---
id: 2026-10-mcp-server-october-cve-batch-obsidian-tc-cloud-run-mcp-toolbox-aws-mcp-server-mcp-from-openapi
title: "MCP server CVEs, 10-21 to 10-26: obsidian-tc drive-by vault access (9.6, 9.9), Google MCP Toolbox traversal, Cloud Run MCP bucket squatting, AWS MCP Server, mcp-from-openapi"
date_disclosed: 2026-10-21
last_updated: 2026-10-31
severity: critical
status: patched
ecosystems: [npm, mcp, google-cloud, aws, pypi]
tools_affected: ["obsidian-tc (npm) before 1.3.1", "Google Cloud MCP Toolbox for Databases 1.2.0 through 1.4.0 with a cloud-storage source", "Google Cloud Run MCP before 1.11.0", "AWS MCP Server (managed; fixed service-side)", "mcp-from-openapi 2.5.0 before 2.9.0", "@rog0x/mcp-docker-tools 1.0.1, @rog0x/mcp-git-tools 1.0.1, @justice8096/sagemath-mcp-server 1.0.1"]
tags: [cve, ghsa, mcp, mcp-server, dns-rebinding, origin-validation, loopback, multi-tenant, authorization, path-traversal, bucket-squatting, predictable-identifier, sandbox-escape, credential-exposure, redirect, ssrf, db-date-lag, unreviewed]
---

## TL;DR
Eleven MCP-server CVEs reached the GitHub Advisory Database between 2026-10-21 and 10-26. Two are Critical and in one package: **obsidian-tc**, an npm MCP server for Obsidian vaults, whose Streamable HTTP transport did not check `Origin`, so a web page could reach a loopback server running `auth.mode: "none"` and read or write the vault (CVE-2026-77363, 9.6), and whose tool dispatch never checked that a token's vault matched the one requested, so any valid token could read, write or delete any configured vault (CVE-2026-77366, 9.9); both fixed in 1.3.1, vendor-dated 2026-07-03, listed 10-23. **Google Cloud MCP Toolbox for Databases** 1.2.0 through 1.4.0: path traversal and missing authorization in the cloud-storage source let an unauthenticated remote caller copy host files to external buckets and overwrite local files (CVE-2026-93328, 9.3; fix PR #3454 adds `allowedBuckets` and `allowedLocalRoot`). **Google Cloud Run MCP** before 1.11.0: predictable bucket names let an attacker squat the bucket the tool deploys from and intercept source or run code (CVE-2026-85297, 7.7; v1.11.0 "check bucket ownership"). **AWS MCP Server**: the `run_script` validator's disallowed-input list was incomplete, so an authenticated user could run arbitrary code in their own session (CVE-2026-115845, bulletin 2026-149, fixed service-side). **mcp-from-openapi** 2.5.0 before 2.9.0 re-sent credentials on cross-origin redirects (CVE-2026-115750, 6.3) and had an SSRF (CVE-2026-115751). Three one-author servers carry unreviewed High RCE records (CVE-2026-106763 to 106765), and SiYuan fixed an MCP asset-tool traversal in 3.8.7 (CVE-2026-116168). Upgrade what you run; remove what has no fix.

## What happened

**obsidian-tc (The-40-Thieves, reporter suavecito585).** GHSA-pqh8-4pj7-32xx / CVE-2026-77363, CVSS 3.1 9.6: the HTTP transport lacked Origin and DNS-rebinding protection; 1.3.1 enables them and returns 403 on an invalid Origin. GHSA-84c9-qqpq-2pq5 / CVE-2026-77366, 9.9 (`PR:L`, scope changed): tool dispatch did not verify the caller-supplied vault identifier against the vault bound to the caller and the JWT carried no vault claim. The listing also shows CVE-2026-115477 (High, declined human-in-the-loop confirmations could still permit destructive calls) and CVE-2026-77361 (Moderate, symlink read-ACL bypass); this file carries them from the listing only. npm `obsidian-tc` was at 1.33.1 on 2026-10-26.

