critical). packages/mcp-server/src/http.ts bound the Streamable HTTP transport to every interface and parsed caller auth headers in a mode that didn't fail when they were absent — a request with no credential completed initialization and dispatched tools. Affects ≤ 6.83.0; fixed version not confirmed (GHSA page 404'd to direct fetch).
  • UI-TARS-desktop (mcp-http-server / @agent-infra/mcp-server-*) — CVE-2026-81735 / GHSA not confirmed (CVSS 3.1 10.0 critical, CVSS 4.0 10.0). startServer.ts defaulted its listen address to :: (every interface) when no host was given, and its auth middleware was opt-in — applied only when a caller supplied it, exposing arbitrary command execution. Fixed by PR #1918 ("default host to 127.0.0.1, not all interfaces"), merged 2026-07-01 at commit c2ad42e; no released package version number is stated in the PR itself, so confirm your installed version postdates that commit rather than assuming a version number.
  • mcp-use Inspector proxy — CVE-2026-81091 / GHSA-f2jg-rm2x-hc5p (CVSS 3.1 8.6 high). mountMcpProxy (libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts) read a proxy target from an X-Target-URL header or __mcp_target parameter and forwarded to it without inspecting the host — loopback, link-local, and RFC1918 destinations all accepted. Affects ≤ 2.3.2; fixed version not confirmed (GHSA page 404'd to direct fetch).
  • Apify actors-mcp-server — CVE-2026-81093 / GHSA-m28f-9v8h-gg2f (CVSS 3.1 8.6 high). The get-html-skeleton tool's URL validator (isValidHttpUrl) checked only that the input parsed as an http(s) URL, never the resolved host — the same read-SSRF-via-agent-tool shape as langchain-community's SitemapLoader above, in a different codebase. Affects < 0.9.12; fixed in 0.9.12.
  • argocd-mcp — CVE-2026-82456 / GHSA-rp45-5x3v-48mr (CVSS 3.1 10.0 critical, CVSS 4.0 10.0). Binds its HTTP transport to every interface and, when ARGOCD_API_TOKEN is configured, accepts MCP sessions without requiring a caller credential — full tool surface (create applications, trigger syncs, modify resources) reachable by anyone who can reach the listener, using the operator's own stored token. Affects 0.8.0; fixed in 0.9.0.

All seven were confirmed directly against NVD for this update (published 2026-08-22 through 2026-08-29); each carries a vendor-repo GHSA cross-reference. Running tally for this repo's "MCP servers are unauthenticated network services by default" pattern: two batches, roughly three weeks apart, thirteen distinct MCP-adjacent projects, the same two defaults (bind-all-interfaces, auth-is-opt-in) in nearly every one.

Update 2026-09-09 — three more single-server MCP CVEs, none sharing an actor

Three unrelated MCP-server CVEs surfaced this window, each confirmed against a primary source (NVD, VulnCheck, or the GitHub Advisory Database directly) rather than an aggregator paraphrase:

  • mcp-atlassian — CVE-2026-73498 / GHSA-g5r6-gv6m-f5jv (CVSS 7.7, High). The confluence_upload_attachment function passes a client-supplied file_path straight to open(file_path, "rb") with no call to the codebase's own validate_safe_path() — a path-traversal that lets an authenticated MCP client, or an agent steered by indirect prompt injection, read and exfiltrate any file the server process can access (including environment variables such as CONFLUENCE_API_TOKEN). Affects < 0.22.0; fixed in 0.22.0. Same "an SSRF/path guard exists elsewhere in the codebase but wasn't applied here" shape already tracked above for chrome-devtools-mcp and LangChain's SitemapLoader.
  • ArcadeDB — CVE-2026-67357 / GHSA-p9wc-4fhr-78wm (CVSS 7.7, High). The MCP get_server_settings tool returns arcadedb.ha.clusterToken in cleartext; a client with MCP access can retrieve it and replay it via the X-ArcadeDB-Cluster-Token / X-ArcadeDB-Forwarded-User headers to impersonate root and take full administrative control. Affects < 26.7.3; fixed in 26.7.3. Do not confuse this with the sibling CVE-2026-67343 / GHSA-46hj-24h4-j8gf (CVSS 8.7) — a related but distinct cleartext-cluster-token disclosure in ArcadeDB's plain GET /api/v1/server REST endpoint (not the MCP tool), fixed one version earlier in 26.7.2. Both leak the same token via different endpoints; an operator patching only one has not closed the other.
  • facebook-ads-mcp-server (gomarble-ai) — CVE-2026-19956 (CVSS 3.1: 6.3 Medium / CVSS 4.0: 5.3 Medium, CWE-918 SSRF). The fetch_pagination_url function in server.py forwards a pagination URL without validating its host, allowing an authenticated caller to drive SSRF from the server's network position. Affects 0.1.0; fixed via commit 4e53875 / PR #32. No GHSA has been filed — this record is VulDB-sourced and confirmed only against NVD; noted here rather than given its own file per this repo's low-value-single-CVE threshold.

Update 2026-09-12 — critical MCP-server RCEs entering the GHSA database, same two defaults again (and one that is command-injection, not misconfig)

The GitHub Advisory Database's reviewed-critical listing published a fresh batch of MCP-server CVEs in early September; per this repo's standing caution, a GHSA database-publication date is not a disclosure date, and most of these were originally disclosed in June–August, so they are dated by original disclosure below. All were fetched from their GHSA pages directly.

  • chainlit — CVE-2026-45018 / GHSA-w3fx-mc44-mf6j (CVSS 9.8). With MCP enabled, the /mcp endpoint's validate_mcp_command() allowlists only the executable name and never inspects arguments, so npx -y -c '<command>' reaches a shell — unauthenticated RCE for any client with a session. Affects ≥ 2.4.0rc0, ≤ 2.11.1; fixed 2.12.0 (2026-08-25). Chainlit is a common vibe-coding chat-UI framework; disable MCP (features.mcp.enabled = false) if you cannot upgrade.
  • mcp-contextforge-gateway — CVE-2026-53710 / GHSA-xm98-3vcf-fph7 (CVSS 10.0). RestrictedPython sandbox bypass in python_sandbox_server: raw getattr in safe_builtins plus runtime-constructed dunder names lets an attacker on the HTTP/SSE transport walk to subprocess.Popen and execute commands. Affects ≤ 1.0.1; fixed 1.0.2 (2026-08-24). This is the same IBM ContextForge gateway family already tracked in the MCP stdio systemic-RCE advisory — a distinct new sandbox-bypass CVE, not the earlier finding.
  • mysql-mcp-server — CVE-2026-59971 / GHSA-rqfv-2mw9-78g2 (CVSS 10.0). In SSE mode the server sets no security_settings, so DNS-rebinding protection defaults off, there is no CORS/TrustedHost middleware, routes are unauthenticated, and it binds 0.0.0.0 — unauthenticated SQL execution (and file R/W / RCE via MySQL FILE). ~25 instances were found publicly exposed. Affects < 0.4.2; fixed 0.4.2 (disclosed 2026-06-21, reviewed into the advisory database 2026-09-11). The exact bind-all-interfaces / auth-optional pattern this advisory has now tracked across ~20 MCP projects.
  • PraisonAI — CVE-2026-55536 / GHSA-6g6r-q6gw-w8fg (CVSS 9.1). A patch bypass of CVE-2026-40289: the browser server validates the WebSocket Origin with re.match() (anchored only at the start), so chrome-extension://<32 chars><extra> passes and an attacker drives browser automation, exfiltrates cookies, and screenshots authenticated sessions. Affects < 4.6.58; fixed 4.6.58. Folds into this repo's existing PraisonAI advisory thematically but is logged here with the MCP/agent-server batch; the fix replaces re.match() with re.fullmatch().
  • Also reviewed into the advisory database this window (older disclosures, lower vibe-relevance, noted not detailed): qwed-mcp CVE-2026-55546 (SymPy parse_expr() RCE, fixed 0.2.1), nextcloud-mcp-server CVE-2026-55640 (unauthenticated webhook when WEBHOOK_SECRET unset, fixed 0.117.2), and the trojanized pantheon-agents PyPI package (0.6.1/0.6.2, June 2026 maintainer-token compromise, .pth Bun credential-stealer) — the last is a supply-chain compromise rather than a code-level MCP CVE.

Running tally: across the three batches this file now tracks (August, 2026-08-30, and this one), the "an MCP server is an unauthenticated network service by default, and the guard that exists elsewhere in the codebase wasn't applied here" pattern holds in nearly every case; the chainlit and contextforge entries add unsandboxed-command-execution as a second recurring root cause alongside missing origin/host validation.

Update 2026-09-13 — Grafana's official MCP server: an unauthenticated session-spoof chained into a CVSS 9.1 SSRF that reaches the cloud metadata service (CVE-2026-19516, fixed 1.1.0). Pillar Security (Ariel Fogel et al., published 2026-09-02) found two flaws in mcp-grafana — Grafana Labs' own MCP server, which Pillar counts at over 1.9M cumulative Docker Hub pulls — that combine into one unauthenticated path to the internal network:

  • Session spoofing (no CVE). The server validated the format of an MCP session id rather than whether it had issued it, so a remote caller could mint its own session id locally and invoke tools with the server's Grafana service-account token. Session ids are state references, not credentials — the exact mistake the DeepSeek Harness and NemoClaw findings make with Host headers.
  • CVE-2026-19516 (Grafana-assigned CVSS 3.1 9.1, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L, CWE-918; published 2026-08-11). The grafana_api_request tool honoured a caller-supplied X-Grafana-URL header for its outbound destination, method, path, body and headers. Grafana's advisory states this is an incomplete fix for CVE-2026-15583: the earlier patch stopped the token leaking to foreign hosts but never restricted the destination, so the server still executed the request and returned the response — "a readable, method-capable proxy from its own network location," in Pillar's words — reaching loopback, private ranges and AWS IMDSv2 credentials. The vector says PR:L; the session-spoof supplies the "L".

Timeline per Pillar: reported via Intigriti 2026-08-02; v1.1.0 released 2026-08-10 with the SSRF fix and optional bearer-token authentication (401 for unauthenticated requests, plus a logged warning when the server binds beyond loopback); CVE published 2026-08-11. "Optional" is the word to notice — an upgraded server that never sets the token is still unauthenticated. Affected ≤ 1.0.0. CSA's 2026-09-08 research note on the finding titles it "identity confusion by design": the MCP server acts with its own service-account identity on behalf of any caller it cannot tell apart. Fifth entry in this file where the fix note reads "added authentication (optional)".

Update 2026-09-14 — three vendor-bulletin batches: AWS's official database MCP servers (read-only gates that weren't), four more IBM ContextForge CVEs, and a coding agent whose repo config could switch on its shell tool. All confirmed against the vendor bulletin or NVD record, not an aggregator.

