One researcher, 22 VulnCheck CVEs across agent sandboxes, MCP servers and LLM gateways; mini-swe-agent leaks host API keys into its sandbox; no fixes recorded

View raw markdownEdit on GitHub ↗

TL;DR

Between 2026-10-10 and 2026-10-11 VulnCheck, acting as CNA, published 22 CVE records credited to one researcher (HaiND, Post and Telecommunication Institute of Technology) against agent frameworks, MCP servers and clients, LLM gateways and agent platforms. The ones that matter for this corpus's audience: mini-swe-agent's optional Bubblewrap sandbox starts with the host's full environment, so a prompt-injected task can read API keys and send them out over the sandbox's shared network (CVE-2026-108592); 9router's dashboard writes an unvalidated base URL into Hermes Agent's config.yaml, so a dashboard user can add a shell hook the agent later runs (CVE-2026-108593); mcp-remote's --device-code grant sends client secrets and receives tokens over plain HTTP when discovery returns a plain-HTTP endpoint (CVE-2026-108716); and the MCP Kotlin SDK's WebSocket server installs no frame-size limit (CVE-2026-108714). Every record's references are the researcher's HackMD write-up plus exact source lines; no record names a fixed version, the write-ups say coordinated disclosure is in progress, and the vendor advisory tabs for mini-swe-agent and SWE-agent are empty. Registry checks show the last affected version is the current release for mini-swe-agent, 9router, 1MCP, open-multi-agent, argocd-mcp and mcp-remote.

Update 2026-10-12: the wave continued through 10-11 and 10-12 with sixteen more VulnCheck records, now from two reporters. The ones that matter: the Unla MCP gateway's OAuth server issues tokens to anyone (CVE-2026-108865, 8.8, unauthenticated reach into every proxied upstream and injected credential), Katanemo Plano exposes its Envoy admin port on all interfaces with the configured LLM provider keys readable in plaintext (CVE-2026-108863, 8.7), mcp-go, the main Go MCP SDK, takes an unbounded POST body (CVE-2026-108859, 8.7) and separately fixed an OAuth resource-binding bug in 1.2.1 on 2026-10-09 (vendor advisory), hyper-mcp verifies plugin signatures against the wrong manifest and accepts any Sigstore signer (CVE-2026-108698, CVE-2026-108699, 8.3 each), pinclaw, an OpenClaw channel plugin, accepts unauthenticated prompt injection into the owner's agent session on a port bound to all interfaces (CVE-2026-108757, 7.1), and mac-shell-mcp lets a prompt run forbidden commands past its allowlist (CVE-2026-108953, 8.5) with a fix commit that no npm release carries. Details in the dated section below.

What happened

The GitHub Advisory Database's mcp and agent recency listings showed a block of same-day unreviewed rows on 2026-10-10, and the VulnCheck advisory index showed a second block on 2026-10-11. Pulling each CVE record from CVE Services gave the same shape every time: CNA VulnCheck, one hackmd.io/@haind or @haind03 reference, two or three permalinks to the vulnerable lines, and a VulnCheck advisory page. The researcher's write-ups (the two that rendered this run, for mini-swe-agent and 9router) each say "coordinated disclosure in progress," record no maintainer response and no fix commit, and were written before the CVE was assigned.

The scores below are VulnCheck's CVSS 4.0 base scores as printed in the CNA records on the fetch date (2026-10-11); the records also carry CVSS 3.1 values. Fix status is what the record and the registry show, not an inference.

Agent sandboxes and file-write boundaries

Product CVE CVSS 4.0 Affected What a prompt-injected task gets Fix on record
mini-swe-agent, BubblewrapEnvironment CVE-2026-108592 6.0 1.10.0 through 2.4.6 bwrap is started without --clearenv, so commands in the sandbox inherit the host environment, including API keys loaded from .env; with network shared, a task can read and send them. The default LocalEnvironment backend has no isolation at all, so this only weakens the one backend that was supposed to. None. PyPI latest is 2.4.6 (checked 2026-10-11); no security advisory on the mini-swe-agent or SWE-agent tab; no issue matching "bubblewrap clearenv" in the repository. Issue #843 (2026-05-27) had listed a related P0, host environment variables reaching prompt templates in the local backend, and was closed on 2026-06-03 with a request to file separate issues.
Phi (pulseaiclub) CVE-2026-108595 6.0 0.3.0 through 0.28.4 agent_spawn takes an unchecked workdir, so a spawned sub-agent escapes workspace_only_writes and read-only mode and writes anywhere the user can. None recorded.
open-multi-agent (@open-multi-agent/core) CVE-2026-108600 5.7 1.5.0 through 1.21.2 The file_write sandbox follows dangling symlinks, so a planted link plus a steered write lands outside the workspace root. None. npm latest 1.21.2 (published 2026-10-09).
Open Computer Use (iFurySt, macOS) CVE-2026-108721 5.8 through 1.0.0 The password-manager denylist compares bundle identifiers case-sensitively, so a case-variant id reaches get_app_state and action tools against a denied app. None recorded.
open-computer-use (e2b-dev) CVE-2026-108722 2.3 through commit 610bac8 Transcript text is written into log.html unescaped, so content the sandbox saw runs as script when the operator opens the log. None recorded.

