August 2026 agent-framework and MCP-server CVE batch — Spring AI tool-authorization bypass, PyCharm's unauthenticated Jupyter MCP, Splunk MCP RCE, LangChain SitemapLoader SSRF, and an LLM proxy that trusts a header for identity

View raw markdownEdit on GitHub ↗

TL;DR

One week's worth of CVEs across the AI-agent and MCP-server surface, grouped because they repeat the same four mistakes rather than because they share an actor. Headline items:

  • Spring AI — CVE-2026-59318: the per-request tool list Spring AI advertises to the model as a boundary isn't fully enforced at dispatch, so a tool not made available to the current request can still be invoked.
  • JetBrains PyCharm — CVE-2026-75060 (CVSS 8.4): the IDE exposed Jupyter MCP tools with no authentication, giving local code execution with no auth and no user interaction. Fixed in 2026.2.1.
  • Splunk MCP Server app — CVE-2026-76404 (CVSS 9.1, critical): unsafe deserialization in credential management → OS command execution. Fixed in 1.2.1, alongside nine Splunk AI Toolkit CVEs.
  • langchain-community — CVE-2026-72848 (CVSS 7.7): SitemapLoader applies restrict_to_same_domain only to leaf entries, so nested sitemaps SSRF into internal addresses — and the response comes back inside the returned Documents, making it a read-SSRF.
  • Headroom LLM proxy — CVE-2026-77776 (CVSS 9.3, critical): the proxy takes the memory owner from a client-supplied x-headroom-user-id header with no binding to the caller's credentials.

What happened

Spring AI — the advertised tool list is not the enforced one (2026-08-20/21)

CVE-2026-59318 / GHSA-wmqr-wxf2-6449 (Moderate, CVSS 6.5, CWE-863). Spring AI presents a per-request tool list to the model as a boundary, but does not fully enforce it at dispatch — a tool that was not made available to the current request can nonetheless be invoked, which is privilege escalation whenever request-scoped tool sets are how you separate privilege levels. Affects Spring AI 2.0.0, 1.1.0–1.1.8, and 1.0.0–1.0.9; fixed in 2.0.1 for open source, with 2.0.0.1 / 1.1.9 / 1.0.10 as Enterprise-Support-only backports.

This is the "decorator-as-documentation" class this repo has tracked since Semantic Kernel, now aimed at the request-scoped tool list rather than an SDK annotation. The general form: anything a framework shows the model as a constraint must also be checked where the call is actually dispatched. Telling the model about a limit is prompt engineering; enforcing it at dispatch is security.

Two siblings in the same batch:

  • CVE-2026-59279 / GHSA-2g9x-r8w8-qjff (High, CVSS 7.5, CWE-770) — the MCP Streamable HTTP server transport (WebFlux and WebMvc) puts no limit on retained sessions and requires no client authentication by default → unauthenticated remote memory exhaustion. Another entry in this repo's standing "MCP servers are unauthenticated network services by default" pattern. Affects Spring AI 2.0.0; the GHSA page does not state a patched version.
  • CVE-2026-59308 / GHSA-h4jw-w55g-65gf (Moderate, CVSS 4.2, CWE-668) — the Semantic Cache context hash doesn't isolate cached responses across different system prompts, so responses leak between unrelated contexts. Low CVSS, but for a multi-tenant deployment "another tenant's cached answer" is a data-isolation failure, not a caching quirk.

JetBrains PyCharm — an IDE shipping an MCP surface with the auth step missing (2026-08-17)

CVE-2026-75060 / GHSA-5686-8wvm-pm8w (High, CVSS 8.4, CWE-306 Missing Authentication for Critical Function). PyCharm exposed Jupyter MCP tools without authentication, letting a local attacker execute arbitrary code with no authentication and no user interaction. Fixed in PyCharm 2026.2.1.

Same shape as the Cline, OpenCode, Marimo, and AutoJack/AutoGen Studio entries in this repo's localhost cluster — and a reminder that the MCP surface an IDE opens on your behalf is one you did not choose to run and probably do not know is listening.

Splunk MCP Server — deserialization to OS command execution (2026-08-19)

CVE-2026-76404 / GHSA-3v49-2fcm-3rcj (Critical, CVSS 9.1), Splunk advisory SVD-2026-0808. The MCP Server app's credential-management component deserializes stored data without type validation; a user holding the Splunk admin role can supply or influence crafted serialized data and execute arbitrary OS commands on the host. Affects the Splunk MCP Server app < 1.2.1; fixed in 1.2.1.

The same advisory batch carries nine Splunk AI Toolkit CVEs (CVE-2026-76391 … CVE-2026-76399, CVSS 4.3–8.8), fixed in 6.0.0 / 6.0.1 — including CVE-2026-76395 (RCE via untrusted deserialization, 8.8), CVE-2026-76391 and CVE-2026-76394 (8.3, privilege management / missing authorization), and CVE-2026-76397 / CVE-2026-76399 (8.1, access control on experiment history and searches).

Authentication as admin is required for CVE-2026-76404, which lowers standalone urgency — but note the composition risk this repo keeps flagging: an MCP server is precisely the component an agent drives on your behalf, so "requires admin" means "requires the privilege the agent is probably already running with."

langchain-community — SitemapLoader read-SSRF (2026-08-21)

CVE-2026-72848 / GHSA-vg8m-4p2q-gcjh (High, CVSS 7.7, CWE-918). SitemapLoader.parse_sitemap applies the documented restrict_to_same_domain control only to leaf url entries — nested sitemap loc values go straight through to scrape_all([loc.text], "xml") unchecked. Anyone who controls or influences an ingested sitemap can steer the server at loopback, link-local, or RFC1918 addresses.

The aggravating detail: the fetched content is returned inside the resulting Documents, so this is a read-SSRF, not a blind one — cloud metadata, internal admin pages, and anything else reachable comes back into the pipeline (and, in a RAG setup, quite possibly into a model's context and then a user's answer). The GHSA page does not state affected or patched version ranges, so check langchain-community against the advisory directly rather than assuming a version is clean.

Same root shape as MLflow CVE-2026-64849: an SSRF guard that covers the obvious path and not the indirection one hop away.

Headroom LLM proxy — a header is not an identity (2026-08-21)

Two flaws in an LLM proxy, both amplified by a reference Docker Compose that binds 0.0.0.0 with no auth:

  • CVE-2026-77776 / GHSA-5vg3-c628-vf56 (Critical, CVSS 9.3) — the proxy derives the memory owner from the client-supplied x-headroom-user-id header without binding it to the caller's credentials (headroom/proxy/handlers/openai.py, chat-completion and WebSocket endpoints) → cross-user impersonation and access to other users' agent memory.
  • CVE-2026-77775 / GHSA-4j5r-9p93-j2px (High, CVSS 7.7, CWE-918) — clients choose the upstream via x-headroom-base-url; validation covers only scheme and hostname, so loopback, link-local, and RFC1918 destinations are reachable, responses are relayed back, and Authorization headers are forwarded unchanged to the attacker-chosen host. That last clause is the serious part: it hands your upstream LLM provider key to whatever host the caller names.

Neither GHSA page states affected or patched versions. This is a textbook instance of this repo's "central credentials cache" framing — an LLM proxy holds every upstream provider key for an org, so one header-trust bug is the union of every provider's API surface.