AWS Labs MCP servers (AWS Security Bulletins 2026-097, 2026-101, 2026-103; CNA AWS): - awslabs.postgres-mcp-server — CVE-2026-85787 (CVSS 4.0 7.1, CWE-184). The SQL validation blocklist that enforces read-only mode was incomplete: crafted SQL placed in content an authenticated user submits to the MCP server could modify data "beyond the read-only scope." Affects < 1.1.7; fixed 1.1.7 (2026-09-04). AWS's own workaround is the real fix — run the server as a minimal Postgres role with only CONNECT/USAGE/SELECT, never a superuser or master user. Reporter: Ashwak N. - awslabs.mysql-mcp-server — CVE-2026-85788 (CVSS 5.7). The mutable-SQL detector missed SQL inline comments that the regex did not treat as whitespace, letting statements bypass the read-only gate and reach file-read/file-write SQL sinks. Affects ≤ 1.0.21; fixed 1.0.23 (2026-09-09). Same advice: no FILE privilege on the database user. Reporter: Jaeyoung Yun. - awslabs.dynamodb-mcp-server — CVE-2026-85654 (CVSS 4.0 7.1, CWE-1336 template injection). The CDK generator — the tool that turns a data-model JSON into deployable infrastructure code — did not neutralise table, index, or attribute names, so a crafted dynamodb_data_model.json executes arbitrary code on the host that runs the generator. Affects 2.0.10 – 2.1.5; fixed 2.1.6 (2026-09-04). Local vector, but the data-model file is exactly the artifact an agent writes from an untrusted spec. Reporter: Jaimen Bell. Pattern note: two of the three are "the read-only mode is a regex" — the guard is a denylist over SQL text, and the model (or a prompt-injected model) writes the SQL. Prefer database-side privileges to server-side string filtering, as AWS's own bulletins recommend.

IBM ContextForge MCP Gateway (IBM PSIRT bulletins, published 2026-09-02; NVD 2026-09-04) — four CVEs, distinct from the CVSS 10.0 RestrictedPython bypass (CVE-2026-53710) logged in the 2026-09-12 update: - CVE-2026-18486 (CVSS 3.1 8.8): unrestricted jq filters let an authenticated developer call built-ins like $ENV and read environment variables holding "cryptographic keys and database credentials that can be leveraged to forge administrator tokens." Affects ≤ 1.0.7; fixed 1.0.8. IBM's remediation includes running the re-encryption migration and rotating JWT_SECRET_KEY, AUTH_ENCRYPTION_SECRET, DATABASE_URL, REDIS_URL, BASIC_AUTH_PASSWORD — no workaround. - CVE-2026-77822 (CVSS 8.2): SSRF via DNS rebinding in the A2A agent invocation path — the resolved IP is not pinned at connection time. Affects ≤ 1.0.8; fixed 1.0.9. - CVE-2026-18905 (CVSS 7.7): DNS-rebinding TOCTOU — URL validation runs at tool registration, not invocation, so a low-privilege user changes the DNS record afterwards and redirects outbound gateway requests to internal targets. Affects ≤ 1.0.6; fixed 1.0.7. - CVE-2026-18489 (CVSS 7.1, CWE-488): the Translate utility with --enable-dynamic-env could execute a second client's request under the first client's credential-derived environment. Affects ≤ 1.0.8; IBM's "fix" (PR #6388) is documentation stating Translate is for local single-session development only — if you run it multi-client, stop, rotate, audit. Six ContextForge CVEs across two files in three weeks; IBM's bulletin pages (ibm.com/support/pages/node/<id>) are the record, per this repo's corporate-parent rule.

CodeWhale (Hmbown/CodeWhale, a terminal coding agent for open-weight models; VulnCheck CNA; disclosed 2026-07-16, database-reviewed 2026-09-04): - CVE-2026-75911 (CVSS 4.0 8.5): a repo-committed .codewhale/config.toml could set allow_shell = true, which the agent applied silently, enabling its exec_shell/task_shell tools with no prompt. approval_policy and sandbox_mode had tightening-only guards; allow_shell did not. Affects 0.8.41 – 0.8.63; fixed 0.8.64. Same class as aider's .aider.conf.yml: a project config file the attacker wrote is trusted as if the user wrote it. Reported by VinSOC Labs. - CVE-2026-75858 (CVSS 8.5): the rlm_eval tool executed model-supplied Python and returned ApprovalRequirement::Auto, which the engine treats as never-prompt — unsandboxed code execution from any prompt injection. Same affected/fixed range (plus the older deepseek-tui package name it was forked from, 0.8.33 – 0.8.40). - CVE-2026-75856 (CVSS 9.2): SSRF-guard DNS-pinning TOCTOU — a DNS server that fails the first resolution and answers the second with 127.0.0.1 reaches local services and cloud metadata. Same range; fixed 0.8.64.

Update 2026-09-15 — a fourth week: an unauthenticated-by-default AI gateway (Bifrost, 9.8), an IAM server whose MCP endpoint skips authorization (Casdoor, 9.9/9.4, unpatched), default credentials in ContextForge (9.8), and three more June disclosures reviewed into the database. All fetched from the primary advisory or the CNA record, not an aggregator.

  • Bifrost — CVE-2026-90898 (CVSS 3.1 9.8, CNA JFrog, 2026-09-14). One unauthenticated POST /api/mcp/client registers a stdio MCP client, which the gateway starts immediately — code execution as the gateway process whenever governance.auth_config.is_enabled=false, the shipped default. Fixed transports/v2.1.0 (2026-09-08). Written up on its own: Bifrost — unauthenticated MCP client registration RCE.
  • Casdoor — CVE-2026-91998 (CVSS 3.1 9.9 / 4.0 9.4, CNA VulnCheck, published 2026-09-15; CWE-863). Casdoor is an open-source IAM / SSO server. Its /api/mcp endpoint resolves any request carrying any application's OAuth clientId/clientSecret to an app/<name> subject that hits an unconditional global allow, skipping the Casbin policy and organization scoping. Whoever holds one application's credentials can enumerate users (password salts and emails included), create administrators, and modify or delete users in every organization. Affects through 4.4.0; no fixed version as of 2026-09-15. The researcher (George Chen) reports emailing the project on 2026-06-13, opening GitHub issues around 2026-06-26 after no response, and the issues being deleted; the same write-up carries two further unpatched findings (unauthenticated file upload; organization admins reading the global JWT signing key). If your app's auth server is Casdoor, treat every application credential as an admin credential until a fix ships, and keep /api/mcp off the internet.
  • IBM ContextForge MCP Gateway — CVE-2026-78573 (CVSS 9.8, CWE-1392 use of default credentials; IBM bulletin 7286834 published 2026-09-09, NVD 2026-09-10). The gateway ships with known default values for platform_admin_password, default_user_password and basic_auth_password, so remote attackers obtain administrative access. IBM's bulletin says v1.0.0 through v1.0.9, fixed v1.0.10; the GitHub Advisory Database copy says 1.0.0 – 1.0.7 — prefer IBM's range. Set all three to strong values before enabling authentication features. Seventh ContextForge CVE in this file.
  • FrontMCP / mcp-from-openapi — CVE-2026-59973 (CVSS 8.5; vendor advisory 2026-06-22, database-reviewed 2026-09-11). A bypass of the earlier SSRF fix (CVE-2026-39885) for external OpenAPI $ref resolution: the hostname denylist still admitted loopback and private targets via DNS names resolving to loopback, redirect chains and IPv4-mapped IPv6. @frontmcp/adapters and frontmcp ≥ 1.2.1 < 1.5.0 → 1.5.0; mcp-from-openapi ≥ 2.3.0 < 2.5.0 → 2.5.0.
  • functype-mcp-server — CVE-2026-59176 (CVSS 7.8; 2026-06-20, database-reviewed 2026-09-09). The set_functype_version tool interpolates an unvalidated version string into pnpm add functype@<version>; npm alias and file: syntax install an attacker-chosen package which the server then dynamically imports. ≤ 1.4.3 → 1.4.4. A package-manager invocation with model-supplied arguments is the same primitive as the "install a dependency" tool in every coding agent.
  • knowns — CVE-2026-88938 (CVSS 4.0 7.1 / 3.1 6.5, CNA VulnCheck, 2026-09-10), plus two siblings the database lists for the same project (CVE-2026-86541, handleCodeReplace path traversal; CVE-2026-86439, MCP tool path validation; both 2026-09-08, not fetched individually). knowns (knowns-dev/knowns) is a Go MCP server that gives AI agents project context; its code.find tool did not confine the path argument to the project root, so agent sessions read any file on the host. Affects through 0.33.0; no fixed version on the CNA record as of this date.

Bifrost and Casdoor are the two ends of this file's pattern: one ships with authentication off, the other has authentication on but exempts the MCP route from authorization. An /api/mcp or /api/mcp/client route is a control plane and needs the same gate as the admin UI.

Update 2026-09-16 — two more unauthenticated-RCE agent-infra servers reviewed into the database (LightLLM, atomic-agents-stack), both VulnCheck CNA.

  • LightLLM — CVE-2026-90919 (CVSS 4.0 9.3, VulnCheck, published 2026-09-14). LightLLM (ModelTC, a high-performance LLM inference/serving framework) exposes an unauthenticated /visual_register WebSocket endpoint on its Config Server that passes the first client frame straight to pickle.loads() — send a serialized payload with a __reduce__ method and get code execution as the Config Server process. Affects through 1.2.0; the CNA record lists no fixed version as of this date, so treat it as unpatched and keep the Config Server port off any untrusted network. Pickle-over-the-wire is the same primitive as the LangGraph msgpack chain and the NLTK/unstructured pickle findings — a "load this object" endpoint is a "run this code" endpoint.
  • atomic-agents-stack — CVE-2026-91988 (CVSS 4.0 9.2, VulnCheck, published 2026-09-15). The HTTP MCP server-registry backend factory accepts cleartext http:// schemes, so a network man-in-the-middle rewrites the catalog response and injects command/argument values that MCPClientPool spawns as local subprocesses — RCE on the agent host. Affects before 1.1.0; fixed 1.1.0. This is the MITM-on-the-registry cousin of the Coder registry compromise: when the thing that tells your agent which MCP servers to run is fetched over plaintext, whoever sits on the wire chooses the command.

Update 2026-09-17 — the official Rust MCP SDK (rmcp): a client-side OAuth token-theft bug and an unauthenticated session-table leak, both fixed in 2.0.0 (CVE-2026-63127 / CVE-2026-63128, published 2026-09-16). rmcp is the Model Context Protocol organisation's Rust SDK — the library behind Rust-built MCP servers and clients. Two GitHub-reviewed advisories landed on 2026-09-16, both fetched directly:

  • CVE-2026-63127 / GHSA-33f5-2c5q-wgwj (CVSS 8.2, High). The OAuth Protected Resource Metadata discovery in rmcp's client never validated the resource field RFC 9728 requires it to check ("the client MUST ensure that the resource identifier URL it is using as the prefix for the metadata request exactly matches the resource value in the returned metadata document") — the ResourceServerMetadata struct had no such field at all. A malicious MCP server can therefore serve metadata that names a legitimate server's authorization server; the user's OAuth flow runs against the real provider, and the resulting access token, valid for the legitimate MCP server, is returned to the attacker's. Every rmcp-based client talking to OAuth-protected MCP servers is exposed; the fix is "full account impersonation on the legitimate server" territory. Affects < 2.0.0; fixed 2.0.0. This is the client-side mirror of the rmcp DNS-rebinding server bug (CVE-2026-42559, 2026-05-06, High) the advisory database also lists for this crate, which this repo had not logged — and a reminder that "connect to this MCP server" is an authorization decision even when the server is only pretending to be someone else's.
  • CVE-2026-63128 / GHSA-9pj6-vhgr-3mwh (CVSS 7.5, High). The Streamable HTTP server transport allocated a session and spawned a worker before validating the request body, then returned 422 for any non-InitializeRequest without cleaning up — so an unauthenticated client leaks one ~400–550-byte session-table entry per request, permanently. The reporter sustained 2,100 requests/second from one Python client, i.e. tens of gigabytes a day, plus lock contention on the session manager's RwLock for legitimate clients. Affects < 2.0.0; fixed 2.0.0.

