---
id: 2026-08-agent-framework-mcp-cve-batch
title: "August 2026 agent-framework and MCP-server CVE batch — Spring AI tool-authorization bypass, PyCharm's unauthenticated Jupyter MCP, Splunk MCP RCE, LangChain SitemapLoader SSRF, and an LLM proxy that trusts a header for identity"
date_disclosed: 2026-08-17
last_updated: 2026-09-20
severity: high
status: patched
ecosystems: [mcp, java, python, npm, self-hosted]
tools_affected: [Spring AI, JetBrains PyCharm, Splunk MCP Server, Splunk AI Toolkit, langchain-community, Headroom, Contentful MCP, chrome-devtools-mcp, mcp-router, ToolUniverse, Telnyx MCP server, UI-TARS-desktop, mcp-use, Apify actors-mcp-server, argocd-mcp, mcp-atlassian, ArcadeDB, facebook-ads-mcp-server, awslabs.postgres-mcp-server, awslabs.mysql-mcp-server, awslabs.dynamodb-mcp-server, IBM ContextForge MCP Gateway, CodeWhale, Bifrost, Casdoor, FrontMCP, mcp-from-openapi, functype-mcp-server, knowns, rmcp (official Rust MCP SDK), LightLLM, atomic-agents-stack, ToolHive, Obot, cc-connect, Tencent BrowserSkill, OpenPanel, claude-code-templates, claude-skill-antivirus]
tags: [cve, mcp, ssrf, authorization-bypass, rce, deserialization, prompt-injection, agent-frameworks]
---

## TL;DR

One week's worth of CVEs across the AI-agent and MCP-server surface, grouped because they repeat the same four mistakes rather than because they share an actor. Headline items:

- **Spring AI — CVE-2026-59318**: the per-request tool list Spring AI advertises to the model as a boundary **isn't fully enforced at dispatch**, so a tool *not made available to the current request* can still be invoked.
- **JetBrains PyCharm — CVE-2026-75060** (CVSS 8.4): the IDE **exposed Jupyter MCP tools with no authentication**, giving local code execution with no auth and no user interaction. Fixed in **2026.2.1**.
- **Splunk MCP Server app — CVE-2026-76404** (CVSS 9.1, critical): unsafe deserialization in credential management → OS command execution. Fixed in **1.2.1**, alongside **nine** Splunk AI Toolkit CVEs.
- **`langchain-community` — CVE-2026-72848** (CVSS 7.7): `SitemapLoader` applies `restrict_to_same_domain` only to leaf entries, so **nested sitemaps SSRF into internal addresses — and the response comes back inside the returned Documents**, making it a read-SSRF.
- **Headroom LLM proxy — CVE-2026-77776** (CVSS 9.3, critical): the proxy takes the memory owner from a **client-supplied `x-headroom-user-id` header** with no binding to the caller's credentials.

## What happened

### Spring AI — the advertised tool list is not the enforced one (2026-08-20/21)

**CVE-2026-59318 / GHSA-wmqr-wxf2-6449** (Moderate, CVSS 6.5, CWE-863). Spring AI presents a per-request tool list to the model as a boundary, but does not fully enforce it at dispatch — a tool that was **not made available to the current request** can nonetheless be invoked, which is privilege escalation whenever request-scoped tool sets are how you separate privilege levels. Affects Spring AI 2.0.0, 1.1.0–1.1.8, and 1.0.0–1.0.9; fixed in **2.0.1** for open source, with 2.0.0.1 / 1.1.9 / 1.0.10 as Enterprise-Support-only backports.

This is the **"decorator-as-documentation"** class this repo has tracked since [Semantic Kernel](2026-05-semantic-kernel-rce.md), now aimed at the request-scoped tool list rather than an SDK annotation. The general form: *anything a framework shows the model as a constraint must also be checked where the call is actually dispatched.* Telling the model about a limit is prompt engineering; enforcing it at dispatch is security.

Two siblings in the same batch:

- **CVE-2026-59279 / GHSA-2g9x-r8w8-qjff** (High, CVSS 7.5, CWE-770) — the MCP **Streamable HTTP server transport** (WebFlux and WebMvc) puts **no limit on retained sessions** and **requires no client authentication by default** → unauthenticated remote memory exhaustion. Another entry in this repo's standing ["MCP servers are unauthenticated network services by default"](2026-05-mcp-stdio-systemic-rce.md) pattern. Affects Spring AI 2.0.0; the GHSA page does not state a patched version.
- **CVE-2026-59308 / GHSA-h4jw-w55g-65gf** (Moderate, CVSS 4.2, CWE-668) — the **Semantic Cache** context hash doesn't isolate cached responses across different system prompts, so responses leak between unrelated contexts. Low CVSS, but for a multi-tenant deployment "another tenant's cached answer" is a data-isolation failure, not a caching quirk.

### JetBrains PyCharm — an IDE shipping an MCP surface with the auth step missing (2026-08-17)

**CVE-2026-75060 / GHSA-5686-8wvm-pm8w** (High, CVSS 8.4, **CWE-306 Missing Authentication for Critical Function**). PyCharm exposed **Jupyter MCP tools without authentication**, letting a local attacker execute arbitrary code with **no authentication and no user interaction**. Fixed in **PyCharm 2026.2.1**.