Also this window — MCP advisories entering the GHSA database

A cluster of MCP-server advisories was published to the GitHub Advisory Database between 2026-08-14 and 2026-08-19, but for several the original disclosure was June 2026 — the recent date is database ingestion, not discovery. Worth knowing so you don't read them as a fresh wave:

  • @contentful/mcp-server < 1.7.19 / @contentful/mcp-tools < 0.4.5 — CVE-2026-53957 / GHSA-2xhg-73j7-rrgx (CVSS 7.7). export_space / import_space pass LLM-controlled host and proxy arguments straight to the Contentful Management API client, so a prompt injection redirects the request — and the server's Personal Access Token — to an attacker endpoint. DB-published 2026-08-19; originally 2026-06-12.
  • chrome-devtools-mcp ≥ 0.24.0, ≤ 1.0.1 — CVE-2026-53766 / GHSA-8qf9-62x2-82pp (CVSS 6.1), patched 1.1.0. validatePath() uses path.resolve() instead of fs.realpath(), so a symlink that textually sits inside the workspace root escapes it, bypassing the MCP roots capability model. Notable because it is Google's own MCP server. DB-published 2026-08-17; originally 2026-06-16.
  • claude-faf-mcp ≤ 5.7.1, patched 5.7.2 — GHSA-rr55-jp92-8wp2 (CVSS 7.5, no CVE): arbitrary local file read/write via an unconfined path argument accepting absolute paths and ../. The advisory explicitly names prompt injection as the exploitation path (SSH keys, cloud credentials). Sibling advisories exist for faf-mcp (GHSA-j4r7-8ph4-43g3) and grok-faf-mcp (GHSA-cc2g-gq8c-r332).

@ooples/token-optimizer-mcp CVE-2026-55157 also entered the database on 2026-08-14; it is already tracked in the systemic MCP advisory.

Update 2026-08-30 — a second week, same four mistakes: seven more MCP servers bind every interface with optional-at-best auth (2026-08-22 to 2026-08-29)

A researcher/scanning effort surfaced via VulnCheck (each confirmed directly on NVD for this update) found seven more MCP-adjacent servers shipping the exact "listens on 0.0.0.0/:: by default, authentication is opt-in" pattern this advisory already names as mistake #2 — none share an actor or a codebase; they repeat the same default because it's the path of least resistance for an MCP server author, not because anyone copied anyone:

  • mcp-router CLI — CVE-2026-81094 / GHSA-rx55-5c7h-r56r (CVSS 3.1 9.1 critical, CVSS 4.0 9.3). The serve command (apps/cli/src/commands/serve.ts) defaulted its host to the all-interfaces address and required a caller token only if the operator passed the flag for it — a default invocation exposed the aggregator, and every MCP server it fronts, to the network. Affects < 0.6.3; fixed in 0.6.3.
  • ToolUniverse — CVE-2026-81096 / GHSA-pxwq-22vf-87fm (CVSS 3.1 10.0 critical). The python_code_executor tool's sandbox (python_executor_tool.py) denylisted specific attribute names/calls but left attribute-lookup builtins reachable via a string-based dunder lookup, and the server itself required no authentication — unauthenticated sandbox escape to arbitrary code execution. Affects ≤ 1.2.6; the GHSA page returned 404 to direct fetch during this sweep, so no fixed version is confirmed here — check the upstream repo directly.
  • Telnyx MCP server — CVE-2026-81098 / GHSA-46jp-xr2h-fw7h (CVSS 3.1 9.1 critical). packages/mcp-server/src/http.ts bound the Streamable HTTP transport to every interface and parsed caller auth headers in a mode that didn't fail when they were absent — a request with no credential completed initialization and dispatched tools. Affects ≤ 6.83.0; fixed version not confirmed (GHSA page 404'd to direct fetch).
  • UI-TARS-desktop (mcp-http-server / @agent-infra/mcp-server-*) — CVE-2026-81735 / GHSA not confirmed (CVSS 3.1 10.0 critical, CVSS 4.0 10.0). startServer.ts defaulted its listen address to :: (every interface) when no host was given, and its auth middleware was opt-in — applied only when a caller supplied it, exposing arbitrary command execution. Fixed by PR #1918 ("default host to 127.0.0.1, not all interfaces"), merged 2026-07-01 at commit c2ad42e; no released package version number is stated in the PR itself, so confirm your installed version postdates that commit rather than assuming a version number.
  • mcp-use Inspector proxy — CVE-2026-81091 / GHSA-f2jg-rm2x-hc5p (CVSS 3.1 8.6 high). mountMcpProxy (libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts) read a proxy target from an X-Target-URL header or __mcp_target parameter and forwarded to it without inspecting the host — loopback, link-local, and RFC1918 destinations all accepted. Affects ≤ 2.3.2; fixed version not confirmed (GHSA page 404'd to direct fetch).
  • Apify actors-mcp-server — CVE-2026-81093 / GHSA-m28f-9v8h-gg2f (CVSS 3.1 8.6 high). The get-html-skeleton tool's URL validator (isValidHttpUrl) checked only that the input parsed as an http(s) URL, never the resolved host — the same read-SSRF-via-agent-tool shape as langchain-community's SitemapLoader above, in a different codebase. Affects < 0.9.12; fixed in 0.9.12.
  • argocd-mcp — CVE-2026-82456 / GHSA-rp45-5x3v-48mr (CVSS 3.1 10.0 critical, CVSS 4.0 10.0). Binds its HTTP transport to every interface and, when ARGOCD_API_TOKEN is configured, accepts MCP sessions without requiring a caller credential — full tool surface (create applications, trigger syncs, modify resources) reachable by anyone who can reach the listener, using the operator's own stored token. Affects 0.8.0; fixed in 0.9.0.

All seven were confirmed directly against NVD for this update (published 2026-08-22 through 2026-08-29); each carries a vendor-repo GHSA cross-reference. Running tally for this repo's "MCP servers are unauthenticated network services by default" pattern: two batches, roughly three weeks apart, thirteen distinct MCP-adjacent projects, the same two defaults (bind-all-interfaces, auth-is-opt-in) in nearly every one.

Update 2026-09-09 — three more single-server MCP CVEs, none sharing an actor

Three unrelated MCP-server CVEs surfaced this window, each confirmed against a primary source (NVD, VulnCheck, or the GitHub Advisory Database directly) rather than an aggregator paraphrase:

  • mcp-atlassian — CVE-2026-73498 / GHSA-g5r6-gv6m-f5jv (CVSS 7.7, High). The confluence_upload_attachment function passes a client-supplied file_path straight to open(file_path, "rb") with no call to the codebase's own validate_safe_path() — a path-traversal that lets an authenticated MCP client, or an agent steered by indirect prompt injection, read and exfiltrate any file the server process can access (including environment variables such as CONFLUENCE_API_TOKEN). Affects < 0.22.0; fixed in 0.22.0. Same "an SSRF/path guard exists elsewhere in the codebase but wasn't applied here" shape already tracked above for chrome-devtools-mcp and LangChain's SitemapLoader.
  • ArcadeDB — CVE-2026-67357 / GHSA-p9wc-4fhr-78wm (CVSS 7.7, High). The MCP get_server_settings tool returns arcadedb.ha.clusterToken in cleartext; a client with MCP access can retrieve it and replay it via the X-ArcadeDB-Cluster-Token / X-ArcadeDB-Forwarded-User headers to impersonate root and take full administrative control. Affects < 26.7.3; fixed in 26.7.3. Do not confuse this with the sibling CVE-2026-67343 / GHSA-46hj-24h4-j8gf (CVSS 8.7) — a related but distinct cleartext-cluster-token disclosure in ArcadeDB's plain GET /api/v1/server REST endpoint (not the MCP tool), fixed one version earlier in 26.7.2. Both leak the same token via different endpoints; an operator patching only one has not closed the other.
  • facebook-ads-mcp-server (gomarble-ai) — CVE-2026-19956 (CVSS 3.1: 6.3 Medium / CVSS 4.0: 5.3 Medium, CWE-918 SSRF). The fetch_pagination_url function in server.py forwards a pagination URL without validating its host, allowing an authenticated caller to drive SSRF from the server's network position. Affects 0.1.0; fixed via commit 4e53875 / PR #32. No GHSA has been filed — this record is VulDB-sourced and confirmed only against NVD; noted here rather than given its own file per this repo's low-value-single-CVE threshold.