Rust MCP servers are a small share of the ecosystem, but the SDK-level pattern is the one to carry: an MCP client has its own trust decisions (which authorization server, which resource) that a hostile server can steer, and a transport that "accepts a connection then checks" is a resource-exhaustion primitive. Upgrade rmcp to ≥ 2.0.0 on both sides.

Update 2026-09-18 — a third rmcp client bug, and the fix line moves to 2.1.0: custom headers (API keys) follow a cross-origin redirect (CVE-2026-64684 / GHSA-9g45-5xwm-f3wc, CVSS 6.8, published 2026-09-16). StreamableHttpClientTransport built its default reqwest client with automatic redirects on and applied StreamableHttpClientTransportConfig.custom_headers without marking them sensitive, so "when a malicious or compromised MCP endpoint returns a cross-origin 307 or 308 redirect, reqwest follows the redirect and apply_custom_headers causes custom API keys or authentication tokens to be replayed to the new origin, where an attacker can capture and reuse them" (NVD, CNA GitHub). The separate auth_header path was not affected. Affects < 2.1.0; fixed 2.1.0 (rust-sdk PR 936, commit 496902b9…). Same shape as the Clerk proxy SSRF and the LiteLLM credential-forwarding bugs elsewhere in this repo: a client that forwards a secret to wherever the server points it. Combined with the two 2026-09-16 advisories above, every rmcp client built before 2.1.0 has a token-theft path that a hostile MCP server can trigger; upgrade to ≥ 2.1.0 and, where you control the transport config, disable redirect-following or set headers as sensitive.

Update 2026-09-20 — the MCP runtime layer joins the list (ToolHive containers reach the host, Obot's OAuth mints over-scoped tokens), plus three Claude-Code-ecosystem tools no vendor tab will ever show you

Six items from the mcp recency listing and the ?query=claude / ?query=agent database queries, three of them entering the database weeks or months after their vendor dates:

  • ToolHive — containerised MCP servers reach host-local services via host.docker.internal (CVE-2026-58197 / GHSA-qg2g-g9w3-m5h8, CVSS 8.8 AV:A/AC:L/PR:N/UI:R/S:C, vendor advisory 2026-07-28, database 2026-09-18). Stacklok's ToolHive is the "run every MCP server in its own container" runtime this repo's MCP hygiene guide is the shape of. Its advisory: "A containerized MCP server running with the default network permission profile can reach host-local services via host.docker.internal. This includes the ToolHive API itself, other ToolHive-managed MCP server proxies" — and any self-hosted model or service bound to the host. Three weaknesses stacked: insecure-by-default networking, unauthenticated API endpoints, and Docker's built-in DNS name for the host — no container escape needed. A malicious MCP server in one container can enumerate and call the native MCP tools ToolHive manages with elevated privileges, poke the control plane, and exfiltrate through other servers. Affects < 0.30.1; fixed 0.30.1 (PRs stacklok/toolhive#5583, toolhive-studio#2469). The lesson is the one the whole batch keeps teaching, one layer down: the isolation product's default profile is the boundary, and it was open.
  • Obot (obot-platform/obot, Go — an MCP gateway/registry platform) — three vendor advisories dated 2026-06-22, GitHub-reviewed 2026-09-18, all fixed 0.23.0, no CVEs. GHSA-xwmw-prc4-v3cr (8.8): OAuth Dynamic Client Registration accepted unauthenticated clients with arbitrary redirect URIs, the authorization flow auto-completed with no consent screen for a logged-in victim who clicked a crafted link, and the token issued "contained the victim's full group permissions rather than being scoped to just the requested MCP server" — API access to everything the victim could reach (credit EQSTLab; the fix adds a consent screen, per-MCP token scope and audience validation). GHSA-jgh3-fggc-mcpm (7.6, PR:H): a Power User registering a remote MCP server supplies a URL that is "fetched server-side with no validation of the destination" — loopback, RFC1918, and 169.254.169.254 all reachable, responses reflected in error messages (non-blind), cloud IAM credentials on the table; 0.23.0 adds a single egress chokepoint that rejects internal ranges at dial time. GHSA-pr6h-vr44-xq8j (5.3): with OBOT_SERVER_ENABLE_REGISTRY_AUTH=true set, the /v0.1/* MCP-registry endpoints were still readable anonymously because the authorizer's protected-prefix list omitted /v0.1 (catalog metadata and connection URLs, no credentials). Same DCR/redirect shape as Bifrost's unauthenticated client registration and the rmcp OAuth bugs above.
  • cc-connect — Feishu card callbacks skip the per-user allowlist (CVE-2026-92801 / GHSA-2qg4-97v5-72x5, CVSS 8.7, database 2026-09-16, CNA VulnCheck). cc-connect (chenhg5/cc-connect, ~15.6K stars) bridges a local Claude Code / Cursor / Gemini CLI / Codex session to Feishu, Telegram, Slack and Discord so you can drive your coding agent from a chat app with no public IP. Through 1.5.0 it validated per-user permissions on text messages but not on Feishu interactive-card actions, so "attackers can dispatch agent commands by triggering card actions in admitted chats" — anyone in a chat the bridge is admitted to, not only the allow-listed operator, can send instructions to the agent on your machine. The database record lists no patched version and the repository's newest tag at fetch time was v1.5.1-beta.1; treat every version as affected until the project says otherwise (repo issue #1852). This is the messaging-bridge variant of OpenClaw's non-owner-sender bugs — the chat platform's membership is not the agent's authorization.
  • Tencent BrowserSkill — any 32-character chrome-extension:// origin is accepted by the local daemon (CVE-2026-94111 / GHSA-x6f2-qp26-2xrh, CVSS 6.9 on the database record, published 2026-09-20). BrowserSkill is an agent browser-automation tool; its local daemon's WebSocket origin check "accepts any chrome-extension origin with 32 characters in range a-p" — which is every extension id. A malicious extension registers itself as the browser client and "intercept[s] or alter[s] page content, DOM elements, and screenshots sent to the AI agent." Through 0.3.0, no patched version listed (repo issue Tencent/BrowserSkill#273). It is BragJack's mechanism applied to an agent's eyes rather than its prompt: what the model sees is attacker-chosen.
  • OpenPanel — MCP auth tokens from URL query parameters written to plaintext logs (CVE-2026-93982, CVSS 4.8, published 2026-09-19). Through commit bad75bdd, the analytics platform logged base64 MCP credentials unredacted; anyone with stdout or centralised-log access can replay them against the MCP endpoint. Low score, familiar shape (CWE-532); rotate MCP tokens if your logs are shared.
  • Two "Claude Code ecosystem" tools with no vendor and no tab — found only by querying the advisory database for the agent's name. claude-code-templates (npm) — CVE-2026-73222 / GHSA-79wm-x847-7cvg, CVSS 8.8: the --studio development server (an Express app) binds 0.0.0.0 with no authentication and accepts cross-origin requests, and POST /api/execute and POST /api/install-agent pass input to a shell with shell: true — a web page you visit while Studio is running, or anyone on the same network, runs commands as you. Affects ≤ 1.29.2, fixed 1.29.4 (vendor advisory 2026-07-14, CVE 08-11, database 09-03, reporter spartan8806, commit bc4618b); the registry shows 1.29.6 on 2026-09-17 and ~1,930 downloads in the week to 09-19. claude-skill-antivirus — CVE-2026-84810 / GHSA-gvgj-r6pg-m42w, CVSS 7.1: a scanner meant to vet skills before you run them "reads only SKILL.md while ignoring Python source, bytecode, and other artifacts," returning SAFE, 100/100 trust for a skill whose payload lives in any other file (CNA VulnCheck, database 2026-09-02, repo issue claude-world/claude-skill-antivirus#33, no versions listed). A skill scanner that scans the manifest is worse than none, because it produces a green badge; if you rely on one, confirm it opens every file in the directory.
# ToolHive: below 0.30.1 the default network profile reaches the host
thv version 2>/dev/null
# Obot: below 0.23.0 the OAuth DCR + registry bugs are live
# claude-code-templates Studio: is it listening on all interfaces right now?
ss -tlnp 2>/dev/null | grep -E '0\.0\.0\.0:(3[0-9]{3}|[0-9]{4,5})' | grep -i node
npm ls -g claude-code-templates 2>/dev/null   # < 1.29.4 = unauthenticated RCE when --studio runs
# cc-connect: any Feishu chat the bridge is admitted to can drive the agent through card actions — remove the bridge from shared chats until a fix ships

Update 2026-09-21 — a self-hosted LLM router whose auth middleware checked the path before the rewrite: 9router CVE-2026-55638 (CVSS 8.6), found via the advisory database's codex query

  • 9router (npm, an OpenAI/Anthropic-compatible LLM proxy) — GHSA-8gmq-j984-vp4r, CVE-2026-55638, CVSS 8.6, published 2026-07-07, fixed 0.5.2 (reporter @dinhvaren). The proxy protects /v1, /v1beta, /api/v1 and /api/v1beta with API-key checks in Next.js middleware, but also has a rewrite mapping /codex/* → /api/v1/responses — and "the middleware checks the original request path before rewrites are applied." /codex is not in the protected list, so an unauthenticated request to it reaches the backend and spends the operator's provider credentials. Same class as the OmniRoute and LiteLLM gateway bugs: a router holds every provider key, and a routing-layer mismatch (rewrite vs. middleware, here; header-trusted identity in Headroom above) hands them to anyone who can reach the port. It surfaced only because the github.com/advisories?query=codex listing matched the /codex path in the title — a reminder that the agent-name queries (LEARNINGS §29) catch products that merely route to an agent's API. Below 0.5.2 with the proxy reachable, assume the keys were used; rotate and upgrade.

Update 2026-09-22 — two more 9router CVEs (a spoofable X-9r-Real-Ip header decides "is this localhost?"), and an MCP server whose path-traversal fix is opt-in (notebooklm-mcp CVE-2026-61647)

  • 9router again — GHSA-5mj8-gf6m-fhw8, CVE-2026-56681, CVSS 7.3 High, and GHSA-32gc-64m7-hj7v, CVE-2026-56682, CVSS 5.3 (reporter b401t; vendor-published 2026-07-16, database and NVD 2026-09-22). The proxy decides whether a request is local by reading the X-9r-Real-Ip header, which is supposed to be set only by its bundled custom-server.js from the TCP socket address. Deploy without that wrapper — the README's default bind is 0.0.0.0 — and "a remote, unauthenticated attacker can simply send X-9r-Real-Ip: 127.0.0.1 and be treated as a local client," which skips API-key validation on /api/v1/* (verified on GET /api/v1/models) and hands out the owner's configured provider connections. The second bug is the same header as the key of the login rate-limiter (MAX_FAILS_BEFORE_LOCK = 5): rotate the value per request and "the lockout never triggers, enabling unlimited password guessing against the dashboard login endpoint" — against a product that ships a default dashboard password. Three 9router CVEs in two months, all the same lesson as CVE-2026-55638 above: the auth layer trusts something the client controls (a path before rewrite, then a header). Versions: the GHSA says affected <= 0.5.4, patched 0.5.8; NVD's text says "prior to 0.5.6"; the vendor references release tag v0.5.6; the npm registry has no 0.5.5–0.5.7 at all — 0.5.4 (2026-06-18) is followed by 0.5.8 (2026-06-21), so 0.5.8 is the first published fix and current is 0.5.85. ~43K downloads in the week to 09-21. Run current, keep custom-server.js in front, and strip inbound X-9r-* headers at the edge.
  • @roomi-fields/notebooklm-mcp — GHSA-jjhp-8crj-mppq, CVE-2026-61647, CVSS 4.0 7.1 High (reporter mcfly-zzh; vendor-published 2026-06-23, NVD 2026-09-21, database 2026-09-22). An MCP server for Google NotebookLM: the batch_to_vault tool (and POST /batch-to-vault) passed a caller-supplied vault_dir straight to path.resolve() + fs.mkdir(), and concatenated slug_prefix into the filename unsanitised, so "a caller or a prompt-injected LLM driving the MCP" can write .md/.json files anywhere the process can — the advisory itself names autostart folders and shell startup files as the downstream targets. Affected >= 1.6.0 < 2.0.3 (2.0.3 published 2026-06-20, 17 minutes after 2.0.2). The catch: 2.0.3 sanitises slug_prefix unconditionally, but the vault_dir containment is opt-in — "v2.0.3 keeps legacy unrestricted behaviour when NOTEBOOKLM_VAULT_ROOT is unset." A npm update does not close the traversal; setting the environment variable does. Small package (~580 downloads/week), but it is the clearest example yet of a "patched" MCP server whose fix is a configuration flag the advisory has to tell you to set — check the advisory's configuration requirement, not only the version, before marking an MCP server safe.