MCP servers, clients and SDKs

Product CVE CVSS 4.0 Affected What it lets an attacker do Fix on record
mcp-remote (--device-code) CVE-2026-108716 6.0 0.8.0 through 0.14.3 authorizeWithDeviceCode sends the client secret and receives access and refresh tokens without requiring HTTPS; if discovery returns a non-loopback plain-HTTP device-authorization or token endpoint, an on-path attacker reads all three. Eighth finding against this bridge; see the mcp-remote file. None. npm latest 0.14.3 (2026-09-21).
MCP Kotlin SDK CVE-2026-108714 8.7 through 0.15.0 Application.mcpWebSocket installs Ktor WebSockets without maxFrameSize, so a few frames declaring near-2 GiB payloads exhaust server memory. DoS only. The Kotlin tab's three earlier advisories (June and September 2026) are all memory-exhaustion bugs in other transports. None recorded; no tab entry for this one on 2026-10-11.
argocd-mcp (argoproj-labs) CVE-2026-108585 5.3 through 0.9.0 delete_application does not validate applicationName, so a dot-segment value turns the authenticated DELETE into a request against repositories, clusters or projects within the token's rights. Third finding against this server after the bind-all-interfaces CVE-2026-82456 in the MCP batch. None. npm latest 0.9.0 (2026-08-11).
1MCP Agent (@1mcp/agent) CVE-2026-108586 5.3 0.20.0 through 0.39.0 OAuth tag-scope enforcement accepts negated filter expressions, so a token for one tag lists and calls tools on every backend MCP server outside its scope. None. npm latest 0.39.0 (2026-10-09).
zotero-mcp (54yyyu) CVE-2026-108583 2.3 0.10.0 through 0.14.1 zotero_add_by_url fetches any URL, including loopback, private and link-local hosts, and returns citation metadata from the response. None recorded. The PyPI package named zotero-mcp is at 0.3.1 and does not match this range; the affected project is the GitHub repository 54yyyu/zotero-mcp and its release tags.
GenOffice (genspark-ai) CVE-2026-108582 6.8 through 0.11.505 The HTTP MCP server's file store under the system temp directory is world-readable, so any local user reads client uploads and converted documents past the bearer token. The record references the v0.11.505 release page; whether that release changes the permissions is not stated. Not on npm under genoffice or @genspark-ai/genoffice.
Tabularis CVE-2026-108604 5.8 through 0.27.0 The MCP run_query read-only gate classifies by leading keyword, so a side-effecting SELECT (sequence functions, query_to_xml with an embedded write) modifies data without the approval prompt. None recorded. Desktop app, not a PyPI package.
Rill (admin OAuth server for MCP) CVE-2026-108718 8.6 0.77.0 through 0.90.5 Dynamically registered OAuth clients get authorization codes without user consent; a client registered with the long-lived-token scope plus one clicked link yields a non-expiring API token with the victim's rights. Same dynamic-client-registration class as Bifrost. None recorded.