**Google Cloud MCP Toolbox for Databases.** GHSA-2gc9-c85v-5vwr / CVE-2026-93328, published 2026-10-26, Critical, CVSS 4.0 9.3, CWE-22; the structured fields show no package or range, the description names 1.2.0 through 1.4.0 and the reference is PR #3454 (merged 2026-06-18, in 1.5.0). Earlier Toolbox entries: [MCP protocol pivoting SSRF](2026-10-mcp-protocol-pivoting-ssrf-same-flaw-google-toolbox-jpmorgan-dinum-five-vendors.md).

**Google Cloud Run MCP.** GHSA-cg86-fr78-hv98 / CVE-2026-85297, published 2026-10-26, High, CVSS 4.0 7.7, CWE-340; "Users must upgrade to Cloud Run MCP version 1.11.0 or later." Release v1.11.0 dated 2026-09-28 carries "fix: check bucket ownership" (PR #300).

**AWS MCP Server.** Bulletin 2026-149-AWS (2026-10-23): the Python validator for `run_script` used an incomplete list of disallowed inputs; an authenticated user could run arbitrary code in their own isolated session; addressed service-side, no customer action; credit Manash Saikia.

**mcp-from-openapi.** VulnCheck records CVE-2026-115750 (2026-10-23, 6.3, GHSA-ff5q-5r4v-fw4v): credentials re-sent on cross-origin redirect, 2.5.0 before 2.9.0; CVE-2026-115751, SSRF, same listing.

**Unreviewed one-author servers.** MITRE records of 2026-10-23 for `@rog0x/mcp-docker-tools` 1.0.1 (CVE-2026-106765, 7.5, record inconsistent per the CVE page), `@rog0x/mcp-git-tools` 1.0.1 (CVE-2026-106764) and `@justice8096/sagemath-mcp-server` 1.0.1 (CVE-2026-106763), each described as remote code execution with no fix referenced. **SiYuan** CVE-2026-116168 (listed 10-25, Moderate): path traversal in the MCP asset tool before 3.8.7; SiYuan's stdio exposure is in [the MCP stdio cluster](2026-05-mcp-stdio-systemic-rce.md).

Why it is here: these are servers people add to Claude Code, Cursor and Codex with one config line; three of the records describe a browser tab or any token owner reaching data the server was supposed to isolate, and two describe a cloud deployment tool whose own storage path an attacker can occupy first.

## Am I affected?

- `npm ls obsidian-tc mcp-from-openapi @rog0x/mcp-docker-tools @rog0x/mcp-git-tools @justice8096/sagemath-mcp-server` and the MCP config files (`.claude/settings.json`, `.cursor/mcp.json`, `~/.codex/config.toml`) for the server names and `npx` pins.
- Toolbox: `toolbox --version` on each deployment; any 1.2.x to 1.4.x with a `cloud-storage` source and a reachable port is exposed to unauthenticated callers.
- Cloud Run MCP: version below 1.11.0 means any deploy between install and upgrade used a bucket name an attacker could have claimed; check which bucket each deploy read from.
- AWS MCP Server: nothing to do unless `run_script` ran untrusted scripts from another user.

## If you are affected

1. Upgrade obsidian-tc to 1.3.1 or later and set `auth.mode` to something other than `none`; rotate any vault tokens if more than one vault was configured.
2. Upgrade Toolbox to 1.5.0 or later and set `allowedBuckets` and `allowedLocalRoot`; review bucket access logs for copies you did not make.
3. Upgrade Cloud Run MCP to 1.11.0 or later and redeploy from a fresh bucket.
4. Remove the three unreviewed servers until a fix exists. [If an MCP server was malicious](../playbooks/if-an-mcp-server-was-malicious.md) covers the credential set.

## Prevention

- [MCP hygiene](../prevention/mcp-hygiene.md): loopback plus auth for every HTTP MCP server, Origin validation, one token per vault or tenant.
- [Agent sandboxing](../prevention/agent-sandboxing.md): cloud-deploy tools run with a scoped service account, not the developer's.