Update 2026-09-23 — ToolHive's proxy layer keeps failing to bind sessions to identities (three more), an OS-command-injection MCP config loader in Moonshot's Kimi Code, a cross-audience token cache in Google's MCP Toolbox SDK, and a cross-project MCP file read in Langflow

Five more, from the mcp recency listing and per-vendor advisory tabs. The mass mcp-atlassian CVE block that entered the database the same day (26 CVEs assigned 2026-09-22 for the July 0.22.0 audit, headline CVE-2026-77244 CVSS 10.0 auth bypass) is large enough to have its own advisory rather than a line here.

  • ToolHive — three proxy/session-isolation bugs (2026-09-21/22), none with a CVE, extending the host.docker.internal finding from the 09-20 update above. Stacklok's MCP runtime keeps shipping proxy bugs where a request authenticates but the session is not bound to the caller: GHSA-hxx3-f8cg-r974 (CVSS 8.8, ≥ 0.0.3 < 0.50.0) — "ambiguous JSON members bypass MCP authorization" because ToolHive decodes params case-sensitively for its Cedar policy check while forwarding the raw body to a case-insensitive backend, so {"name":"allowed","Name":"denied"} runs the denied tool; GHSA-hqg7-qjgg-q779 (7.1, < 0.51.0) — "MCP sessions are not bound to authenticated principals," so anyone with another user's session id can inject into or evict their session; GHSA-wm2j-ch74-276r (7.1, < 0.51.1) — the legacy HTTP+SSE proxy "broadcasts every backend JSON-RPC response to every connected SSE client," so an attacker on their own SSE stream passively receives a victim's tool results. All reported by GEONWOOHAN. Run ≥ 0.51.1. ToolHive is the "one container per MCP server" runtime this repo's MCP hygiene guide recommends; the pattern here is that container isolation does not give you session isolation for free.
  • Moonshot AI Kimi Code — MCP config loader OS command injection (CVE-2026-95660 / GHSA-jp7p-97jq-v89h, CVSS 3.1 6.3 / 4.0 2.1, published 2026-09-22, CNA VulDB). In agent-core-v2/src/agent/mcp/config-loader.ts, an untrusted workspace's MCP configuration could plant bare-name fd/stty executables that the loader spawned from PATH — the same "a config file you open becomes a command" class as aider's .aider.conf.yml and the OpenClaw gcloud argument injection. Fixed in 0.31.1 (npm @moonshot-ai/kimi-code, 2026-07-31) by resolving fd/stty to absolute paths; the CVE is a late September assignment against a July fix. Current is 2.1.0 — the vulnerable range is long behind current, but a pinned old Kimi Code opening an untrusted repo is the exposure.
  • Google mcp-toolbox-sdk-python (toolbox-core) — cross-audience ID-token cache (CVE-2026-19202 / GHSA-jcjp-gr26-563j, CVSS 4.0 9.1 Critical, NVD 2026-09-22, database 2026-09-23, CNA Google). The toolbox_core.auth_methods module cached Google ID tokens in a single module-level dict keyed by nothing, so "a valid, unexpired token minted for a sensitive service (Service A) can be retrieved from the cache and sent to a secondary service (Service B)" — OIDC audience isolation broken, enabling token replay and impersonation across the services an app authenticates to through the SDK. Reported through Google's OSS VRP; fixed by keying the cache per audience in PR #675 (merged 2026-06-05). The advisory database lists affected/patched as "unknown"; the registry shows toolbox-core releases through 1.4.0 (2026-09-01), so run current. A high CVSS on a Google-published SDK that no vendor security tab carries (the repo shows "no published advisories") — found only via the mcp database listing.
  • Langflow — authenticated cross-project MCP file disclosure (GHSA-4hmc-cfm3-w43c, CVSS 4.0 7.1 High, published 2026-09-22, no CVE, fixed 1.9.1). Langflow's MCP transport authenticated the user at connect time but handle_read_resource() did not verify ownership of the target file, so "any authenticated Langflow user who can access at least one project-scoped MCP endpoint can read files belonging to other users" by supplying a victim file URI. Fixed 1.9.1 (2026-04-24); current 1.12.3. Distinct from the IBM PSIRT Langflow batch — an MCP-layer IDOR, not one of the eleven RCE/eval CVEs.

Update 2026-09-24 — a fourth 9router CVE, found through the advisory database's kiro query: the Kiro API-key endpoint forwards the submitted key as a bearer token to whatever host the region parameter names (CVE-2026-56678)

  • 9router — GHSA-6mwv-4mrm-5p3m, CVE-2026-56678, CVSS 3.1 6.4 Moderate (vendor-published 2026-07-10, database 2026-09-23; affected <= 0.5.2, patched 0.5.6 — the same 0.5.6-vs-0.5.8 registry gap as the 09-22 entry above applies, so run current). POST /api/oauth/kiro/api-key "reads region straight from the request body and passes it, unvalidated, into the upstream URL template; the bearer credential is forwarded to that host" — a region value ending in # redirects the request, Kiro API key attached, to an attacker's server. Authenticated-only, and the credential leaked is the one the caller supplied, so the practical exposure is a multi-user 9router where one dashboard user harvests keys other users register — plus the SSRF into the router's network. It surfaced only because the advisory title contains "Kiro": the Kiro package query returns products that integrate Kiro, not only AWS's own — the same lesson as ?query=codex matching a /codex path (LEARNINGS §29/§30). Four CVEs in one small LLM router since July, each a client-controlled value trusted by the auth or routing layer.

Update 2026-09-25 — the mcp recency listing's biggest single-day wave yet: a database MCP server whose read-only mode and origin check both fail (DBHub, CVSS 9.3/7.4), an SSRF guard that doesn't strip IPv6 brackets (mcp-fetch, 8.7), an autonomous-hacking agent that parses ChatML tokens out of crawled web pages (Decepticon, 10.0), and a fifth ContextForge path traversal — all reviewed into the GitHub Advisory Database 2026-09-24, same two default mistakes plus a new "special tokens in fetched content" class

Seven more MCP-server advisories entered the database on 2026-09-24, all fetched from the GHSA/NVD record this sweep, none from search:

  • DBHub (@bytebase/dbhub) — two bugs, same server. GHSA-fm8p-53ww-hf6w / CVE-2026-61742 (CVSS 4.0 9.3 Critical, vendor date 2026-06-24, database 2026-09-24, affected ≤ 0.22.4, fixed 0.22.5): the HTTP transport "attempts to protect browser-origin access by checking whether the Origin hostname equals the Host hostname, then reflecting the validated Origin into Access-Control-Allow-Origin. This does not stop DNS rebinding" — after rebinding, "a malicious website can deterministically invoke DBHub MCP tools from the victim's browser" against Postgres/MySQL/SQL Server/Oracle/MariaDB/SQLite. And GHSA-mwwr-p57h-56pf / CVE-2026-61788 (CVSS 3.1 7.4 High, fixed 0.22.6): readonly = true on the execute_sql tool "does not make the connection read-only" — the database-level control "is gated on a config value that is never populated, so it never runs," leaving only a first-keyword classifier that any SELECT lo_export(...) (arbitrary file write) or SELECT setval(...) slips past; the HTTP transport "lacks authentication and binds to 0.0.0.0 by default," and privileged roles reach RCE via dblink / COPY … TO PROGRAM. Two DNS-rebinding-plus-no-auth database MCP servers in one file's history now (see AWS's own from 09-14).
  • @kazuph/mcp-fetch — SSRF via unstripped IPv6 brackets. GHSA-mqq2-4r9w-4h99 / CVE-2026-80347 (CVSS 4.0 8.7 High, CNA VulnCheck, NVD 2026-08-26, database 2026-09-24): isSafeUrl reads the hostname for a literal like http://[::1]/ as the bracketed string, net.isIP returns 0 for it, "so the branch holding the private-address checks is skipped entirely," the guard falls back to a DNS lookup that returns nothing, the target is reported safe, "and the HTTP client then strips the brackets and connects" — so "an attacker who can influence what the model requests can read internal responses back into the model context." The IPv6 sibling of the SSRF-guard bypasses already in this file.
  • Decepticon — ChatML special-token injection from crawl output (autonomous hacking agent). GHSA-g5f9-3xfg-p9mf / CVE-2026-61732 (CVSS 3.1 10.0 Critical, database 2026-09-24, fixed 1.1.17): versions < 1.1.17 "wrap web crawl results … into LLM messages without neutralizing ChatML special-token literals," and under the BYOK model most self-hosted providers (vLLM, SGLang, Ollama, LM Studio) "do not filter special-token literals from user content," so a crawled page can forge role boundaries in the agent's own context — the reconnaissance-output-becomes-instructions class, scored 10.0 because the agent then acts on the forged role.
  • IBM ContextForge MCP Gateway — a fifth path traversal. CVE-2026-77825 (CVSS 3.1 4.9 Medium, CNA IBM, database 2026-09-24, affected 1.0.0–1.0.8): the Admin log-download endpoint GET /v1/admin/logs/file "uses str.startswith() rather than proper boundary validation," letting an authenticated admin read .log/.jsonl/.json files in a sibling directory whose absolute path shares the log dir's string prefix — the low-severity tail of the ContextForge batch already tracked here (IBM PSIRT node 7289314).
  • Also in the wave (not detailed): WSP MCP – AI Agents Connector broken access control (CVE-2026-93529, Moderate), and the geelen mcp-remote OAuth-discovery CVE cluster (CVE-2026-51994, CVE-2026-51995, CVE-2026-51996, CVE-2026-51997, CVE-2026-52001) — the latter now has its own file rather than an entry here, since it is a client-side (not server-side) bug in a ~784K-download bridge with a maintainer handover.