LLM gateways, routers and agent platforms

Product CVE CVSS 4.0 Affected What it lets an attacker do Fix on record
9router → Hermes Agent CVE-2026-108593 7.3 0.4.1 through 0.5.99 POST /api/cli-tools/hermes-settings writes the submitted base URL into ~/.hermes/config.yaml through string templates with no YAML encoding, so a dashboard user adds keys such as hooks_auto_accept and a post_llm_call shell command, which Hermes runs on its next LLM event. Needs a dashboard session under the default requireLogin: true; exposed to anyone who can reach the dashboard when that is off. Fifth 9router CVE in the corpus. None. npm latest 0.5.99 (modified 2026-10-08).
LLMGateway (theopenco) CVE-2026-108719 5.3 through 1.20.0 The video-generation callback_url is delivered without the webhook target check, so an API-key holder points it at loopback, private or cloud-metadata hosts. None recorded.
TencentCloud Octop CVE-2026-108581 7.1 through 1.0.2b6 GET /api/providers and /api/voice/providers validate only the JWT, so any low-privileged user reads the stored LLM and voice provider API keys in plaintext. The record references pull requests #1265 and #1507; no fixed version stated.
Kortix Suna CVE-2026-108115 2.3 0.10.7 before 0.13.52 The isPrivateIp guard misses IPv6 6to4 and Teredo forms that embed a private IPv4 address, so a connector URL reaches internal services and metadata endpoints. The CNA range ends at 0.13.52. The v0.13.52 release page (dated "07 Oct", year not shown) lists a "Security hardening" line about tenant isolation and sandbox proxy access checks and does not name SSRF.
OpenLIT CVE-2026-108596 6.0 2.1.0 A forged x-openlit-project-id header lets an authenticated user read another project's traces, including prompts and completions. None recorded. The PyPI SDK openlit is at 1.45.0 and is a different artifact from the 2.1.0 platform.
Plastic Labs Honcho CVE-2026-108711 5.3 through 3.3.0 A peer- or session-scoped key reads workspace metadata and configuration through POST /v3/workspaces because only the workspace claim is checked. None recorded.
Cheshire Cat AI core CVE-2026-108725 5.1 through 2.0.23 The uploads plugin accepts HTML without a type check and serves it from the application origin, so one link runs script as the signed-in victim. None recorded.

Two more records in the same batch are out of this corpus's audience and are listed for completeness: Flyte 2.0.1 through 2.0.51 writes file-mounted secrets base64-encoded into an init-container environment variable readable by anyone with Pod read access (CVE-2026-108728, 7.1), and NornicDB through 1.4.1 serves vector-search results past per-database read restrictions (CVE-2026-108710, 7.1). VulnCheck's index for 2026-10-11 also lists ten advisories against CRM, IPAM, CMS and ITSM products (SuiteCRM, LibreNMS, iTop, phpIPAM, Sylius, GLPI, EdgeEver, Corteza, answer-me-with-html) whose records this sweep did not open.

Why one researcher's wave is one advisory

The shape repeats a pattern this corpus has recorded before (the MITRE agent-framework wave, the ZITADEL batch): a research CNA assigns ids for one reporter's findings in bulk, the database lists them as unreviewed rows with no package metadata, and the vendor channels say nothing. VulnCheck's assignment validates the affected range and the mechanism, which is why these are written as confirmed rather than unconfirmed, but nothing in any record establishes a maintainer response. The common thread across the agent entries is the one this corpus keeps meeting: a check meant to contain the model (a sandbox's environment, a workspace root, a read-only query gate, a denylist, a scope filter, a YAML writer) is bypassed by input the model itself supplies, so a prompt injection in a task, a page or a file becomes a credential read or a write outside the box. The gateway entries are the other recurring shape: the service that holds every provider key exposes those keys to any authenticated user or writes an agent's config for it.

Update 2026-10-12: sixteen more records, a second reporter, and one fix that exists only as a commit

The mcp and agent listings on 2026-10-12 showed a further block of same-day unreviewed rows dated 10-11 and 10-12, and the VulnCheck index added one more on 10-12. Pulling the records gave the same shape as before, with one change: the HackMD references now come from three profiles. @haind and @haind03 are the 10-10 and 10-11 researcher; the records dated 10-11 for Unla, Plano, mcp-go, hyper-mcp, Odoo MCP, phpMyFAQ, Company Research Agent and Astron Agent reference hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q, whose Unla write-up names the reporter as hieuPenguinnn and says "coordinated disclosure pending, no CVE assigned yet" on a page whose heading already prints the CVE. The mac-shell-mcp record (10-12) is a third reporter (Bandana, HackWitHer, APIsec Research Labs) and has a different history, below. Scores are VulnCheck's CVSS 4.0 base scores as printed in the CNA records on 2026-10-12, with the 3.1 value in brackets.