Update 2026-09-12 — critical MCP-server RCEs entering the GHSA database, same two defaults again (and one that is command-injection, not misconfig)

The GitHub Advisory Database's reviewed-critical listing published a fresh batch of MCP-server CVEs in early September; per this repo's standing caution, a GHSA database-publication date is not a disclosure date, and most of these were originally disclosed in June–August, so they are dated by original disclosure below. All were fetched from their GHSA pages directly.

  • chainlit — CVE-2026-45018 / GHSA-w3fx-mc44-mf6j (CVSS 9.8). With MCP enabled, the /mcp endpoint's validate_mcp_command() allowlists only the executable name and never inspects arguments, so npx -y -c '<command>' reaches a shell — unauthenticated RCE for any client with a session. Affects ≥ 2.4.0rc0, ≤ 2.11.1; fixed 2.12.0 (2026-08-25). Chainlit is a common vibe-coding chat-UI framework; disable MCP (features.mcp.enabled = false) if you cannot upgrade.
  • mcp-contextforge-gateway — CVE-2026-53710 / GHSA-xm98-3vcf-fph7 (CVSS 10.0). RestrictedPython sandbox bypass in python_sandbox_server: raw getattr in safe_builtins plus runtime-constructed dunder names lets an attacker on the HTTP/SSE transport walk to subprocess.Popen and execute commands. Affects ≤ 1.0.1; fixed 1.0.2 (2026-08-24). This is the same IBM ContextForge gateway family already tracked in the MCP stdio systemic-RCE advisory — a distinct new sandbox-bypass CVE, not the earlier finding.
  • mysql-mcp-server — CVE-2026-59971 / GHSA-rqfv-2mw9-78g2 (CVSS 10.0). In SSE mode the server sets no security_settings, so DNS-rebinding protection defaults off, there is no CORS/TrustedHost middleware, routes are unauthenticated, and it binds 0.0.0.0 — unauthenticated SQL execution (and file R/W / RCE via MySQL FILE). ~25 instances were found publicly exposed. Affects < 0.4.2; fixed 0.4.2 (disclosed 2026-06-21, reviewed into the advisory database 2026-09-11). The exact bind-all-interfaces / auth-optional pattern this advisory has now tracked across ~20 MCP projects.
  • PraisonAI — CVE-2026-55536 / GHSA-6g6r-q6gw-w8fg (CVSS 9.1). A patch bypass of CVE-2026-40289: the browser server validates the WebSocket Origin with re.match() (anchored only at the start), so chrome-extension://<32 chars><extra> passes and an attacker drives browser automation, exfiltrates cookies, and screenshots authenticated sessions. Affects < 4.6.58; fixed 4.6.58. Folds into this repo's existing PraisonAI advisory thematically but is logged here with the MCP/agent-server batch; the fix replaces re.match() with re.fullmatch().
  • Also reviewed into the advisory database this window (older disclosures, lower vibe-relevance, noted not detailed): qwed-mcp CVE-2026-55546 (SymPy parse_expr() RCE, fixed 0.2.1), nextcloud-mcp-server CVE-2026-55640 (unauthenticated webhook when WEBHOOK_SECRET unset, fixed 0.117.2), and the trojanized pantheon-agents PyPI package (0.6.1/0.6.2, June 2026 maintainer-token compromise, .pth Bun credential-stealer) — the last is a supply-chain compromise rather than a code-level MCP CVE.

Running tally: across the three batches this file now tracks (August, 2026-08-30, and this one), the "an MCP server is an unauthenticated network service by default, and the guard that exists elsewhere in the codebase wasn't applied here" pattern holds in nearly every case; the chainlit and contextforge entries add unsandboxed-command-execution as a second recurring root cause alongside missing origin/host validation.

Update 2026-09-13 — Grafana's official MCP server: an unauthenticated session-spoof chained into a CVSS 9.1 SSRF that reaches the cloud metadata service (CVE-2026-19516, fixed 1.1.0). Pillar Security (Ariel Fogel et al., published 2026-09-02) found two flaws in mcp-grafana — Grafana Labs' own MCP server, which Pillar counts at over 1.9M cumulative Docker Hub pulls — that combine into one unauthenticated path to the internal network:

  • Session spoofing (no CVE). The server validated the format of an MCP session id rather than whether it had issued it, so a remote caller could mint its own session id locally and invoke tools with the server's Grafana service-account token. Session ids are state references, not credentials — the exact mistake the DeepSeek Harness and NemoClaw findings make with Host headers.
  • CVE-2026-19516 (Grafana-assigned CVSS 3.1 9.1, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L, CWE-918; published 2026-08-11). The grafana_api_request tool honoured a caller-supplied X-Grafana-URL header for its outbound destination, method, path, body and headers. Grafana's advisory states this is an incomplete fix for CVE-2026-15583: the earlier patch stopped the token leaking to foreign hosts but never restricted the destination, so the server still executed the request and returned the response — "a readable, method-capable proxy from its own network location," in Pillar's words — reaching loopback, private ranges and AWS IMDSv2 credentials. The vector says PR:L; the session-spoof supplies the "L".

Timeline per Pillar: reported via Intigriti 2026-08-02; v1.1.0 released 2026-08-10 with the SSRF fix and optional bearer-token authentication (401 for unauthenticated requests, plus a logged warning when the server binds beyond loopback); CVE published 2026-08-11. "Optional" is the word to notice — an upgraded server that never sets the token is still unauthenticated. Affected ≤ 1.0.0. CSA's 2026-09-08 research note on the finding titles it "identity confusion by design": the MCP server acts with its own service-account identity on behalf of any caller it cannot tell apart. Fifth entry in this file where the fix note reads "added authentication (optional)".

Update 2026-09-14 — three vendor-bulletin batches: AWS's official database MCP servers (read-only gates that weren't), four more IBM ContextForge CVEs, and a coding agent whose repo config could switch on its shell tool. All confirmed against the vendor bulletin or NVD record, not an aggregator.