## Update 2026-10-27 — the AWS MCP Server researcher's write-up, three more VulDB MCP-server records, and SiYuan's older MCP file-tool record reaching the database

**AWS MCP Server (CVE-2026-115845).** The reporter, xplo1t, published on 2026-10-24 (the post credits collaboration with Claude Opus 4.6): reported to AWS through HackerOne on 2026-07-26, validated 07-30, acknowledged with a fix in progress 09-15, marked resolved 10-23, published 10-24. The post describes the `aws___run_script` sandbox as restricting imports, builtins, attribute access and file operations, and reports command execution as the sandbox Lambda user, exposure of that role's temporary credentials and read access to that user's files, with the researcher stating the credentials were heavily restricted, the sandbox ran in a separate per-session container, and no customer data or other sessions were reached. That matches the bulletin's "within their own isolated session environment" and its CVSS 3.1 6.4. The bulletin names Manash Saikia as the reporter; the post's author handle is xplo1t; this file prints both.

**Three more one-author MCP servers (VulDB, 10-25 and 10-26, all 5.3 on CVSS 4.0 with `UI:P` or `PR:L`).** CVE-2026-116369, `github-kanban-mcp-server` (Sunwood-ai-labs) through 0.4.0: OS command injection through the `state` and `labels` arguments of `handleListIssues`; the record says upgrade to 0.4.1 (patch 253d93bb, PR #27). CVE-2026-116102, `docker-mcp` (QuantGeekDev) 0.1.0 and 0.2.0: OS command injection through `project_name` in `_build_windows_command`; no fix named. CVE-2026-116045, `designer-mcp` (1999AZZAR) through 2.1.0: path traversal through the `Name` argument of `get_reference`; rolling releases, patch c8c2951d. Each is a single CNA record; remove or pin to the named patch.

**SiYuan (CVE-2026-60083).** The database reviewed GHSA-c8r8-95hg-mp34 on 2026-10-27; the VulnCheck record is from 2026-08-22: the MCP file tool's path blocklist omitted files the HTTP API protects, so an authenticated administrator could read the plaintext publish-mode password and other workspace files (CVSS 4.0 6.9, `PR:H`); fixed 3.8.0. It sits beside the 3.8.7 asset-tool traversal already in this file; both are closed by the current release.

## Update 2026-10-28 — AWS API MCP Server 1.3.0 to 1.5.x accepted OAuth tokens issued to other apps in the same tenant (CVE-2026-115413, bulletin 2026-152, 7.8); fixed 1.6.0, and the fix needs an audience configured

AWS bulletin **2026-152** (2026-10-27) and the AMZN CNA record published the same day: **CVE-2026-115413**, AWS API MCP Server (PyPI `awslabs.aws-api-mcp-server`) 1.3.0 before 1.6.0, when run with the streamable-http transport and OAuth, checked a bearer token's signature, issuer and expiry but not its audience, so a token the same identity provider issued to a different application in the tenant (the vendor advisory's example is a second app client in the same Cognito user pool) was accepted, and the holder could run AWS API calls with the host's configured credentials. CNA scores: CVSS 3.1 7.8 (`AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`) and 4.0 7.3; the vendor advisory on the `awslabs/mcp` tab (GHSA-4prq-p2x5-w9fh, High, 7.3, CWE-346, reporter YuvalElbar6, credited as Yuval Elbar) prints the 4.0 figure. The default stdio transport is not affected. The fix, 1.6.0 (PyPI 2026-10-27), requires OAuth operators to set the expected token audience or client ID; the bulletin's remediation line says the same, so an upgrade with no configuration change is not the fix. Workaround until then: switch to stdio. This is a different bug from the `run_script` sandbox record above (CVE-2026-115845, bulletin 2026-149) in a different package, the API server rather than the general server, five days apart.


## Update 2026-10-30 — three June vendor advisories reach the database (pdf-reader-mcp's unenforced API key, two mcp-sanitizer bypasses) and a WordPress MCP plugin's unauthenticated OAuth client registration takes over the site (CVE-2026-110732)