MCP gateways, SDKs and servers

Product CVE CVSS 4.0 (3.1) Affected What it lets an attacker do Fix on record
AmoyLab Unla (MCP gateway) CVE-2026-108865 8.8 (8.2) through 0.10.0 The built-in OAuth2 server never authenticates a resource owner: an unauthenticated caller registers a client, requests a code from /authorize and exchanges it at /token for a bearer token the MCP gate accepts, reaching OAuth-protected MCP prefixes, the proxied upstream APIs and the credentials the gateway injects into them. Same dynamic-client-registration class as Rill above and Bifrost. None. The write-up reviewed v0.10.0 and main as of 2026-10-11 and records no maintainer response; the repository has no SECURITY.md.
mcp-go (mark3labs) CVE-2026-108859 8.7 (7.5) through 1.2.1 StreamableHTTPServer.ServeHTTP reads the whole POST body with io.ReadAll before any validation, so oversized or many concurrent bodies exhaust memory. DoS only. None recorded for the DoS. The vendor tab carries one advisory, GHSA-xf6j-693p-wqxx (2026-10-09, High, no CVE): the OAuth client accepted the resource declared in well-known Protected Resource Metadata without checking it against the server addressed, so a malicious MCP server could obtain a token scoped to another resource; affected 0.48.0 through 1.2.0, fixed 1.2.1 (PR #1053), reporter Theodoros Lampropoulos. That is the Go twin of the Python SDK's issuer-validation bug.
hyper-mcp (WebAssembly plugin MCP server) CVE-2026-108698, CVE-2026-108699 8.3 (6.5) each through 0.8.3 load_wasm verifies the Cosign signature of a separately resolved tag rather than the manifest it loads, so a registry answering differently to the loader and to Cosign serves an unsigned plugin (CWE-367); and cosign_verify_args() accepts any signer identity and OIDC issuer by default, so a free Sigstore keyless certificate on an attacker's image passes (CWE-347). Plugins run with the configured host, filesystem and environment access. None recorded. The vendor tab is empty.
MCP Kotlin SDK CVE-2026-108714 8.7 through 0.15.0 Already in the table above; listed here because the vendor tab's three earlier advisories (GHSA-74gp-qhv5-v493, GHSA-f47c-p7wj-q7gx, GHSA-4x39-xh35-w96w) are all memory-exhaustion findings and none covers the WebSocket frame size. None.
Odoo MCP (erpipe) CVE-2026-108861 5.3 (4.3) 1.0.0 through 1.3.2 execute_method reaches read and search_read with denied field names, bypassing the field-level ACL the other tools enforce. None recorded.
phpMyFAQ MCP server CVE-2026-108851 4.8 (3.3) through 4.1.10 faq_search never applies user or group permission checks, so a connected client reads restricted entries. None recorded.
mac-shell-mcp CVE-2026-108953 8.5 (7.8) "before 2.0.0" per the record execute_command matched the command name against the allowlist but passed arguments to a shell, so an allowed pwd with a metacharacter argument runs any command as the server user without approval. A prompt injection is enough. Conflict. The record's range implies 2.0.0 fixes it and references commit 932ce73 ("rebuild on confinement, allowlists and no shell (2.0.0)"), which removes seven policy-mutating tools, drops shell interpretation and builds the child environment from scratch. The repository has no releases page entries, and npm view mac-shell-mcp shows a single published version, 1.0.4 (2025-04-12). As of 2026-10-12 no npm release carries the fix. The reporter had filed a private advisory (GHSA-2h3j-235x-vx2q) on 2026-01-28, followed up in June and October with no reply (issue #45, 2026-10-04), and said a third-party CNA would be used after 2026-10-10, which is what happened.