AWS Labs MCP servers (AWS Security Bulletins 2026-097, 2026-101, 2026-103; CNA AWS): - awslabs.postgres-mcp-server — CVE-2026-85787 (CVSS 4.0 7.1, CWE-184). The SQL validation blocklist that enforces read-only mode was incomplete: crafted SQL placed in content an authenticated user submits to the MCP server could modify data "beyond the read-only scope." Affects < 1.1.7; fixed 1.1.7 (2026-09-04). AWS's own workaround is the real fix — run the server as a minimal Postgres role with only CONNECT/USAGE/SELECT, never a superuser or master user. Reporter: Ashwak N. - awslabs.mysql-mcp-server — CVE-2026-85788 (CVSS 5.7). The mutable-SQL detector missed SQL inline comments that the regex did not treat as whitespace, letting statements bypass the read-only gate and reach file-read/file-write SQL sinks. Affects ≤ 1.0.21; fixed 1.0.23 (2026-09-09). Same advice: no FILE privilege on the database user. Reporter: Jaeyoung Yun. - awslabs.dynamodb-mcp-server — CVE-2026-85654 (CVSS 4.0 7.1, CWE-1336 template injection). The CDK generator — the tool that turns a data-model JSON into deployable infrastructure code — did not neutralise table, index, or attribute names, so a crafted dynamodb_data_model.json executes arbitrary code on the host that runs the generator. Affects 2.0.10 – 2.1.5; fixed 2.1.6 (2026-09-04). Local vector, but the data-model file is exactly the artifact an agent writes from an untrusted spec. Reporter: Jaimen Bell. Pattern note: two of the three are "the read-only mode is a regex" — the guard is a denylist over SQL text, and the model (or a prompt-injected model) writes the SQL. Prefer database-side privileges to server-side string filtering, as AWS's own bulletins recommend.

IBM ContextForge MCP Gateway (IBM PSIRT bulletins, published 2026-09-02; NVD 2026-09-04) — four CVEs, distinct from the CVSS 10.0 RestrictedPython bypass (CVE-2026-53710) logged in the 2026-09-12 update: - CVE-2026-18486 (CVSS 3.1 8.8): unrestricted jq filters let an authenticated developer call built-ins like $ENV and read environment variables holding "cryptographic keys and database credentials that can be leveraged to forge administrator tokens." Affects ≤ 1.0.7; fixed 1.0.8. IBM's remediation includes running the re-encryption migration and rotating JWT_SECRET_KEY, AUTH_ENCRYPTION_SECRET, DATABASE_URL, REDIS_URL, BASIC_AUTH_PASSWORD — no workaround. - CVE-2026-77822 (CVSS 8.2): SSRF via DNS rebinding in the A2A agent invocation path — the resolved IP is not pinned at connection time. Affects ≤ 1.0.8; fixed 1.0.9. - CVE-2026-18905 (CVSS 7.7): DNS-rebinding TOCTOU — URL validation runs at tool registration, not invocation, so a low-privilege user changes the DNS record afterwards and redirects outbound gateway requests to internal targets. Affects ≤ 1.0.6; fixed 1.0.7. - CVE-2026-18489 (CVSS 7.1, CWE-488): the Translate utility with --enable-dynamic-env could execute a second client's request under the first client's credential-derived environment. Affects ≤ 1.0.8; IBM's "fix" (PR #6388) is documentation stating Translate is for local single-session development only — if you run it multi-client, stop, rotate, audit. Six ContextForge CVEs across two files in three weeks; IBM's bulletin pages (ibm.com/support/pages/node/<id>) are the record, per this repo's corporate-parent rule.

CodeWhale (Hmbown/CodeWhale, a terminal coding agent for open-weight models; VulnCheck CNA; disclosed 2026-07-16, database-reviewed 2026-09-04): - CVE-2026-75911 (CVSS 4.0 8.5): a repo-committed .codewhale/config.toml could set allow_shell = true, which the agent applied silently, enabling its exec_shell/task_shell tools with no prompt. approval_policy and sandbox_mode had tightening-only guards; allow_shell did not. Affects 0.8.41 – 0.8.63; fixed 0.8.64. Same class as aider's .aider.conf.yml: a project config file the attacker wrote is trusted as if the user wrote it. Reported by VinSOC Labs. - CVE-2026-75858 (CVSS 8.5): the rlm_eval tool executed model-supplied Python and returned ApprovalRequirement::Auto, which the engine treats as never-prompt — unsandboxed code execution from any prompt injection. Same affected/fixed range (plus the older deepseek-tui package name it was forked from, 0.8.33 – 0.8.40). - CVE-2026-75856 (CVSS 9.2): SSRF-guard DNS-pinning TOCTOU — a DNS server that fails the first resolution and answers the second with 127.0.0.1 reaches local services and cloud metadata. Same range; fixed 0.8.64.

Update 2026-09-15 — a fourth week: an unauthenticated-by-default AI gateway (Bifrost, 9.8), an IAM server whose MCP endpoint skips authorization (Casdoor, 9.9/9.4, unpatched), default credentials in ContextForge (9.8), and three more June disclosures reviewed into the database. All fetched from the primary advisory or the CNA record, not an aggregator.

  • Bifrost — CVE-2026-90898 (CVSS 3.1 9.8, CNA JFrog, 2026-09-14). One unauthenticated POST /api/mcp/client registers a stdio MCP client, which the gateway starts immediately — code execution as the gateway process whenever governance.auth_config.is_enabled=false, the shipped default. Fixed transports/v2.1.0 (2026-09-08). Written up on its own: Bifrost — unauthenticated MCP client registration RCE.
  • Casdoor — CVE-2026-91998 (CVSS 3.1 9.9 / 4.0 9.4, CNA VulnCheck, published 2026-09-15; CWE-863). Casdoor is an open-source IAM / SSO server. Its /api/mcp endpoint resolves any request carrying any application's OAuth clientId/clientSecret to an app/<name> subject that hits an unconditional global allow, skipping the Casbin policy and organization scoping. Whoever holds one application's credentials can enumerate users (password salts and emails included), create administrators, and modify or delete users in every organization. Affects through 4.4.0; no fixed version as of 2026-09-15. The researcher (George Chen) reports emailing the project on 2026-06-13, opening GitHub issues around 2026-06-26 after no response, and the issues being deleted; the same write-up carries two further unpatched findings (unauthenticated file upload; organization admins reading the global JWT signing key). If your app's auth server is Casdoor, treat every application credential as an admin credential until a fix ships, and keep /api/mcp off the internet.
  • IBM ContextForge MCP Gateway — CVE-2026-78573 (CVSS 9.8, CWE-1392 use of default credentials; IBM bulletin 7286834 published 2026-09-09, NVD 2026-09-10). The gateway ships with known default values for platform_admin_password, default_user_password and basic_auth_password, so remote attackers obtain administrative access. IBM's bulletin says v1.0.0 through v1.0.9, fixed v1.0.10; the GitHub Advisory Database copy says 1.0.0 – 1.0.7 — prefer IBM's range. Set all three to strong values before enabling authentication features. Seventh ContextForge CVE in this file.
  • FrontMCP / mcp-from-openapi — CVE-2026-59973 (CVSS 8.5; vendor advisory 2026-06-22, database-reviewed 2026-09-11). A bypass of the earlier SSRF fix (CVE-2026-39885) for external OpenAPI $ref resolution: the hostname denylist still admitted loopback and private targets via DNS names resolving to loopback, redirect chains and IPv4-mapped IPv6. @frontmcp/adapters and frontmcp ≥ 1.2.1 < 1.5.0 → 1.5.0; mcp-from-openapi ≥ 2.3.0 < 2.5.0 → 2.5.0.
  • functype-mcp-server — CVE-2026-59176 (CVSS 7.8; 2026-06-20, database-reviewed 2026-09-09). The set_functype_version tool interpolates an unvalidated version string into pnpm add functype@<version>; npm alias and file: syntax install an attacker-chosen package which the server then dynamically imports. ≤ 1.4.3 → 1.4.4. A package-manager invocation with model-supplied arguments is the same primitive as the "install a dependency" tool in every coding agent.
  • knowns — CVE-2026-88938 (CVSS 4.0 7.1 / 3.1 6.5, CNA VulnCheck, 2026-09-10), plus two siblings the database lists for the same project (CVE-2026-86541, handleCodeReplace path traversal; CVE-2026-86439, MCP tool path validation; both 2026-09-08, not fetched individually). knowns (knowns-dev/knowns) is a Go MCP server that gives AI agents project context; its code.find tool did not confine the path argument to the project root, so agent sessions read any file on the host. Affects through 0.33.0; no fixed version on the CNA record as of this date.