- **`@sylphx/pdf-reader-mcp` 2.2.0 to before 3.0.1 (GHSA-q344-5v34-gm84, High 7.5, `C:H`).** With `MCP_TRANSPORT=http`, the server read `MCP_API_KEY`, logged that authentication was on, and never checked the `X-API-Key` header, so with the default `0.0.0.0` bind anyone who could reach the port called the PDF tools and read any PDF the process could open, with limited SSRF through URL sources. The default stdio transport is not affected. Fixed 3.0.1 (npm 2026-06-25), which enforces the header, binds to `127.0.0.1` by default and warns on a non-loopback bind without a key. Vendor advisory dated 2026-06-25 on `SylphxAI/anymd`; database 2026-10-29. The page prints CVE-2026-62264; CVE Services returned `CVE_RECORD_DNE` for that id on 2026-10-30, so cite the GHSA until the record appears (the shape §38 of the learnings records). The package has 2,535 weekly downloads and 78 versions to 8.5.6 (2026-10-30).
- **`mcp-sanitizer` before 1.4.0 (GHSA-4mfg-r38w-w8fg, 8.2; GHSA-7w82-6f9j-v9jp, 7.5; no CVE).** A library that MCP servers call to vet URLs and paths before `web_fetch`-style and file tools run. Its URL check let `localhost` with an explicit port and bracketed IPv6 loopback or link-local addresses through, and its path check allowed absolute paths under `/home/` and `/Users/`, so a server trusting its verdict fetched internal services and read SSH keys and cloud credentials. Fixed 1.4.0 (npm 2026-06-25); vendor advisories dated 2026-06-25, database 2026-10-28. Credits EQSTLab with knm6777 and yym8538. 843 weekly downloads; a sanitizer that fails open is worse than none for the servers that adopted it.
- **AI Engine for WordPress through 3.8.6 (CVE-2026-110732, Wordfence, 7.5, published 2026-10-30).** The plugin's MCP module registers an OAuth 2.1 Dynamic Client Registration endpoint (`/wp-json/mcp/v1/oauth/register`) without an authorization check; the record's title reads "Missing Authorization to Administrator Account Takeover via Unauthenticated MCP OAuth Client Registration". The WordPress.org plugin API shows 3.8.9 as current (updated 2026-10-30) and about 90,000 active installs; the record names no fixed version and the Wordfence page returned an empty body to this run, so "3.8.7 or later" is not written here. The second `AI Engine` row on the `mcp` listing, CVE-2026-107745 (Moderate, 10-28), was not opened. A WordPress site with an MCP endpoint for its chatbot is a vibe-coded stack more often than not; the same DCR endpoint shape was n8n's open redirect two days ago.

Sources for this update: [GitHub Advisory Database — GHSA-q344-5v34-gm84](https://github.com/advisories/GHSA-q344-5v34-gm84) — fetched 2026-10-30: 7.5 and vector, `>= 2.2.0, < 3.0.1`, 3.0.1, the mechanism, the June 25 vendor date and October 29 database date, the printed CVE id, credit novice-22; [CVE Services — CVE-2026-62264](https://cveawg.mitre.org/api/cve/CVE-2026-62264) — queried 2026-10-30: `CVE_RECORD_DNE`; [GHSA-4mfg-r38w-w8fg](https://github.com/advisories/GHSA-4mfg-r38w-w8fg) and [GHSA-7w82-6f9j-v9jp](https://github.com/advisories/GHSA-7w82-6f9j-v9jp) — fetched 2026-10-30: 8.2 and 7.5, `< 1.4.0`, the bypasses, commit 2006858, the dates and credits; npm registry `@sylphx/pdf-reader-mcp` and `mcp-sanitizer` `time` and `api.npmjs.org` weekly downloads, queried 2026-10-30; [CVE Services — CVE-2026-110732](https://cveawg.mitre.org/api/cve/CVE-2026-110732) — fetched 2026-10-30: CNA Wordfence, published 2026-10-30, `0 to 3.8.6`, 7.5, the title and description, the Wordfence and plugins.trac references; WordPress.org plugin information API for `ai-engine`, queried 2026-10-30: version 3.8.9, 90,000 active installs; [GitHub Advisory Database — `mcp` listing](https://github.com/advisories?query=mcp+sort%3Apublished-desc) — fetched 2026-10-30: the four rows.