Agent frameworks, plugins and gateways

Product CVE CVSS 4.0 (3.1) Affected What it lets an attacker do Fix on record
Katanemo Plano (LLM gateway) CVE-2026-108863 8.7 (7.5) through 0.4.37 The generated Envoy config binds the admin interface to all interfaces on port 9901 with no authentication; /config_dump returns the WASM filter configuration with every configured LLM provider API key in plaintext. None recorded. PyPI planoai latest is 0.4.37, the last affected version.
pinclaw (OpenClaw channel plugin, Nexting) CVE-2026-108757 7.1 (6.5) through 0.3.0 POST /pinclaw/send skips the authToken check; port 18790 binds all interfaces by default; the body is delivered to the user's main OpenClaw agent session as user instructions. Blind prompt injection from anyone on the network. None recorded. npm latest 0.3.0 (2026-05-20). Not on the OpenClaw vendor tabs; a companion-plugin finding of the kind the Windows node batch showed those tabs never carry.
mistral.rs (mistralrs-code-exec) CVE-2026-108759 7.6 (6.8) 0.9.0 through 0.9.4 Sandboxed shell code names a symlink as an output or reuses a session with a symlinked input path and reads or overwrites files outside the sandbox with the server's permissions. None recorded. PyPI mistralrs latest is 0.9.4.
MoAI-ADK (moai init) CVE-2026-108751 4.8 (4.4) through 3.1.2 The template deployer stages through <target>.moai-tmp; a repository committing a symlink named .claude/settings.json.moai-tmp makes atomicWriteFile truncate and overwrite whatever the link points at. A write into the agent's own config file, from a cloned repository, is the tensorlake persistence shape by a different route. None recorded.
Abilityai Trinity CVE-2026-108756 5.3 (5.4) through 0.9.5 Agent-scoped MCP API keys can perform the human-only Telegram binding operations: send through the owner's bot token, replace the binding, delete it. None recorded.
Shepherd (citation-checker extra) CVE-2026-108741 2.3 (3.1) through 0.3.1 The public_url guard resolves once and fetch re-resolves at connect time, so a planted reference URL with attacker DNS rebinds to internal addresses. None recorded.
Company Research Agent CVE-2026-108850 6.9 (5.3) through 2.2.0 Unescaped ReportLab markup in /generate-pdf lets an unauthenticated caller make the server fetch arbitrary hosts and return the responses inside the PDF. None recorded.
iFlytek Astron Agent CVE-2026-108864 2.3 (4.2) through 1.1.2 POST /workflow/v1/resume accepts another application's predictable Snowflake event_id, injecting into and reading the other tenant's paused workflow. None recorded.

Also on the listings and not opened: UnicomAI Wanwu (CVE-2026-108853, CVE-2026-108854, CVE-2026-108855, CVE-2026-108856), JeecgBoot (CVE-2026-108605, CVE-2026-108669, CVE-2026-108671, CVE-2026-108879, CVE-2026-108883), TencentCloud Octop's second record and the two houtini-ai *-mcp Low entries (CVE-2026-108786, CVE-2026-108787). Two VulDB records against Agno published the same day are a different reporter and a different CNA and have their own file.

What changed in the assessment: nothing in the status. Unla and Plano move the gateway shape from "any authenticated user reads the keys" to "anyone who can reach the port," and the mac-shell-mcp history shows the other way a research-CNA record arises: not a researcher skipping the vendor, but a vendor ignoring a private advisory for eight months.

Update 2026-10-13: the batch continued, and the records with an audience here have their own file

The agent and mcp listings on 2026-10-13 showed the next block, dated 2026-10-12 and 2026-10-13, with the same shape (VulnCheck as CNA, no package metadata, issue and permalink references). Four of them concern products this corpus's readers run and are written up in the Continue CLI / sandboxed.sh / deepsec / Network-AI file: Continue CLI's Bash prefix rules are bypassed by command chaining (CVE-2026-109560, no fix), sandboxed.sh attached shells to container workspaces with the host root visible (CVE-2026-109569, 9.3, opt-in flag), Vercel deepsec extracted sandbox result tarballs with plain tar (CVE-2026-109375, fixed 1.1.17 in May), and Network-AI's Claude Code PreToolUse hook matched deny patterns against one field (CVE-2026-109331, fixed 5.15.2). Also on the listings and not opened: EdgeEver (CVE-2026-109557, CVE-2026-109558), TinyLLaVA (CVE-2026-108957) and the FreeRDP and OTRS rows, which are out of audience. Nothing in this file's own tables changed; the registry checks of 2026-10-12 were not repeated.

Am I affected?