Bifrost and Casdoor are the two ends of this file's pattern: one ships with authentication off, the other has authentication on but exempts the MCP route from authorization. An /api/mcp or /api/mcp/client route is a control plane and needs the same gate as the admin UI.

Update 2026-09-16 — two more unauthenticated-RCE agent-infra servers reviewed into the database (LightLLM, atomic-agents-stack), both VulnCheck CNA.

  • LightLLM — CVE-2026-90919 (CVSS 4.0 9.3, VulnCheck, published 2026-09-14). LightLLM (ModelTC, a high-performance LLM inference/serving framework) exposes an unauthenticated /visual_register WebSocket endpoint on its Config Server that passes the first client frame straight to pickle.loads() — send a serialized payload with a __reduce__ method and get code execution as the Config Server process. Affects through 1.2.0; the CNA record lists no fixed version as of this date, so treat it as unpatched and keep the Config Server port off any untrusted network. Pickle-over-the-wire is the same primitive as the LangGraph msgpack chain and the NLTK/unstructured pickle findings — a "load this object" endpoint is a "run this code" endpoint.
  • atomic-agents-stack — CVE-2026-91988 (CVSS 4.0 9.2, VulnCheck, published 2026-09-15). The HTTP MCP server-registry backend factory accepts cleartext http:// schemes, so a network man-in-the-middle rewrites the catalog response and injects command/argument values that MCPClientPool spawns as local subprocesses — RCE on the agent host. Affects before 1.1.0; fixed 1.1.0. This is the MITM-on-the-registry cousin of the Coder registry compromise: when the thing that tells your agent which MCP servers to run is fetched over plaintext, whoever sits on the wire chooses the command.

Update 2026-09-17 — the official Rust MCP SDK (rmcp): a client-side OAuth token-theft bug and an unauthenticated session-table leak, both fixed in 2.0.0 (CVE-2026-63127 / CVE-2026-63128, published 2026-09-16). rmcp is the Model Context Protocol organisation's Rust SDK — the library behind Rust-built MCP servers and clients. Two GitHub-reviewed advisories landed on 2026-09-16, both fetched directly:

  • CVE-2026-63127 / GHSA-33f5-2c5q-wgwj (CVSS 8.2, High). The OAuth Protected Resource Metadata discovery in rmcp's client never validated the resource field RFC 9728 requires it to check ("the client MUST ensure that the resource identifier URL it is using as the prefix for the metadata request exactly matches the resource value in the returned metadata document") — the ResourceServerMetadata struct had no such field at all. A malicious MCP server can therefore serve metadata that names a legitimate server's authorization server; the user's OAuth flow runs against the real provider, and the resulting access token, valid for the legitimate MCP server, is returned to the attacker's. Every rmcp-based client talking to OAuth-protected MCP servers is exposed; the fix is "full account impersonation on the legitimate server" territory. Affects < 2.0.0; fixed 2.0.0. This is the client-side mirror of the rmcp DNS-rebinding server bug (CVE-2026-42559, 2026-05-06, High) the advisory database also lists for this crate, which this repo had not logged — and a reminder that "connect to this MCP server" is an authorization decision even when the server is only pretending to be someone else's.
  • CVE-2026-63128 / GHSA-9pj6-vhgr-3mwh (CVSS 7.5, High). The Streamable HTTP server transport allocated a session and spawned a worker before validating the request body, then returned 422 for any non-InitializeRequest without cleaning up — so an unauthenticated client leaks one ~400–550-byte session-table entry per request, permanently. The reporter sustained 2,100 requests/second from one Python client, i.e. tens of gigabytes a day, plus lock contention on the session manager's RwLock for legitimate clients. Affects < 2.0.0; fixed 2.0.0.

Rust MCP servers are a small share of the ecosystem, but the SDK-level pattern is the one to carry: an MCP client has its own trust decisions (which authorization server, which resource) that a hostile server can steer, and a transport that "accepts a connection then checks" is a resource-exhaustion primitive. Upgrade rmcp to ≥ 2.0.0 on both sides.

Update 2026-09-18 — a third rmcp client bug, and the fix line moves to 2.1.0: custom headers (API keys) follow a cross-origin redirect (CVE-2026-64684 / GHSA-9g45-5xwm-f3wc, CVSS 6.8, published 2026-09-16). StreamableHttpClientTransport built its default reqwest client with automatic redirects on and applied StreamableHttpClientTransportConfig.custom_headers without marking them sensitive, so "when a malicious or compromised MCP endpoint returns a cross-origin 307 or 308 redirect, reqwest follows the redirect and apply_custom_headers causes custom API keys or authentication tokens to be replayed to the new origin, where an attacker can capture and reuse them" (NVD, CNA GitHub). The separate auth_header path was not affected. Affects < 2.1.0; fixed 2.1.0 (rust-sdk PR 936, commit 496902b9…). Same shape as the Clerk proxy SSRF and the LiteLLM credential-forwarding bugs elsewhere in this repo: a client that forwards a secret to wherever the server points it. Combined with the two 2026-09-16 advisories above, every rmcp client built before 2.1.0 has a token-theft path that a hostile MCP server can trigger; upgrade to ≥ 2.1.0 and, where you control the transport config, disable redirect-following or set headers as sensitive.

Update 2026-09-20 — the MCP runtime layer joins the list (ToolHive containers reach the host, Obot's OAuth mints over-scoped tokens), plus three Claude-Code-ecosystem tools no vendor tab will ever show you

Six items from the mcp recency listing and the ?query=claude / ?query=agent database queries, three of them entering the database weeks or months after their vendor dates:

  • ToolHive — containerised MCP servers reach host-local services via host.docker.internal (CVE-2026-58197 / GHSA-qg2g-g9w3-m5h8, CVSS 8.8 AV:A/AC:L/PR:N/UI:R/S:C, vendor advisory 2026-07-28, database 2026-09-18). Stacklok's ToolHive is the "run every MCP server in its own container" runtime this repo's MCP hygiene guide is the shape of. Its advisory: "A containerized MCP server running with the default network permission profile can reach host-local services via host.docker.internal. This includes the ToolHive API itself, other ToolHive-managed MCP server proxies" — and any self-hosted model or service bound to the host. Three weaknesses stacked: insecure-by-default networking, unauthenticated API endpoints, and Docker's built-in DNS name for the host — no container escape needed. A malicious MCP server in one container can enumerate and call the native MCP tools ToolHive manages with elevated privileges, poke the control plane, and exfiltrate through other servers. Affects < 0.30.1; fixed 0.30.1 (PRs stacklok/toolhive#5583, toolhive-studio#2469). The lesson is the one the whole batch keeps teaching, one layer down: the isolation product's default profile is the boundary, and it was open.
  • Obot (obot-platform/obot, Go — an MCP gateway/registry platform) — three vendor advisories dated 2026-06-22, GitHub-reviewed 2026-09-18, all fixed 0.23.0, no CVEs. GHSA-xwmw-prc4-v3cr (8.8): OAuth Dynamic Client Registration accepted unauthenticated clients with arbitrary redirect URIs, the authorization flow auto-completed with no consent screen for a logged-in victim who clicked a crafted link, and the token issued "contained the victim's full group permissions rather than being scoped to just the requested MCP server" — API access to everything the victim could reach (credit EQSTLab; the fix adds a consent screen, per-MCP token scope and audience validation). GHSA-jgh3-fggc-mcpm (7.6, PR:H): a Power User registering a remote MCP server supplies a URL that is "fetched server-side with no validation of the destination" — loopback, RFC1918, and 169.254.169.254 all reachable, responses reflected in error messages (non-blind), cloud IAM credentials on the table; 0.23.0 adds a single egress chokepoint that rejects internal ranges at dial time. GHSA-pr6h-vr44-xq8j (5.3): with OBOT_SERVER_ENABLE_REGISTRY_AUTH=true set, the /v0.1/* MCP-registry endpoints were still readable anonymously because the authorizer's protected-prefix list omitted /v0.1 (catalog metadata and connection URLs, no credentials). Same DCR/redirect shape as Bifrost's unauthenticated client registration and the rmcp OAuth bugs above.
  • cc-connect — Feishu card callbacks skip the per-user allowlist (CVE-2026-92801 / GHSA-2qg4-97v5-72x5, CVSS 8.7, database 2026-09-16, CNA VulnCheck). cc-connect (chenhg5/cc-connect, ~15.6K stars) bridges a local Claude Code / Cursor / Gemini CLI / Codex session to Feishu, Telegram, Slack and Discord so you can drive your coding agent from a chat app with no public IP. Through 1.5.0 it validated per-user permissions on text messages but not on Feishu interactive-card actions, so "attackers can dispatch agent commands by triggering card actions in admitted chats" — anyone in a chat the bridge is admitted to, not only the allow-listed operator, can send instructions to the agent on your machine. The database record lists no patched version and the repository's newest tag at fetch time was v1.5.1-beta.1; treat every version as affected until the project says otherwise (repo issue #1852). This is the messaging-bridge variant of OpenClaw's non-owner-sender bugs — the chat platform's membership is not the agent's authorization.
  • Tencent BrowserSkill — any 32-character chrome-extension:// origin is accepted by the local daemon (CVE-2026-94111 / GHSA-x6f2-qp26-2xrh, CVSS 6.9 on the database record, published 2026-09-20). BrowserSkill is an agent browser-automation tool; its local daemon's WebSocket origin check "accepts any chrome-extension origin with 32 characters in range a-p" — which is every extension id. A malicious extension registers itself as the browser client and "intercept[s] or alter[s] page content, DOM elements, and screenshots sent to the AI agent." Through 0.3.0, no patched version listed (repo issue Tencent/BrowserSkill#273). It is BragJack's mechanism applied to an agent's eyes rather than its prompt: what the model sees is attacker-chosen.
  • OpenPanel — MCP auth tokens from URL query parameters written to plaintext logs (CVE-2026-93982, CVSS 4.8, published 2026-09-19). Through commit bad75bdd, the analytics platform logged base64 MCP credentials unredacted; anyone with stdout or centralised-log access can replay them against the MCP endpoint. Low score, familiar shape (CWE-532); rotate MCP tokens if your logs are shared.
  • Two "Claude Code ecosystem" tools with no vendor and no tab — found only by querying the advisory database for the agent's name. claude-code-templates (npm) — CVE-2026-73222 / GHSA-79wm-x847-7cvg, CVSS 8.8: the --studio development server (an Express app) binds 0.0.0.0 with no authentication and accepts cross-origin requests, and POST /api/execute and POST /api/install-agent pass input to a shell with shell: true — a web page you visit while Studio is running, or anyone on the same network, runs commands as you. Affects ≤ 1.29.2, fixed 1.29.4 (vendor advisory 2026-07-14, CVE 08-11, database 09-03, reporter spartan8806, commit bc4618b); the registry shows 1.29.6 on 2026-09-17 and ~1,930 downloads in the week to 09-19. claude-skill-antivirus — CVE-2026-84810 / GHSA-gvgj-r6pg-m42w, CVSS 7.1: a scanner meant to vet skills before you run them "reads only SKILL.md while ignoring Python source, bytecode, and other artifacts," returning SAFE, 100/100 trust for a skill whose payload lives in any other file (CNA VulnCheck, database 2026-09-02, repo issue claude-world/claude-skill-antivirus#33, no versions listed). A skill scanner that scans the manifest is worse than none, because it produces a green badge; if you rely on one, confirm it opens every file in the directory.
# ToolHive: below 0.30.1 the default network profile reaches the host
thv version 2>/dev/null
# Obot: below 0.23.0 the OAuth DCR + registry bugs are live
# claude-code-templates Studio: is it listening on all interfaces right now?
ss -tlnp 2>/dev/null | grep -E '0\.0\.0\.0:(3[0-9]{3}|[0-9]{4,5})' | grep -i node
npm ls -g claude-code-templates 2>/dev/null   # < 1.29.4 = unauthenticated RCE when --studio runs
# cc-connect: any Feishu chat the bridge is admitted to can drive the agent through card actions — remove the bridge from shared chats until a fix ships

Am I affected?

# Spring AI (Maven/Gradle)
grep -rn 'spring-ai' pom.xml build.gradle* 2>/dev/null

# LangChain community + any MCP servers in a Python env
pip list 2>/dev/null | grep -Ei 'langchain-community|mcp'

# npm-side MCP servers named above
npm ls @contentful/mcp-server @contentful/mcp-tools chrome-devtools-mcp \
       claude-faf-mcp faf-mcp grok-faf-mcp 2>/dev/null

# PyCharm build number — need 2026.2.1 or later
ls ~/Library/Application\ Support/JetBrains/ 2>/dev/null || ls ~/.config/JetBrains/ 2>/dev/null

# 2026-08-30 update: the second MCP bind-all-interfaces batch
npm ls mcp-router @agent-infra/mcp-server-commands @agent-infra/mcp-server-filesystem 2>/dev/null
pip list 2>/dev/null | grep -Ei 'tooluniverse'
npm ls mcp-use 2>/dev/null
npm ls @apify/actors-mcp-server 2>/dev/null
npm ls argocd-mcp 2>/dev/null
# Any of the above reachable beyond loopback (check listening address, not just process presence):
ss -tlnp 2>/dev/null | grep -E ':(3000|4000|8000|8080|3333)\b' || netstat -tlnp 2>/dev/null

# 2026-09-14 update
pip list 2>/dev/null | grep -Ei 'awslabs\.(postgres|mysql|dynamodb)-mcp-server|mcp-contextforge-gateway'
npm ls -g codewhale deepseek-tui 2>/dev/null; cargo install --list 2>/dev/null | grep -i codewhale
# Need: postgres-mcp-server >= 1.1.7, mysql-mcp-server >= 1.0.23, dynamodb-mcp-server >= 2.1.6,
#       mcp-contextforge-gateway >= 1.0.9, codewhale >= 0.8.64