Update 2026-09-27 — four more from the mcp recency listing and the NVD keyword query: SiYuan's MCP file tool checks only the root of a recursive operation (8.5, fixed 3.8.4), Penpot's MCP plugin bridge listens on every interface with no auth (5.3, fixed 2.18.0), heym's workflow nodes bypass its own SSRF guard and keep MCP API keys in plaintext (7.6 / 6.9), and Kibana Agent Builder lets whoever can edit a shared agent act as the next higher-privileged user who runs it (7.3)

  • SiYuan — sensitive-path guard bypass in recursive MCP file operations. GHSA-x2gq-fcjj-cxqr / CVE-2026-100633 (CVSS 8.5 High, CNA VulnCheck, published 2026-09-26; affected 3.8.0–3.8.3, fixed 3.8.4). The MCP file tool's util.IsForbiddenAbsPath() check "only validates the root directory of recursive operations, not each descendant path," so an authenticated administrator can use file.grep to pull data out of protected files (configuration, TLS keys), file.copy to relocate restricted files somewhere readable, and unzip to overwrite protected directories with ordinary ZIP member names — and "the confirmation prompts only display root-level arguments," so the approval the user sees names the safe root, not the protected file underneath. Second SiYuan MCP entry in this corpus (the first is the stdio-transport RCE class in 2026-05-mcp-stdio-systemic-rce); the pattern — a guard that validates the argument, not the files the operation will touch — is the recursive cousin of the path-traversal entries above.
  • Penpot — MCP server plugin bridge bound to all interfaces, unauthenticated. CVE-2026-100868 (CVSS 4.0 5.3, CNA VulnCheck, NVD published 2026-09-27; fixed 2.18.0; vendor advisories GHSA-22qr-rp27-j9wm and GHSA-ch2q-6x56-qg5r are referenced but were not opened). "Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networks can connect to the WebSocket port to impersonate the Penpot browser plugin, intercept task payloads, and return forged results to the MCP client." The design tool's MCP bridge is the "localhost is not a boundary" class — the result channel back to the agent is forgeable, so the agent acts on attacker-supplied design data. As of 2026-09-27 github.com/advisories?query=CVE-2026-100868 returns no result: the database mirror lags NVD here, so grep the CVE.
  • heym (workflow automation platform with MCP nodes) — two. GHSA-68x6-m7x2-mcgw / CVE-2026-100858 (CVSS 7.6 High, before 0.0.109): the Slack, Discord and Crawler workflow nodes "issue HTTP requests to URLs taken from user-created credentials (webhook_url / flaresolverr_url) using an unguarded HTTP client, bypassing the SSRF egress guard that already protects the HTTP, WebSocket, and MCP nodes" — non-blind SSRF to loopback, private, link-local and cloud-metadata addresses with full response bodies in node output. CVE-2026-100862 (CVSS 6.9, before 0.0.91, NVD): MCP API keys "stored as a plaintext column, returned in config/list responses, and accepted via the ?key= query string so they leak into logs, proxies and Referer headers," alongside plaintext webhook header-auth values, portal session tokens and workflow execution JWTs. An SSRF guard that covers three node types and not the other three is the n8n/Flowise shape again: the allowlist is only as complete as the newest node.
  • Kibana Agent Builder — confused deputy through a shared agent. GHSA-r4ff-jqf2-8p5g / CVE-2026-72668 (CVSS 3.1 7.3 High, CNA Elastic, published 2026-09-26; the NVD reference is Elastic's ESA-2026-85 security update for Kibana 9.4.7 / 9.5.0, not opened): "A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts with that agent. Where the same user can also author workflows, this can extend to full administrative control of Kibana and of the Elasticsearch cluster." The same shape as SalesBleed's dormant injection in a CRM record: the agent definition is shared, the identity it runs under is whoever opens it next, and the observability stack's admin is the target.

Update 2026-09-30 — Obot's quickstart ships with authentication off and the Docker socket mounted (CVE-2026-101065, 9.3, fix is documentation), its /mcp-connect ACL bypass gets a CVE (CVE-2026-101084, 9.3) and a second bypass through the composite route stayed open from 0.21.1 to 0.24.1; Ollama's experimental agent mode approves a command prefix and runs whatever follows the semicolon (CVE-2026-102697, 8.5); MetaMCP's inspector proxy is unauthenticated code execution (CVE-2026-79538, 9.8, no fix); mcp-chrome-bridge's native server answers any origin (CVE-2026-102878, 8.6); Google's MCP Toolbox for Databases resolves its root allowlist lexically (CVE-2026-102242, 8.6)

VulnCheck assigned CVEs to the Obot findings on 2026-09-27 and added one no vendor page had carried as a CVE: CVE-2026-101065 (CVSS 4.0 9.3, CWE-306) — the Docker quickstart command in Obot's README "starts the container listening on 0.0.0.0:8080 with authentication disabled by default," every request maps to a synthetic "nobody" user holding Owner and Admin, and because the same quickstart mounts the host's Docker socket, "the MCP runtime backend reachable this way has access to the host's Docker control surface." The vendor advisory (GHSA-jj4w-pfgv-4mrm, published 2026-05-08, credit Ryan Vonbrubeck) says the fix is documentation-only: the quickstart now enables authentication, and anyone who followed the old one must set OBOT_SERVER_ENABLE_AUTHENTICATION=true before the host touches an untrusted network. The three June advisories tracked above now carry CVE-2026-101062 (8.7, the OAuth dynamic-client-registration token theft), CVE-2026-101064 (8.3, the remote-MCP-server SSRF) and CVE-2026-101063 (6.9, the unauthenticated /v0.1/* registry read), all fixed 0.23.0, and the May /mcp-connect authorization bypass is CVE-2026-101084 (9.3, CWE-639): any authenticated user who knows a server ID connects to a restricted MCP server and drives its tools "using stored OAuth credentials." The releases page then surfaced what the CVE wave did not — GHSA-6fwv-3h4c-37j9 (High, 8.1, published 2026-09-17, credit arpitjain099): the 0.21.1 fix added "/mcp-connect/" to a UI-fallback deny list, but the composite route "/mcp-connect-composite/{mcp_id}" reaches the same proxy handler without that prefix, so "any User can fully use MCP servers that the administrator believed were restricted to specific groups" on 0.21.1 through 0.24.1; the advisory lists no patched version, and the vendor's 0.26.0 release notes say it is fixed in 0.25.0. Two bypasses of the same check, five months apart — treat every Obot below 0.25.0 as having no MCP access control.

Ollama — CVE-2026-102697 (VulnCheck CNA, CVSS 4.0 8.5, published 2026-09-29, credit Akıner Kısa). Ollama 0.14.0 through 0.31.1's experimental agent mode gates shell commands behind a per-session approval, but the approval "fails to properly parse shell syntax": it matched an approved command prefix, so a model steered by prompt injection could append control operators — a semicolon, a logical operator — and "execute additional shell commands … bypassing the session approval requirement." Fixed in 0.31.2 (commit a2b3a5e; the GitHub releases page renders the tag's date as 2024, which is the display bug LEARNINGS §32 records, so no fix date is stated here). This is the Claude Code subcommand-cap and OpenClaw exec-approval class again: an allowlist that reads the first token of a shell string approves the whole string.

MetaMCP (metatool-ai) — CVE-2026-79538 (MITRE, CVSS 3.1 9.8) and CVE-2026-79537 (both published 2026-09-29, no fix listed, "through 2.4.22"). The MCP-aggregator's internal inspector proxy endpoint GET /mcp-proxy/server/stdio "contains a code execution vulnerability within the createTransport STDIO branch" — network, no privileges, no interaction. The second is an IDOR in session dispatch: the session store is keyed only by the client-supplied mcp-session-id header with "no owner, namespace, or endpoint binding," and an unauthenticated health endpoint "discloses active session IDs and namespace UUIDs," so an attacker lists and runs another tenant's private MCP tools "using the victim's forwarded credentials." Both records reference a TraceForce advisory rather than a vendor page; there is no npm package by that name (the product ships as a Docker image), so no registry fix date exists to quote.

mcp-chrome-bridge — CVE-2026-102878 (VulnCheck, 8.6, 2026-09-29, "through 1.0.31", no fix). The native-server HTTP API behind the mcp-chrome browser-automation extension has an origin-validation error: "attackers can craft malicious web pages that make cross-origin requests to the local server and invoke browser automation tools including script execution, page content reading, and screenshot capture." The npm package's last release is 1.0.31 (2025-12-30); the vendor issue is #384. Same shape as the Cline hub WebSocket hijack and the DBHub DNS-rebinding entries above — a local MCP bridge that trusts the browser is a local MCP bridge any tab can drive.

Google MCP Toolbox for Databases — CVE-2026-102242 (Google CNA, CVSS 4.0 8.6, 2026-09-29). Versions 1.2.0 through 1.9.0 validate the allowedLocalRoots boundary "lexically without resolving symbolic links first," so an authenticated caller with tool-execution permission reads or overwrites files outside the permitted roots through a symlink; the fix is PR #3810 and the database entry lists no patched version at fetch time. Second Toolbox CVE after CVE-2026-19202 (above); same CWE-59 as the Docker Sandboxes escape.

Registry and database notes for this update: NVD keyword queries for the 09-26 → 09-30 window were the source for every id here; the advisory-database recency listings showed the Obot, MetaMCP and mcp-chrome-bridge entries on 09-27/09-29 but truncated their descriptions, and the vendor releases page — not the advisory tab — was where GHSA-6fwv-3h4c-37j9 appeared.

Am I affected?

# Spring AI (Maven/Gradle)
grep -rn 'spring-ai' pom.xml build.gradle* 2>/dev/null

# LangChain community + any MCP servers in a Python env
pip list 2>/dev/null | grep -Ei 'langchain-community|mcp'

# npm-side MCP servers named above
npm ls @contentful/mcp-server @contentful/mcp-tools chrome-devtools-mcp \
       claude-faf-mcp faf-mcp grok-faf-mcp 2>/dev/null

# PyCharm build number — need 2026.2.1 or later
ls ~/Library/Application\ Support/JetBrains/ 2>/dev/null || ls ~/.config/JetBrains/ 2>/dev/null

# 2026-08-30 update: the second MCP bind-all-interfaces batch
npm ls mcp-router @agent-infra/mcp-server-commands @agent-infra/mcp-server-filesystem 2>/dev/null
pip list 2>/dev/null | grep -Ei 'tooluniverse'
npm ls mcp-use 2>/dev/null
npm ls @apify/actors-mcp-server 2>/dev/null
npm ls argocd-mcp 2>/dev/null
# Any of the above reachable beyond loopback (check listening address, not just process presence):
ss -tlnp 2>/dev/null | grep -E ':(3000|4000|8000|8080|3333)\b' || netstat -tlnp 2>/dev/null

# 2026-09-14 update
pip list 2>/dev/null | grep -Ei 'awslabs\.(postgres|mysql|dynamodb)-mcp-server|mcp-contextforge-gateway'
npm ls -g codewhale deepseek-tui 2>/dev/null; cargo install --list 2>/dev/null | grep -i codewhale
# Need: postgres-mcp-server >= 1.1.7, mysql-mcp-server >= 1.0.23, dynamodb-mcp-server >= 2.1.6,
#       mcp-contextforge-gateway >= 1.0.9, codewhale >= 0.8.64

# 2026-09-09 update
pip list 2>/dev/null | grep -Ei 'mcp-atlassian'
# ArcadeDB — check server version, not just an installed client library
# facebook-ads-mcp-server (gomarble-ai)
pip list 2>/dev/null | grep -Ei 'facebook-ads-mcp'

Minimum safe versions established in this batch: Spring AI 2.0.1 · PyCharm 2026.2.1 · Splunk MCP Server app 1.2.1 · Splunk AI Toolkit 6.0.0/6.0.1 · @contentful/mcp-server 1.7.19 / @contentful/mcp-tools 0.4.5 · chrome-devtools-mcp 1.1.0 · claude-faf-mcp 5.7.2 · mcp-router 0.6.3 · actors-mcp-server 0.9.12 · argocd-mcp 0.9.0 · mcp-atlassian 0.22.0 · ArcadeDB 26.7.3 (26.7.2 closes the sibling REST-endpoint leak only) · facebook-ads-mcp-server at or after commit 4e53875. For langchain-community, Headroom, Spring AI's CVE-2026-59279, ToolUniverse, Telnyx MCP server, UI-TARS-desktop's mcp-http-server (fixed at commit c2ad42e, no version number stated), and mcp-use's Inspector proxy, the advisory pages do not state a fixed version — check upstream directly rather than assuming.