# Agent frameworks and MCP packages from the batch
pip show mini-swe-agent 2>/dev/null | grep -i version          # affected: 1.10.0 to 2.4.6 (all current releases)
grep -rn "BubblewrapEnvironment\|environment_class.*bubblewrap" ~/.config/mini-swe-agent* *.yaml 2>/dev/null
npm ls -g 9router @1mcp/agent @open-multi-agent/core argocd-mcp mcp-remote 2>/dev/null
npm ls 9router @1mcp/agent @open-multi-agent/core argocd-mcp mcp-remote 2>/dev/null
grep -rn "mcp-remote" ~/.claude.json ~/.cursor/mcp.json ~/.config/Code/User/settings.json 2>/dev/null | grep -- "--device-code"
# Hermes Agent config written by 9router: any hook is suspect
grep -n "hooks\|post_llm_call\|hooks_auto_accept" ~/.hermes/config.yaml 2>/dev/null
# MCP Kotlin SDK pin
grep -rn "io.modelcontextprotocol" build.gradle* gradle/libs.versions.toml 2>/dev/null
# Added 2026-10-12
grep -rn "github.com/mark3labs/mcp-go" go.mod 2>/dev/null                     # OAuth fix 1.2.1; DoS unfixed through 1.2.1
npm ls -g pinclaw mac-shell-mcp 2>/dev/null; grep -rn "pinclaw\|mac-shell-mcp\|hyper-mcp" ~/.claude.json ~/.cursor/mcp.json ~/.openclaw 2>/dev/null
pip show planoai mistralrs moai-adk 2>/dev/null | grep -i "^name\|^version"
ss -ltnp 2>/dev/null | grep -E ':(9901|18790) '                                 # Plano admin, pinclaw: should not be on 0.0.0.0
  • mini-swe-agent: affected only if you selected the Bubblewrap backend and run it with secrets in the host environment. The default local backend offers no isolation, so the practical exposure is the same: a task that reads untrusted content can read your keys. Unattended or --yolo runs remove the approval step that would otherwise show the command.
  • 9router: affected if the Hermes integration is configured and anyone untrusted can reach the dashboard. With requireLogin off, that is anyone on the network.
  • mcp-remote: affected only on the --device-code grant against a server whose discovery metadata points at a plain-HTTP endpoint off loopback. Standard browser-redirect flows are not in this record.
  • Hosted platforms (Suna, OpenLIT, Octop, LLMGateway, Honcho, Rill): affected if you self-host a listed version and let more than one trust level sign in.

If you are affected

  1. mini-swe-agent and the other sandboxes: take long-lived keys out of the runner's environment until a release adds --clearenv (the researcher's proposed fix) and re-injects only what the agent needs; run sandboxed tasks with networking unshared; keep command approval on for untrusted repositories. If a task has already processed untrusted content with keys present, rotate them: playbooks/if-your-local-ai-agent-was-exploited.md, playbooks/rotating-cloud-credentials.md.
  2. 9router with Hermes: keep requireLogin: true, restrict dashboard access, and audit ~/.hermes/config.yaml for hook keys you did not write. Treat an unexpected hook as a compromise of that user account.
  3. mcp-remote: do not use --device-code against a server you do not control until a release enforces HTTPS; prefer a client that speaks Streamable HTTP natively. If you did, revoke the tokens that flow issued: playbooks/if-an-mcp-server-was-malicious.md.
  4. argocd-mcp, 1MCP, Rill: scope the token the server holds to the least it needs, and treat a model-supplied identifier as untrusted input to every tool. Watch each repository for a release that references the CVE.
  5. MCP Kotlin SDK servers: put the WebSocket endpoint behind a proxy that enforces a frame and message size limit until the SDK does.
  6. Added 2026-10-12. Unla and Plano: take the gateway off routable interfaces now; for Plano, firewall port 9901 and rotate every provider key in its config, because the admin page has been printing them to anyone who asked; for Unla, disable or restrict dynamic client registration and treat every upstream credential the gateway injects as exposed. mcp-go: upgrade to 1.2.1 for the OAuth fix and put a body-size limit in front of the Streamable HTTP endpoint. hyper-mcp: pin plugin images by digest and set an explicit signer identity and issuer; the defaults verify nothing. pinclaw: stop the plugin or bind it to loopback until a release checks the token on /send; an exposed instance has been taking instructions from the network since May. mac-shell-mcp: remove it; the fixed code exists only in the repository and the npm package is the vulnerable 1.0.4. playbooks/if-an-mcp-server-was-malicious.md covers the token revocation in each case.

Prevention

  • A sandbox that inherits the host environment is a sandbox for the filesystem only. Start sandboxed commands from an empty environment and pass secrets through a scoped file or a short-lived token: prevention/agent-sandboxing.md.
  • Anything the model supplies to a tool is attacker input. Path segments, identifiers, URLs, SQL and config values each need validation at the tool boundary, not in the prompt: prevention/mcp-hygiene.md.
  • The LLM router or gateway holds every provider key. Give it its own network segment, its own login, and keys you can revoke per consumer: prevention/credential-hygiene.md.
  • Watch the CNA records, not the vendor tabs, for products this size. None of the 22 records had a vendor advisory on the sweep date; the database listings and the VulnCheck index were the only signal.

Sources

Sources added 2026-10-12