## Update 2026-10-31 — CVE-2026-62264 now resolves at CVE Services (published 2026-10-30 18:32 UTC, after the previous run's query); the AI Engine record reaches the database with the 3.8.7 diff as a reference

- **`@sylphx/pdf-reader-mcp`.** GitHub, as CNA, published CVE-2026-62264 at 18:32 UTC on 2026-10-30; the previous run's query, whose read time was not recorded, returned `CVE_RECORD_DNE` earlier that day. The record: SylphxAI `pdf-reader-mcp` `>= 2.2.0, < 3.0.1`, CVSS 3.1 7.5 `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`, the same description as the GHSA, references PR #332, commit 4c35f72 and tag v3.0.1. The id can now be used in CVE-keyed statements; the range and fix are unchanged (3.0.1, npm 2026-06-25; `latest` 8.5.7 on 2026-10-31).
- **AI Engine for WordPress (CVE-2026-110732).** The database row GHSA-22w7-p44p-2gq7 (unreviewed, High 7.5, 2026-10-30) prints the mechanism the CNA title summarised: the MCP OAuth 2.1 Dynamic Client Registration route `/wp-json/mcp/v1/oauth/register` is registered with `__return_true` as its permission callback, so an unauthenticated caller registers an active OAuth client with a redirect URI it controls; if an administrator approves that client on the consent screen, the attacker holds an administrator-bound MCP token, and the consent page lacks `X-Frame-Options` and `frame-ancestors`, so the approval can be obtained by clickjacking (hence `AC:H/UI:R`). The row's references include the `plugins.trac` diff between tags 3.8.6 and 3.8.7 of `labs/mcp-oauth.php`, which is where the fix would sit; no source read this run states "fixed in 3.8.7" in words, and the Wordfence page is still unread, so this file says the record references the 3.8.7 change and that the plugin API served 3.8.9 (updated 2026-10-31, about 90,000 active installs). Anyone on 3.8.6 or earlier should update regardless.

Sources for this update: [CVE Services — CVE-2026-62264](https://cveawg.mitre.org/api/cve/CVE-2026-62264) — fetched 2026-10-31: published 2026-10-30 18:32 UTC, CNA GitHub_M, the range, 7.5 and vector, references; npm registry `@sylphx/pdf-reader-mcp` `time`, queried 2026-10-31: 3.0.1 at 2026-06-25, `latest` 8.5.7; [GitHub Advisory Database — GHSA-22w7-p44p-2gq7](https://github.com/advisories/GHSA-22w7-p44p-2gq7) — fetched 2026-10-31: unreviewed, 7.5 `AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H`, CWE-862, "all versions up to, and including, 3.8.6", the `__return_true` and clickjacking description, the trac references including the 3.8.6 to 3.8.7 diff; WordPress.org plugin information API for `ai-engine`, queried 2026-10-31: 3.8.9, last updated 2026-10-31, 90,000 active installs.