# 2026-09-09 update
pip list 2>/dev/null | grep -Ei 'mcp-atlassian'
# ArcadeDB — check server version, not just an installed client library
# facebook-ads-mcp-server (gomarble-ai)
pip list 2>/dev/null | grep -Ei 'facebook-ads-mcp'

Minimum safe versions established in this batch: Spring AI 2.0.1 · PyCharm 2026.2.1 · Splunk MCP Server app 1.2.1 · Splunk AI Toolkit 6.0.0/6.0.1 · @contentful/mcp-server 1.7.19 / @contentful/mcp-tools 0.4.5 · chrome-devtools-mcp 1.1.0 · claude-faf-mcp 5.7.2 · mcp-router 0.6.3 · actors-mcp-server 0.9.12 · argocd-mcp 0.9.0 · mcp-atlassian 0.22.0 · ArcadeDB 26.7.3 (26.7.2 closes the sibling REST-endpoint leak only) · facebook-ads-mcp-server at or after commit 4e53875. For langchain-community, Headroom, Spring AI's CVE-2026-59279, ToolUniverse, Telnyx MCP server, UI-TARS-desktop's mcp-http-server (fixed at commit c2ad42e, no version number stated), and mcp-use's Inspector proxy, the advisory pages do not state a fixed version — check upstream directly rather than assuming.

If you run Headroom or any Spring AI MCP HTTP transport reachable beyond loopback, treat every upstream LLM provider key it holds as potentially exposed and rotate — the SSRF forwards Authorization headers verbatim. The same applies to argocd-mcp: if ARGOCD_API_TOKEN was configured and the listener was reachable, treat that token as exposed and rotate it.

If you are affected

Prevention

The four repeating mistakes in this batch, stated plainly: (1) a limit shown to the model is not a limit enforced at dispatch (Spring AI); (2) an MCP surface opened on the user's behalf still needs authentication (PyCharm, Spring AI transport); (3) an SSRF guard on the obvious path misses the indirection one hop away (LangChain nested sitemaps, Headroom's base-URL override); (4) a request header is never an identity (Headroom).

Sources

2026-08-30 update sources — all seven CVEs below confirmed directly against the NVD API (services.nvd.nist.gov/rest/json/cves/2.0) rather than paraphrased from an aggregator; each NVD record's own reference list is cited alongside it: - NVD — CVE-2026-81094 / GHSA-rx55-5c7h-r56r — mcp-router CLI, CVSS 9.1/9.3, fixed 0.6.3. - NVD — CVE-2026-81096 / GHSA-pxwq-22vf-87fm — ToolUniverse, CVSS 10.0/9.3, ≤1.2.6 affected, fixed version not confirmed (GHSA page 404'd to direct fetch this sweep). - NVD — CVE-2026-81098 / GHSA-46jp-xr2h-fw7h — Telnyx MCP server, CVSS 9.1/9.3, ≤6.83.0 affected, fixed version not confirmed. - NVD — CVE-2026-81735 and PR #1918 — UI-TARS-desktop mcp-http-server, CVSS 10.0/10.0, fixed at commit c2ad42e (2026-07-01), no released version number stated. - NVD — CVE-2026-81091 / GHSA-f2jg-rm2x-hc5p — mcp-use Inspector proxy, CVSS 8.6/8.7, ≤2.3.2 affected, fixed version not confirmed. - NVD — CVE-2026-81093 / GHSA-m28f-9v8h-gg2f — Apify actors-mcp-server, CVSS 8.6/8.7, fixed 0.9.12. - NVD — CVE-2026-82456 / GHSA-rp45-5x3v-48mr — argocd-mcp, CVSS 10.0/10.0, affects 0.8.0, fixed 0.9.0.

2026-09-09 update sources: - GitHub Advisory Database — GHSA-g5r6-gv6m-f5jv (CVE-2026-73498, mcp-atlassian) — fetched directly: CVSS 7.7, affected < 0.22.0, fixed 0.22.0, confluence_upload_attachment path traversal. - VulnCheck — ArcadeDB information disclosure via get_server_settings (CVE-2026-67357 / GHSA-p9wc-4fhr-78wm) — fetched directly: CVSS 7.7, affected < 26.7.3, fixed 26.7.3. Cross-checked against the distinct sibling VulnCheck — ArcadeDB cluster token disclosure via GET /api/v1/server (CVE-2026-67343 / GHSA-46hj-24h4-j8gf) to confirm the two CVEs are separate endpoints, not a duplicate pairing. - NVD — CVE-2026-19956 — fetched directly via the NVD API: CVSS 3.1 6.3 / 4.0 5.3, CWE-918, fetch_pagination_url SSRF in facebook-ads-mcp-server 0.1.0, fixed via commit 4e53875 / PR #32. No GHSA filed; VulDB-sourced record. - Adversa AI — MCP security September 2026: Deadbugz + 3 server CVEs — surfaced all three CVEs in this update; each confirmed against a primary source rather than this roundup.

2026-09-12 update sources — all fetched directly from the GitHub Advisory Database: - GHSA-w3fx-mc44-mf6j (CVE-2026-45018, chainlit) — CVSS 9.8, /mcp argument-injection RCE, affected ≥2.4.0rc0 ≤2.11.1, fixed 2.12.0, 2026-08-25. - GHSA-xm98-3vcf-fph7 (CVE-2026-53710, mcp-contextforge-gateway) — CVSS 10.0, RestrictedPython bypass to subprocess.Popen, ≤1.0.1 → 1.0.2, 2026-08-24. - GHSA-rqfv-2mw9-78g2 (CVE-2026-59971, mysql-mcp-server) — CVSS 10.0, SSE no-auth/DNS-rebinding, ~25 exposed instances, <0.4.2 → 0.4.2, disclosed 2026-06-21 / reviewed 2026-09-11. - GHSA-6g6r-q6gw-w8fg (CVE-2026-55536, PraisonAI) — CVSS 9.1, re.match() origin-validation bypass (patch bypass of CVE-2026-40289), <4.6.58 → 4.6.58. - GHSA-mw6r-2hvm-4rp2 (CVE-2026-55546, qwed-mcp) and GHSA-8vh3-g2qg-2h2c (CVE-2026-55640, nextcloud-mcp-server) and GHSA-93qj-5q5v-3c2h (pantheon-agents trojanized PyPI) — the lower-relevance items noted above. independently against its own primary source above rather than taken from this aggregator summary.

2026-09-13 update sources: - Pillar Security — Valid but never issued: session spoofing and SSRF in Grafana MCP — fetched 2026-09-13; published 2026-09-02: both flaws, the chain to IMDSv2, the 1.9M-pull figure, and the Intigriti/Grafana timeline (08-02 report, 08-10 v1.1.0, 08-11 CVE, 08-12 Hall of Fame). - Grafana Labs — CVE-2026-19516: Grafana MCP server-side request forgery via X-Grafana-URL header — fetched 2026-09-13; vendor advisory: CVSS 9.1 vector, fixed ≥ 1.1.0, the "incomplete fix for CVE-2026-15583" statement. - NVD — CVE-2026-19516 — fetched via the NVD API 2026-09-13; published 2026-08-11, CWE-918, mcp-grafana ≤ 1.0.0, Grafana advisory as reference. - CSA Lab Space — Identity Confusion by Design: The Grafana MCP SSRF — fetched 2026-09-13; 2026-09-08 research note that surfaced the finding for this sweep; links Pillar as primary.