If you run Headroom or any Spring AI MCP HTTP transport reachable beyond loopback, treat every upstream LLM provider key it holds as potentially exposed and rotate — the SSRF forwards Authorization headers verbatim. The same applies to argocd-mcp: if ARGOCD_API_TOKEN was configured and the listener was reachable, treat that token as exposed and rotate it.

If you are affected

Prevention

The four repeating mistakes in this batch, stated plainly: (1) a limit shown to the model is not a limit enforced at dispatch (Spring AI); (2) an MCP surface opened on the user's behalf still needs authentication (PyCharm, Spring AI transport); (3) an SSRF guard on the obvious path misses the indirection one hop away (LangChain nested sitemaps, Headroom's base-URL override); (4) a request header is never an identity (Headroom).

Update 2026-09-26 — the WordPress side of MCP gets three CVEs (a Contributor can rewrite site-wide agent workflows; an admin's browser can be made to create admins), and AIR shows Anthropic's own organisation-skill scanner is static-only

  • MCP Server for WordPress plugin < 1.8.2 — CVE-2026-96524, CVE-2026-96525, CVE-2026-96526 (WPScan → GitHub Advisory Database, all published 2026-09-26, no CVSS yet). The plugin exposes a WordPress site to MCP clients — agents that draft, publish and manage content. Per the advisory texts: the workflow REST routes lack capability checks, so "users with the Contributor role [can] modify, delete and create site-wide workflow configuration" (96525); one workflow route has no object-level check, letting a Contributor read titles and statuses of other users' private, draft, pending and scheduled content (96526); and cookie-authenticated REST requests skip nonce verification, so a logged-in administrator lured to a page can be made to perform admin actions, "including creating new admin accounts" (96524). Fix: 1.8.2. Same family as the WSP MCP connector bug above (CVE-2026-93529): the WordPress MCP plugins map "an agent may act on the site" onto WordPress roles that were never meant to gate an agent's workflow configuration.
  • AIR (Air Security), 2026-09-24 — Anthropic's skill scanner, bypassed in seven minutes. The scanner Anthropic released on 2026-08-06 for skills uploaded to an organisation's Claude skills section is, per AIR, a static LLM review with no sandbox and no verification of external resources: a skill whose Python dependency is a look-alike PyPI package passed; a skill directing the agent to a spoofed domain one character off the real one was marked safe; a skill carrying a binary that reads SSH keys was rated "Caution" rather than "Block." AIR's point is time-of-check/time-of-use — a URL, package or repo the scanner only looks at can change after approval — and it is the same finding this file recorded on 09-20 for the third-party claude-skill-antivirus (which read only SKILL.md). Single-source, research not incident, no Anthropic response recorded; noted here rather than filed separately. Treat any skill scanner's verdict as a floor and pin skill dependencies by hash.
  • Obot — CVE-2026-103758 (VulnCheck, 2026-10-01, CVSS 4.0 8.6) is the id for GHSA-6fwv-3h4c-37j9 described in the 09-30 update above (the checkUI deny list omitted /mcp-connect-composite/, so Basic-role users with a composite MCP id proxy through mcpGateway.Proxy to tools that Access Control Rules restrict); affected 0.21.1 through 0.24.1. The vendor advisory still lists no patched version; the 09-30 update's reading that 0.25.0 carries the fix stands on the releases page, not the advisory.
  • mark3labs/mcp-filesystem-server v0.11.1 — CVE-2026-79534 (MITRE, 2026-09-29, 5.9): validatePath falls back to validating only the parent directory when filepath.EvalSymlinks reports a dangling symlink, so write_file, modify_file, copy_file, move_file and create_directory follow a pre-existing dangling symlink inside an allowed directory and create files outside the configured roots. This is the most-used Go filesystem MCP server; the allowed-roots list is its entire security model, and a model-chosen path is the input. The only reference is a TraceForce advisory page; no fixed version is stated.
  • 0xshariq/github-mcp-server — CVE-2026-102906 (VulDB, 2026-09-30, 2.1 Low per the CNA but "the exploit is publicly available"): the "Git Remove" tool's file argument reaches child_process.exec in src/github.ts; rolling release, so no version bound. Reported to the project via an issue first.
  • Zscaler MCP Server 0.7.0 and 0.7.1 — CVE-2026-59563 (2026-09-28, Moderate): HMAC confirmation tokens were not properly validated; vendor fix in later releases per the database entry.

None of the three small servers has a second source; they are logged here as ids to grep, not as confirmed advisories, and the Obot id is a status-neutral CVE assignment for a bug already tracked.

Update 2026-10-04 — the official reference mcp-server-fetch gets a VulDB CVE with the fix "awaiting acceptance" (CVE-2026-104120); SiYuan's agent tools SSRF via DNS rebinding (8.2) and an MCP asset.upload that copies any absolute path into the workspace (vendor 08-13, database 10-02); the Rust SDK's OAuth client fetched server-chosen resource_metadata URLs (rmcp < 2.0.0); a path traversal in Office-PowerPoint-MCP-Server (CVE-2025-71427, 7.6); and Google's A2UI renderer executes javascript: URLs an agent puts on a button (CVE-2026-10032, 9.3)

  • mcp-server-fetch / mcp-server-everything (modelcontextprotocol/servers) — CVE-2026-104120 (CNA VulDB, published 2026-10-02, CVSS 4.0 5.5 / 3.1 7.3, CWE-918). NVD's text: "the function fetch_url of the file mcp_server_fetch/server.py of the component Fetch Tool. The manipulation of the argument url/path leads to server-side request forgery … The exploit has been disclosed publicly and may be used. The pull request to fix this issue awaits acceptance" (issue #4492, PR #4890). Affected "up to 2026.6.4"; no fixed version. The reference fetch server exists to fetch URLs, so the finding is the absence of private-range blocking rather than a surprising feature — but it runs on developer laptops beside the localhost services (next dev's new MCP endpoint, Hub dashboards, Ollama) this corpus keeps logging, and any page the model reads can steer it. The vendor tab has had nothing since February's mcp-server-git traversal.
  • SiYuan (github.com/siyuan-note/siyuan/kernel) — two vendor advisories dated 2026-08-13, reviewed into the database 2026-10-02, both fixed 3.8.1. GHSA-x8gv-g2g3-65fj (High 8.2): the AI Agent tools' CheckHostSSRF guard "performs a single DNS lookup at guard time but the actual connection executes an independent second lookup with no private-IP verification" — serve a public address to the check and a metadata/private address to the connect. GHSA-p23f-cm6q-2qp8 (5.7): the MCP asset.upload tool "accepts a comma-separated list of absolute file paths but performs no workspace boundary check and no sensitive-path check," so an agent steered by prompt injection copies SSH keys or cloud credentials into the workspace assets directory, where notes, export and sync expose them. Affected ≤ 3.8.0. Also on the same day: GHSA-3cc2-h3v6-rqpq / CVE-2026-74802 (Low, cross-site WebSocket hijacking on the network-proxy endpoint), and VulnCheck's index lists CVE-2026-105205 (2026-10-04, "SiYuan before 3.8.5 information disclosure via api/block getDocInfo and getDocsInfo") — id logged from the index only, not opened. Third and fourth SiYuan entries here after the stdio RCE and the 09-27 recursive-file-tool bypass (fixed 3.8.4): the fix target is now 3.8.5.
  • rmcp (official Rust MCP SDK) — GHSA-c9xm-49cp-xcr9 (vendor 2026-06-29, database 2026-10-02, CVSS 4.0 6.3, CWE-918): the OAuth client "accepts URLs from server-controlled WWW-Authenticate headers without validation," so an MCP server can inject resource_metadata= pointing at localhost, RFC 1918 or cloud metadata and the client fetches it from the victim's network. rmcp < 2.0.0 → 2.0.0 (PR #935). This is the Rust SDK's slice of the discovery-SSRF class tracked in the mcp-remote batch and the issuer-validation bugs now confirmed in both the Python and TypeScript SDKs — and, at the platform layer, in Loom for AWS.
  • Office-PowerPoint-MCP-Server — CVE-2025-71427 (CNA VulnCheck, published 2026-10-01/02, CVSS 4.0 7.6, CWE-22): "allows MCP callers to write and read files outside the working directory by supplying absolute paths or ../ sequences" through save_presentation, open_presentation and manage_image output_path; the advisory frames the trigger as prompt injection directing the agent. Affected through 2.0.7; the record references PR #33 and names no fixed version.
  • @a2ui/web_core — CVE-2026-10032 / GHSA-72qq-p3r5-f7wq (vendor 2026-08-03, database 2026-10-02, Critical 9.3, CWE-79). A2UI is the agent-to-UI protocol whose web renderers (React, Lit, Angular) draw interfaces the agent describes; openUrl "passes agent-controlled URLs directly to window.open() without validating the URI scheme," so a javascript: URI supplied through a Button component's functionCall runs in the user's browser. ≥ 0.9.0 < 0.10.2 → 0.10.2 (PR a2ui-project#1707). A new surface for this corpus: when the model's output is the UI, every URL and attribute it emits is untrusted input to the renderer, and a prompt-injected agent becomes a stored-XSS author.

Status and severity of this file are unchanged. Two same-day items got their own files: Loom for AWS (control plane auth bypass, 10.0) and Trigger.dev (July vendor advisories, database 10-02); InternLM MindSearch's VulDB 9.3 went to the Ro1ME wave file as the same class.