## Sources
- [GitHub Advisory Database — GHSA-pqh8-4pj7-32xx](https://github.com/advisories/GHSA-pqh8-4pj7-32xx) — fetched 2026-10-26: CVE-2026-77363, 9.6, `< 1.3.1`, vendor date 2026-07-03, listed 10-23.
- [GitHub Advisory Database — GHSA-84c9-qqpq-2pq5](https://github.com/advisories/GHSA-84c9-qqpq-2pq5) — fetched 2026-10-26: CVE-2026-77366, 9.9 and vector, the vault-claim description.
- [GitHub Advisory Database — GHSA-2gc9-c85v-5vwr](https://github.com/advisories/GHSA-2gc9-c85v-5vwr) — fetched 2026-10-26: CVE-2026-93328, 9.3, CWE-22, the 1.2.0 to 1.4.0 range in the description, PR #3454.
- [GitHub Advisory Database — GHSA-cg86-fr78-hv98](https://github.com/advisories/GHSA-cg86-fr78-hv98) — fetched 2026-10-26: CVE-2026-85297, 7.7 and vector, CWE-340, the upgrade line, the v1.11.0 reference.
- [googleapis/mcp-toolbox — PR #3454, restrict bucket and local path access](https://github.com/googleapis/mcp-toolbox/pull/3454) — fetched 2026-10-26: merged 2026-06-18, shipped in release 1.5.0, the `allowedBuckets` and `allowedLocalRoot` options.
- [GoogleCloudPlatform/cloud-run-mcp — release v1.11.0](https://github.com/GoogleCloudPlatform/cloud-run-mcp/releases/tag/v1.11.0) — fetched 2026-10-26: dated 2026-09-28, "fix: check bucket ownership" (PR #300).
- npm registry (`npm view obsidian-tc version`, `npm view obsidian-tc time`) — run 2026-10-26: latest 1.33.1; 1.3.1 published 2026-07-03.
- [AWS security bulletin 2026-149](https://aws.amazon.com/security/security-bulletins/2026-149-aws/) — fetched 2026-10-26: CVE-2026-115845, the validator description, service-side fix, credit.
- [GitHub Advisory Database — `mcp` listing](https://github.com/advisories?query=mcp) — fetched 2026-10-26: the obsidian-tc, mcp-from-openapi, rog0x/justice8096, AWS and SiYuan rows with dates and severities.
- [CVE Services — CVE-2026-115750](https://cveawg.mitre.org/api/cve/CVE-2026-115750) and [CVE-2026-106765](https://cveawg.mitre.org/api/cve/CVE-2026-106765) — fetched 2026-10-26: VulnCheck and MITRE records, ranges and scores.
- Related in this corpus: [MCP TypeScript SDK October batch](2026-10-mcp-typescript-sdk-october-batch-cross-client-message-delivery-task-session-audience-redirects.md), [MCP protocol pivoting SSRF](2026-10-mcp-protocol-pivoting-ssrf-same-flaw-google-toolbox-jpmorgan-dinum-five-vendors.md).
- **2026-10-27 update sources** — [xplo1t — Breaking the AWS MCP Python Sandbox](https://xplo1t-sec.github.io/posts/breaking-the-aws-mcp-python-sandbox/) (fetched 2026-10-27: dated 2026-10-24, the HackerOne timeline, the reported impact and the researcher's own limits on it); [CVE Services — CVE-2026-115845](https://cveawg.mitre.org/api/cve/CVE-2026-115845) (queried 2026-10-27: CNA AMZN, published 2026-10-23, CVSS 3.1 6.4 and 4.0 5.3, bulletin reference); [CVE Services — CVE-2026-116369](https://cveawg.mitre.org/api/cve/CVE-2026-116369), [CVE-2026-116102](https://cveawg.mitre.org/api/cve/CVE-2026-116102), [CVE-2026-116045](https://cveawg.mitre.org/api/cve/CVE-2026-116045) (queried 2026-10-27: CNA VulDB, the products, versions, arguments, patches and scores above); [CVE Services — CVE-2026-60083](https://cveawg.mitre.org/api/cve/CVE-2026-60083) (queried 2026-10-27: CNA VulnCheck, published 2026-08-22, SiYuan before 3.8.0, CVSS 4.0 6.9, GHSA-c8r8-95hg-mp34); [GitHub Advisory Database — mcp listing, sorted by publication](https://github.com/advisories?query=mcp+sort%3Apublished-desc) (fetched 2026-10-27: the SiYuan row reviewed 10-27 and the three VulDB rows).
- **2026-10-28 update sources** — [AWS security bulletin 2026-152](https://aws.amazon.com/security/security-bulletins/2026-152-aws/) (fetched 2026-10-28: 2026-10-27, CVE-2026-115413, package and range, 1.6.0, the audience-claim description, the GHSA reference); [awslabs/mcp — GHSA-4prq-p2x5-w9fh](https://github.com/awslabs/mcp/security/advisories/GHSA-4prq-p2x5-w9fh) (fetched 2026-10-28: High 7.3 with vector, CWE-346, the Cognito example, stdio not affected, the audience configuration requirement, credit); [CVE Services — CVE-2026-115413](https://cveawg.mitre.org/api/cve/CVE-2026-115413) (queried 2026-10-28: CNA AMZN, published 2026-10-27, 3.1 7.8 and 4.0 7.3, the remediation sentence); PyPI `awslabs.aws-api-mcp-server` (queried 2026-10-28: 1.6.0 uploaded 2026-10-27); [AWS security bulletins index](https://aws.amazon.com/security/security-bulletins/) (fetched 2026-10-28: 2026-144 through 2026-152).