2026-09-14 update sources — all fetched 2026-09-14: - AWS Security Bulletin 2026-101 — CVE-2026-85787 (awslabs postgres-mcp-server), AWS Security Bulletin 2026-097 — CVE-2026-85654 (awslabs.dynamodb-mcp-server), AWS Security Bulletin 2026-103 — CVE-2026-85788 (awslabs mysql-mcp-server) — vendor bulletins: affected/fixed versions, least-privilege workarounds, reporter credits. - GitHub Advisory Database — GHSA-f4f4-39r8-8gj4 (CVE-2026-85787) and GHSA-hh4r-pcm9-jh93 (CVE-2026-85654) — CVSS 7.1, CWE-184 / CWE-1336. - NVD API records for CVE-2026-85787, CVE-2026-85788, CVE-2026-85654 — CNA AWS, publication dates, description text. - IBM Security Bulletin 7286052 — CVE-2026-18486, 7286055 — CVE-2026-77822, 7286053 — CVE-2026-18905, 7286056 — CVE-2026-18489 — IBM PSIRT bulletins, published 2026-09-02: CVSS vectors, affected/fixed versions, the credential-rotation list, the Translate "local single-session only" statement. - NVD API records for CVE-2026-18486, CVE-2026-18489, CVE-2026-77822, CVE-2026-18905 — CNA psirt@us.ibm.com, published 2026-09-04. - GitHub Advisory Database — GHSA-gx45-xrj5-g6c4 (CVE-2026-75911, CodeWhale allow_shell), GHSA-wrj3-vj8c-784f (CVE-2026-75858, rlm_eval auto-approval), GHSA-6v2g-fpxh-pmmh (CVE-2026-75856, DNS-pinning TOCTOU) — affected/fixed ranges, the deepseek-tui predecessor package, VinSOC Labs credit, 2026-07-16 disclosure vs 2026-09-04 database review. - NVD API records for CVE-2026-75911 and CVE-2026-75856 — CNA VulnCheck, CVSS 4.0 8.5 / 9.2, published 2026-08-18.

2026-09-15 update sources — all fetched 2026-09-15 (Bifrost's JFrog, NVD and release sources are in its own advisory): - VulnCheck — Casdoor through 4.4.0 cross-organization user administration via /api/mcp (CVE-2026-91998) — CNA advisory: CVSS 9.4, through 4.4.0, no fixed version, credit George Chen. - NVD — CVE-2026-91998 — published 2026-09-15, CVSS 3.1 9.9 / 4.0 9.4, CWE-863, references to authz/authz.go, mcpself/user.go, routers/base.go at v4.4.0. - George Chen — Casdoor findings (geo-chen/oss) — researcher write-up: mechanism of all three findings, the 06-13 report / ~06-26 issue / deletion timeline. - GitHub Advisory Database — GHSA-jvmw-g7rg-x26f (CVE-2026-91998) — CVE-sourced copy, published 2026-09-15. - IBM Security Bulletin 7286834 — ContextForge MCP Gateway is affected by use of default credentials (CVE-2026-78573) — published 2026-09-09: v1.0.0 – v1.0.9 → v1.0.10, the three password settings to change. - GitHub Advisory Database — GHSA-87q9-x2gp-qchr (CVE-2026-78573) — CVSS 9.8, CWE-1392; the narrower 1.0.0 – 1.0.7 range noted above. - GitHub Advisory Database — GHSA-65h7-9wrw-629c (CVE-2026-59973, FrontMCP / mcp-from-openapi) — CVSS 8.5, bypass of GHSA-v6ph-xcq9-qxxj / CVE-2026-39885, fixed 1.5.0 / 2.5.0. - GitHub Advisory Database — GHSA-wcjj-9m6g-2fr2 (CVE-2026-59176, functype-mcp-server) — CVSS 7.8, set_functype_version alias / file: install, ≤ 1.4.3 → 1.4.4, fix commit c0d58ad. - GitHub Advisory Database — GHSA-629c-j52g-h978 (CVE-2026-88938, knowns) and NVD — CVE-2026-88938 — CNA VulnCheck, published 2026-09-10, code.find path confinement, through 0.33.0, CWE-22. The vendor advisory id these reference (GHSA-5cj9-fcqq-g2h7) returned 404 on 2026-09-15. - NVD — CVE-2026-64684 (rmcp custom headers leak to cross-origin redirect targets) — CNA GitHub, published 2026-09-16, CVSS 6.8, CWE-200, affected < 2.1.0, fixed 2.1.0; the description quoted in the 2026-09-18 update was taken from the NVD API record, and the advisory appears as GHSA-9g45-5xwm-f3wc in the mcp recency listing below (fetched 2026-09-18). - GitHub Advisory Database — advisories matching mcp, newest first — the recency listing that surfaced Casdoor, Bifrost, knowns, functype and FrontMCP this sweep; each confirmed against its own record above.

2026-09-20 update sources — all fetched 2026-09-20: - GitHub Advisory Database — GHSA-qg2g-g9w3-m5h8 (CVE-2026-58197, ToolHive) — CVSS 8.8 vector, < 0.30.1 → 0.30.1, the host.docker.internal / three-weakness description, PR and release references, vendor date 2026-07-28. - GitHub Advisory Database — GHSA-xwmw-prc4-v3cr (Obot OAuth DCR token theft), GHSA-jgh3-fggc-mcpm (Obot SSRF via remote MCP server URL), GHSA-pr6h-vr44-xq8j (Obot registry API readable without auth) — vendor advisories dated 2026-06-22, all fixed 0.23.0; CVSS 8.8 / 7.6 / 5.3, mechanisms and credits as quoted. - GitHub Advisory Database — GHSA-2qg4-97v5-72x5 (CVE-2026-92801, cc-connect) — CVSS 8.7, through 1.5.0, the Feishu card-callback allowlist bypass, issue #1852; chenhg5/cc-connect — project description, ~15.6K stars, v1.5.1-beta.1 newest tag, no advisory mention. - GitHub Advisory Database — GHSA-x6f2-qp26-2xrh (CVE-2026-94111, Tencent BrowserSkill) — CVSS 6.9, through 0.3.0, the 32-character a-p origin check, issue #273. - GitHub Advisory Database — GHSA-xvpp-2hfw-c93c (CVE-2026-93982, OpenPanel) — CVSS 4.8, CWE-532, commit bad75bdd, VulnCheck reference. - GitHub Advisory Database — GHSA-79wm-x847-7cvg (CVE-2026-73222, claude-code-templates) — CVSS 8.8, ≤ 1.29.2 → 1.29.4, the 0.0.0.0 / cross-origin / shell: true description, reporter and commit; npm time field for claude-code-templates (2026-09-20): 1.29.4 2026-07-14, 1.29.5 09-09, 1.29.6 09-17; weekly downloads 1,930 (2026-09-13 → 09-19, api.npmjs.org). - GitHub Advisory Database — GHSA-gvgj-r6pg-m42w (CVE-2026-84810, claude-skill-antivirus) — CVSS 7.1, CWE-693, the SKILL.md-only scanning description, issue #33, VulnCheck reference. - GitHub Advisory Database — advisories matching claude, newest first and matching agent, newest first — the listings that surfaced claude-code-templates, claude-skill-antivirus, cc-connect and BrowserSkill; none had appeared in any vendor tab or search query.