Update 2026-10-06 — SiYuan's biggest one: an unauthenticated SQL injection in /api/filetree/searchDocs reachable in publish mode (CVE-2026-69085, 10.0, fixed 3.7.3; vendor 07-20, database 10-01); Dify's MCP-server settings endpoint let any workspace user rewrite another app's MCP server (CVE-2026-105761, 7.1, fixed 1.16.0); Microsoft UFO's mobile MCP server passes type_text and launch_app arguments to adb shell (CVE-2026-105788, 8.8 — the GHSA lists no fix, the CVE record says 3.0.10); Grafana's k6 MCP reads any file the server user can (CVE-2026-89039, 6.5)

  • SiYuan (siyuan-note/siyuan/kernel) — GHSA-33jq-p8c2-q3q4 / CVE-2026-69085, CVSS 3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N; VulnCheck as CNA also gives 9.9 in 4.0). The searchDocs endpoint "concatenates user-supplied search keywords directly into SQL statements without escaping or parameterization"; because the SQLite driver allows statement stacking, "unauthenticated attackers operating through publish mode" can read and modify every cleartext notebook in one request. The guards that protect the explicit SQL endpoints (CheckSingleStatement, CheckReadonlyStatement) are absent from the search path. Encrypted notebooks are not readable; the default build does not give code execution. Fixed in 3.7.3 (vendor advisory 2026-07-20; VulnCheck record 2026-08-03; database 2026-10-01); reporter Shirshakhtml. Fifth SiYuan entry in this corpus, and the oldest — it predates the 3.8.x MCP and agent-tool bugs above, so an instance that followed the earlier fix targets (3.8.4, 3.8.5) is already past it; one that pinned a pre-3.7.3 build because it only runs MCP is not.
  • Dify — GHSA-ccrj-frp2-c945 / CVE-2026-105761, 7.1. PUT /console/api/apps/<app_id>/server looked the AppMCPServer up by the client-supplied id and never checked it belonged to the caller's app, so any authenticated workspace user could "disable another application's MCP server, modify connection parameters, inject malicious configurations" with no audit trail. Affected 1.14.2, fixed 1.16.0; vendor advisory 2026-08-19, CVE record 2026-10-05; reporter JHC56. The second Dify entry after DifyTap.
  • Microsoft UFO (microsoft/UFO, the desktop/mobile automation agent) — GHSA-6ppj-5886-4f26 / CVE-2026-105788, 8.8. The Mobile MCP server's type_text and launch_app tools hand their arguments to adb shell input text and adb shell monkey -p; the first only escapes spaces and ampersands, the second not at all, so an authenticated MCP client (API key) runs arbitrary commands on the connected Android device. A prior patch had fixed the sibling press_key. Version conflict preserved: the vendor GHSA (2026-09-22) lists affected <= be75a7d and patched: none; the CVE record (2026-10-06, GitHub CNA) says "prior to 3.0.10" and references the v3.0.10 release tag and two commits. Treat 3.0.10 as the probable fix and the GHSA as not yet updated; reporter sour-exploit.
  • Grafana mcp-k6 — CVE-2026-89039, 6.5 (Grafana CNA, 2026-10-05; GHSA-ffg3-vfrj-4mjj unreviewed). "A caller who can invoke the convert_playwright_script prompt in mcp-k6 can pass a bare file path as the playwright_script argument and receive the contents of any file readable by the user running the server, including SSH keys and cloud credentials." Recorded from the NVD record and the mcp recency listing; Grafana's advisory page was not opened.

Also on the 10-05/06 mcp listing and left as ids only: four WordPress MCP plugins (IATO MCP CVE-2026-32582, WDS MCP Content Manager CVE-2026-39599, Mindio Magic MCP CVE-2026-104402, Airano MCP Bridge CVE-2026-32585 — Patchstack, moderate), ByteCoreStack MCP Connector CVE-2026-103068, and two vLLM lows. The official TypeScript SDK's bearer-token audience bug of 10-05 is in the MCP SDK file.

Update 2026-10-07 — Obot's catalog entries hand their plaintext secrets to any granted user (CVE-2026-105138, 7.1) plus two smaller authorization gaps (CVE-2026-105139, -105140), all fixed 0.26.2; and Google's MCP Toolbox has a third CVE this corpus had missed — the July SSRF (CVE-2026-14540, 8.0), now written up with the cross-vendor pattern it belongs to

  • Obot — three VulnCheck CNA records published 2026-10-07. CVE-2026-105138 (CVSS 4.0 7.1 / 3.1 6.5): in 0.12.0 before 0.26.2, "basic users granted an entry by access control rules can request GET /api/all-mcps/entries/{entry_id} to obtain plaintext API keys or tokens" that admins set as static secrets on MCP catalog entries — the catalog's credential field was readable by everyone the entry was shared with. CVE-2026-105139 (5.3): 0.26.0 before 0.26.2, vMCP profiles were "enforced only on tools," so a matching user reached prompts, resources and resource templates of ungranted components through the owner's shared connection. CVE-2026-105140 (2.3): 0.25.0 before 0.25.6 / 0.26.0 before 0.26.1, overlapping auth-provider group refreshes committing out of order restored just-revoked IdP group memberships for about ten minutes. Each record references a vendor GHSA (GHSA-q5wf-87f5-cxgq, GHSA-xhpw-65qw-wj6m, GHSA-929v-v9hq-5xhr), a fix commit and the 0.26.2 release; this makes seven Obot ids in this file since September. Same shape as the ToolHive rows: the gateway in front of the MCP servers is where the authorization bugs live.
  • Google MCP Toolbox for Databases — CVE-2026-14540 (Google CNA, 2026-07-31, CVSS 4.0 8.0, 0.3.0–1.4.0, fixed 1.5.0 on 2026-06-18). The generic HTTP source/tool followed redirects with no target-IP policy — SSRF from any URL an agent could influence. It predates both Toolbox CVEs already in this file (CVE-2026-19202 of 09-22 and CVE-2026-102242 of 09-29) and was never logged here; the product's two repositories still publish nothing on their security tabs. It is the Google row of a five-organisation pattern an independent researcher documented on 2026-10-05, so the full write-up is its own advisory: 2026-10-mcp-protocol-pivoting-ssrf-same-flaw-google-toolbox-jpmorgan-dinum-five-vendors. Toolbox users: run ≥ 1.5.0 for this one, and the later fixes for the other two.

Sources

2026-08-30 update sources — all seven CVEs below confirmed directly against the NVD API (services.nvd.nist.gov/rest/json/cves/2.0) rather than paraphrased from an aggregator; each NVD record's own reference list is cited alongside it: - NVD — CVE-2026-81094 / GHSA-rx55-5c7h-r56r — mcp-router CLI, CVSS 9.1/9.3, fixed 0.6.3. - NVD — CVE-2026-81096 / GHSA-pxwq-22vf-87fm — ToolUniverse, CVSS 10.0/9.3, ≤1.2.6 affected, fixed version not confirmed (GHSA page 404'd to direct fetch this sweep). - NVD — CVE-2026-81098 / GHSA-46jp-xr2h-fw7h — Telnyx MCP server, CVSS 9.1/9.3, ≤6.83.0 affected, fixed version not confirmed. - NVD — CVE-2026-81735 and PR #1918 — UI-TARS-desktop mcp-http-server, CVSS 10.0/10.0, fixed at commit c2ad42e (2026-07-01), no released version number stated. - NVD — CVE-2026-81091 / GHSA-f2jg-rm2x-hc5p — mcp-use Inspector proxy, CVSS 8.6/8.7, ≤2.3.2 affected, fixed version not confirmed. - NVD — CVE-2026-81093 / GHSA-m28f-9v8h-gg2f — Apify actors-mcp-server, CVSS 8.6/8.7, fixed 0.9.12. - NVD — CVE-2026-82456 / GHSA-rp45-5x3v-48mr — argocd-mcp, CVSS 10.0/10.0, affects 0.8.0, fixed 0.9.0.

2026-09-09 update sources: - GitHub Advisory Database — GHSA-g5r6-gv6m-f5jv (CVE-2026-73498, mcp-atlassian) — fetched directly: CVSS 7.7, affected < 0.22.0, fixed 0.22.0, confluence_upload_attachment path traversal. - VulnCheck — ArcadeDB information disclosure via get_server_settings (CVE-2026-67357 / GHSA-p9wc-4fhr-78wm) — fetched directly: CVSS 7.7, affected < 26.7.3, fixed 26.7.3. Cross-checked against the distinct sibling VulnCheck — ArcadeDB cluster token disclosure via GET /api/v1/server (CVE-2026-67343 / GHSA-46hj-24h4-j8gf) to confirm the two CVEs are separate endpoints, not a duplicate pairing. - NVD — CVE-2026-19956 — fetched directly via the NVD API: CVSS 3.1 6.3 / 4.0 5.3, CWE-918, fetch_pagination_url SSRF in facebook-ads-mcp-server 0.1.0, fixed via commit 4e53875 / PR #32. No GHSA filed; VulDB-sourced record. - Adversa AI — MCP security September 2026: Deadbugz + 3 server CVEs — surfaced all three CVEs in this update; each confirmed against a primary source rather than this roundup.

2026-09-12 update sources — all fetched directly from the GitHub Advisory Database: - GHSA-w3fx-mc44-mf6j (CVE-2026-45018, chainlit) — CVSS 9.8, /mcp argument-injection RCE, affected ≥2.4.0rc0 ≤2.11.1, fixed 2.12.0, 2026-08-25. - GHSA-xm98-3vcf-fph7 (CVE-2026-53710, mcp-contextforge-gateway) — CVSS 10.0, RestrictedPython bypass to subprocess.Popen, ≤1.0.1 → 1.0.2, 2026-08-24. - GHSA-rqfv-2mw9-78g2 (CVE-2026-59971, mysql-mcp-server) — CVSS 10.0, SSE no-auth/DNS-rebinding, ~25 exposed instances, <0.4.2 → 0.4.2, disclosed 2026-06-21 / reviewed 2026-09-11. - GHSA-6g6r-q6gw-w8fg (CVE-2026-55536, PraisonAI) — CVSS 9.1, re.match() origin-validation bypass (patch bypass of CVE-2026-40289), <4.6.58 → 4.6.58. - GHSA-mw6r-2hvm-4rp2 (CVE-2026-55546, qwed-mcp) and GHSA-8vh3-g2qg-2h2c (CVE-2026-55640, nextcloud-mcp-server) and GHSA-93qj-5q5v-3c2h (pantheon-agents trojanized PyPI) — the lower-relevance items noted above. independently against its own primary source above rather than taken from this aggregator summary.

2026-09-13 update sources: - Pillar Security — Valid but never issued: session spoofing and SSRF in Grafana MCP — fetched 2026-09-13; published 2026-09-02: both flaws, the chain to IMDSv2, the 1.9M-pull figure, and the Intigriti/Grafana timeline (08-02 report, 08-10 v1.1.0, 08-11 CVE, 08-12 Hall of Fame). - Grafana Labs — CVE-2026-19516: Grafana MCP server-side request forgery via X-Grafana-URL header — fetched 2026-09-13; vendor advisory: CVSS 9.1 vector, fixed ≥ 1.1.0, the "incomplete fix for CVE-2026-15583" statement. - NVD — CVE-2026-19516 — fetched via the NVD API 2026-09-13; published 2026-08-11, CWE-918, mcp-grafana ≤ 1.0.0, Grafana advisory as reference. - CSA Lab Space — Identity Confusion by Design: The Grafana MCP SSRF — fetched 2026-09-13; 2026-09-08 research note that surfaced the finding for this sweep; links Pillar as primary.

2026-09-14 update sources — all fetched 2026-09-14: - AWS Security Bulletin 2026-101 — CVE-2026-85787 (awslabs postgres-mcp-server), AWS Security Bulletin 2026-097 — CVE-2026-85654 (awslabs.dynamodb-mcp-server), AWS Security Bulletin 2026-103 — CVE-2026-85788 (awslabs mysql-mcp-server) — vendor bulletins: affected/fixed versions, least-privilege workarounds, reporter credits. - GitHub Advisory Database — GHSA-f4f4-39r8-8gj4 (CVE-2026-85787) and GHSA-hh4r-pcm9-jh93 (CVE-2026-85654) — CVSS 7.1, CWE-184 / CWE-1336. - NVD API records for CVE-2026-85787, CVE-2026-85788, CVE-2026-85654 — CNA AWS, publication dates, description text. - IBM Security Bulletin 7286052 — CVE-2026-18486, 7286055 — CVE-2026-77822, 7286053 — CVE-2026-18905, 7286056 — CVE-2026-18489 — IBM PSIRT bulletins, published 2026-09-02: CVSS vectors, affected/fixed versions, the credential-rotation list, the Translate "local single-session only" statement. - NVD API records for CVE-2026-18486, CVE-2026-18489, CVE-2026-77822, CVE-2026-18905 — CNA psirt@us.ibm.com, published 2026-09-04. - GitHub Advisory Database — GHSA-gx45-xrj5-g6c4 (CVE-2026-75911, CodeWhale allow_shell), GHSA-wrj3-vj8c-784f (CVE-2026-75858, rlm_eval auto-approval), GHSA-6v2g-fpxh-pmmh (CVE-2026-75856, DNS-pinning TOCTOU) — affected/fixed ranges, the deepseek-tui predecessor package, VinSOC Labs credit, 2026-07-16 disclosure vs 2026-09-04 database review. - NVD API records for CVE-2026-75911 and CVE-2026-75856 — CNA VulnCheck, CVSS 4.0 8.5 / 9.2, published 2026-08-18.

2026-09-15 update sources — all fetched 2026-09-15 (Bifrost's JFrog, NVD and release sources are in its own advisory): - VulnCheck — Casdoor through 4.4.0 cross-organization user administration via /api/mcp (CVE-2026-91998) — CNA advisory: CVSS 9.4, through 4.4.0, no fixed version, credit George Chen. - NVD — CVE-2026-91998 — published 2026-09-15, CVSS 3.1 9.9 / 4.0 9.4, CWE-863, references to authz/authz.go, mcpself/user.go, routers/base.go at v4.4.0. - George Chen — Casdoor findings (geo-chen/oss) — researcher write-up: mechanism of all three findings, the 06-13 report / ~06-26 issue / deletion timeline. - GitHub Advisory Database — GHSA-jvmw-g7rg-x26f (CVE-2026-91998) — CVE-sourced copy, published 2026-09-15. - IBM Security Bulletin 7286834 — ContextForge MCP Gateway is affected by use of default credentials (CVE-2026-78573) — published 2026-09-09: v1.0.0 – v1.0.9 → v1.0.10, the three password settings to change. - GitHub Advisory Database — GHSA-87q9-x2gp-qchr (CVE-2026-78573) — CVSS 9.8, CWE-1392; the narrower 1.0.0 – 1.0.7 range noted above. - GitHub Advisory Database — GHSA-65h7-9wrw-629c (CVE-2026-59973, FrontMCP / mcp-from-openapi) — CVSS 8.5, bypass of GHSA-v6ph-xcq9-qxxj / CVE-2026-39885, fixed 1.5.0 / 2.5.0. - GitHub Advisory Database — GHSA-wcjj-9m6g-2fr2 (CVE-2026-59176, functype-mcp-server) — CVSS 7.8, set_functype_version alias / file: install, ≤ 1.4.3 → 1.4.4, fix commit c0d58ad. - GitHub Advisory Database — GHSA-629c-j52g-h978 (CVE-2026-88938, knowns) and NVD — CVE-2026-88938 — CNA VulnCheck, published 2026-09-10, code.find path confinement, through 0.33.0, CWE-22. The vendor advisory id these reference (GHSA-5cj9-fcqq-g2h7) returned 404 on 2026-09-15. - NVD — CVE-2026-64684 (rmcp custom headers leak to cross-origin redirect targets) — CNA GitHub, published 2026-09-16, CVSS 6.8, CWE-200, affected < 2.1.0, fixed 2.1.0; the description quoted in the 2026-09-18 update was taken from the NVD API record, and the advisory appears as GHSA-9g45-5xwm-f3wc in the mcp recency listing below (fetched 2026-09-18). - GitHub Advisory Database — advisories matching mcp, newest first — the recency listing that surfaced Casdoor, Bifrost, knowns, functype and FrontMCP this sweep; each confirmed against its own record above.

2026-09-20 update sources — all fetched 2026-09-20: - GitHub Advisory Database — GHSA-qg2g-g9w3-m5h8 (CVE-2026-58197, ToolHive) — CVSS 8.8 vector, < 0.30.1 → 0.30.1, the host.docker.internal / three-weakness description, PR and release references, vendor date 2026-07-28. - GitHub Advisory Database — GHSA-xwmw-prc4-v3cr (Obot OAuth DCR token theft), GHSA-jgh3-fggc-mcpm (Obot SSRF via remote MCP server URL), GHSA-pr6h-vr44-xq8j (Obot registry API readable without auth) — vendor advisories dated 2026-06-22, all fixed 0.23.0; CVSS 8.8 / 7.6 / 5.3, mechanisms and credits as quoted. - GitHub Advisory Database — GHSA-2qg4-97v5-72x5 (CVE-2026-92801, cc-connect) — CVSS 8.7, through 1.5.0, the Feishu card-callback allowlist bypass, issue #1852; chenhg5/cc-connect — project description, ~15.6K stars, v1.5.1-beta.1 newest tag, no advisory mention. - GitHub Advisory Database — GHSA-x6f2-qp26-2xrh (CVE-2026-94111, Tencent BrowserSkill) — CVSS 6.9, through 0.3.0, the 32-character a-p origin check, issue #273. - GitHub Advisory Database — GHSA-xvpp-2hfw-c93c (CVE-2026-93982, OpenPanel) — CVSS 4.8, CWE-532, commit bad75bdd, VulnCheck reference. - GitHub Advisory Database — GHSA-79wm-x847-7cvg (CVE-2026-73222, claude-code-templates) — CVSS 8.8, ≤ 1.29.2 → 1.29.4, the 0.0.0.0 / cross-origin / shell: true description, reporter and commit; npm time field for claude-code-templates (2026-09-20): 1.29.4 2026-07-14, 1.29.5 09-09, 1.29.6 09-17; weekly downloads 1,930 (2026-09-13 → 09-19, api.npmjs.org). - GitHub Advisory Database — GHSA-gvgj-r6pg-m42w (CVE-2026-84810, claude-skill-antivirus) — CVSS 7.1, CWE-693, the SKILL.md-only scanning description, issue #33, VulnCheck reference. - GitHub Advisory Database — advisories matching claude, newest first and matching agent, newest first — the listings that surfaced claude-code-templates, claude-skill-antivirus, cc-connect and BrowserSkill; none had appeared in any vendor tab or search query. - GitHub Advisory Database — GHSA-8gmq-j984-vp4r (CVE-2026-55638, 9router) — CVSS 8.6, < 0.5.2 → 0.5.2, the rewrite-before-middleware mechanism and protected-prefix list, reporter and fix commit; surfaced by the codex listing. Fetched 2026-09-21. - GitHub Advisory Database — GHSA-5mj8-gf6m-fhw8 (CVE-2026-56681, 9router X-9r-Real-Ip auth bypass) and GHSA-32gc-64m7-hj7v (CVE-2026-56682, 9router lockout bypass) — vendor-published 2026-07-16, database 2026-09-22; CVSS 7.3 / 5.3, affected <= 0.5.4, patched 0.5.8, the isLocalRequest() / getClientIp() mechanisms, default 0.0.0.0 bind, reporter b401t. Fetched 2026-09-22. NVD API — CVE-2026-56681 — published 2026-09-22, "prior to 0.5.6." npm view 9router time (2026-09-22): 0.5.4 → 2026-06-18, 0.5.8 → 2026-06-21, no 0.5.5–0.5.7; api.npmjs.org last-week downloads 42,967. - GitHub Advisory Database — GHSA-jjhp-8crj-mppq (CVE-2026-61647, @roomi-fields/notebooklm-mcp) — vendor-published 2026-06-23, NVD 2026-09-21, database 2026-09-22; CVSS 4.0 7.1, affected >= 1.6.0 < 2.0.3, the vault_dir / slug_prefix traversal, the opt-in NOTEBOOKLM_VAULT_ROOT containment, reporter mcfly-zzh. Fetched 2026-09-22. NVD API — CVE-2026-61647 — published 2026-09-21. npm view (2026-09-22): 2.0.2 and 2.0.3 both published 2026-06-20; api.npmjs.org last-week downloads 582.

2026-09-23 update sources — all fetched 2026-09-23: - stacklok/toolhive — GHSA-hxx3-f8cg-r974 (CVSS 8.8, ≥ 0.0.3 < 0.50.0, ambiguous-JSON authorization bypass), GHSA-hqg7-qjgg-q779 (7.1, < 0.51.0, session-principal binding), GHSA-wm2j-ch74-276r (7.1, < 0.51.1, SSE response broadcast) — mechanisms, affected/patched ranges and reporter (GEONWOOHAN) as quoted; toolhive releases confirm 0.50.0 (2026-09-18), 0.51.0 and 0.51.1 (2026-09-22). - GitHub Advisory Database — GHSA-jp7p-97jq-v89h (CVE-2026-95660, Moonshot AI Kimi Code) and NVD API — CVE-2026-95660 — CNA VulDB, published 2026-09-22, CVSS 3.1 6.3 / 4.0 2.1, CWE-77, config-loader.ts fd/stty PATH planting, fixed 0.31.1; npm @moonshot-ai/kimi-code time field: 0.31.0 2026-07-30, 0.31.1 2026-07-31, current 2.1.0. - GitHub Advisory Database — GHSA-jcjp-gr26-563j (CVE-2026-19202, mcp-toolbox-sdk-python) and NVD API — CVE-2026-19202 — CNA Google, NVD 2026-09-22, database 2026-09-23, CVSS 4.0 9.1, the cross-audience token-cache quote, PR #675 merged 2026-06-05; pip index versions toolbox-core: current 1.4.0 (2026-09-01); the repo's own security tab shows no published advisories. - langflow-ai/langflow — GHSA-4hmc-cfm3-w43c — CVSS 4.0 7.1, published 2026-09-22, no CVE, affected ≥ 1.6.8 ≤ 1.9.0, fixed 1.9.1 (2026-04-24), the handle_read_resource() ownership gap; distinct from the IBM PSIRT batch. - 2026-09-24 update source — GitHub Advisory Database — GHSA-6mwv-4mrm-5p3m (CVE-2026-56678) (fetched 2026-09-24: title, CVSS 6.4 and vector, <= 0.5.2 → 0.5.6, the quoted mechanism, vendor date 2026-07-10, database date 2026-09-23), surfaced via github.com/advisories?query=kiro. - 2026-09-25 update sources — GHSA-fm8p-53ww-hf6w / CVE-2026-61742 and GHSA-mwwr-p57h-56pf / CVE-2026-61788 (DBHub; CVSS 9.3 / 7.4, fixed 0.22.5 / 0.22.6; the origin-check-plus-DNS-rebinding and dead-read-only-code quotes, credits ixNyf / junbyjun1238 / avishaigonen-pluto); GHSA-mqq2-4r9w-4h99 / CVE-2026-80347 and NVD API (mcp-fetch; CVSS 8.7, CNA VulnCheck, the unstripped-IPv6-bracket quote); GHSA-g5f9-3xfg-p9mf / CVE-2026-61732 (Decepticon; CVSS 10.0, fixed 1.1.17, the ChatML-special-token quote); GHSA-6xjp-r2qh-2fj7 / CVE-2026-77825 and NVD API (IBM ContextForge, CVSS 4.9, IBM PSIRT node 7289314); all reviewed into the database 2026-09-24, surfaced via github.com/advisories?query=mcp+sort%3Apublished-desc. Fetched 2026-09-25.