Same shape as the [Cline](2026-06-cline-cve-2026-44211-websocket-rce.md), [OpenCode](2026-01-opencode-localhost-rce.md), [Marimo](2026-04-marimo-notebook-rce.md), and [AutoJack/AutoGen Studio](2026-06-autojack-autogen-studio-mcp-rce.md) entries in this repo's localhost cluster — and a reminder that the MCP surface an IDE opens on your behalf is one you did not choose to run and probably do not know is listening.

### Splunk MCP Server — deserialization to OS command execution (2026-08-19)

**CVE-2026-76404 / GHSA-3v49-2fcm-3rcj** (Critical, CVSS 9.1), Splunk advisory **SVD-2026-0808**. The MCP Server app's credential-management component **deserializes stored data without type validation**; a user holding the Splunk `admin` role can supply or influence crafted serialized data and **execute arbitrary OS commands on the host**. Affects the Splunk MCP Server app **< 1.2.1**; fixed in **1.2.1**.

The same advisory batch carries **nine Splunk AI Toolkit CVEs** (CVE-2026-76391 … CVE-2026-76399, CVSS 4.3–8.8), fixed in **6.0.0 / 6.0.1** — including **CVE-2026-76395** (RCE via untrusted deserialization, 8.8), **CVE-2026-76391** and **CVE-2026-76394** (8.3, privilege management / missing authorization), and **CVE-2026-76397** / **CVE-2026-76399** (8.1, access control on experiment history and searches).

Authentication as `admin` is required for CVE-2026-76404, which lowers standalone urgency — but note the composition risk this repo keeps flagging: an MCP server is precisely the component an agent drives on your behalf, so "requires admin" means "requires the privilege the agent is probably already running with."

### langchain-community — SitemapLoader read-SSRF (2026-08-21)

**CVE-2026-72848 / GHSA-vg8m-4p2q-gcjh** (High, CVSS 7.7, CWE-918). `SitemapLoader.parse_sitemap` applies the documented **`restrict_to_same_domain` control only to leaf `url` entries** — nested sitemap `loc` values go straight through to `scrape_all([loc.text], "xml")` unchecked. Anyone who controls or influences an ingested sitemap can steer the server at loopback, link-local, or RFC1918 addresses.

The aggravating detail: **the fetched content is returned inside the resulting Documents**, so this is a **read**-SSRF, not a blind one — cloud metadata, internal admin pages, and anything else reachable comes back into the pipeline (and, in a RAG setup, quite possibly into a model's context and then a user's answer). The GHSA page does not state affected or patched version ranges, so **check `langchain-community` against the advisory directly rather than assuming a version is clean**.

Same root shape as [MLflow CVE-2026-64849](2026-08-mlflow-webhook-ssrf-authz-batch.md): an SSRF guard that covers the obvious path and not the indirection one hop away.

### Headroom LLM proxy — a header is not an identity (2026-08-21)

Two flaws in an LLM proxy, both amplified by a reference Docker Compose that **binds `0.0.0.0` with no auth**:

- **CVE-2026-77776 / GHSA-5vg3-c628-vf56** (Critical, CVSS 9.3) — the proxy derives the memory owner from the **client-supplied `x-headroom-user-id` header** without binding it to the caller's credentials (`headroom/proxy/handlers/openai.py`, chat-completion and WebSocket endpoints) → **cross-user impersonation and access to other users' agent memory**.
- **CVE-2026-77775 / GHSA-4j5r-9p93-j2px** (High, CVSS 7.7, CWE-918) — clients choose the upstream via **`x-headroom-base-url`**; validation covers only scheme and hostname, so loopback, link-local, and RFC1918 destinations are reachable, responses are relayed back, and **`Authorization` headers are forwarded unchanged to the attacker-chosen host**. That last clause is the serious part: it hands your upstream LLM provider key to whatever host the caller names.

Neither GHSA page states affected or patched versions. This is a textbook instance of this repo's **"central credentials cache"** framing — an LLM proxy holds every upstream provider key for an org, so one header-trust bug is the union of every provider's API surface.

### Also this window — MCP advisories entering the GHSA database

A cluster of MCP-server advisories was **published to the GitHub Advisory Database between 2026-08-14 and 2026-08-19**, but for several the *original* disclosure was **June 2026** — the recent date is database ingestion, not discovery. Worth knowing so you don't read them as a fresh wave:

- **`@contentful/mcp-server` < 1.7.19 / `@contentful/mcp-tools` < 0.4.5 — CVE-2026-53957 / GHSA-2xhg-73j7-rrgx** (CVSS 7.7). `export_space` / `import_space` pass **LLM-controlled `host` and `proxy` arguments** straight to the Contentful Management API client, so a prompt injection redirects the request — **and the server's Personal Access Token** — to an attacker endpoint. DB-published 2026-08-19; originally 2026-06-12.
- **`chrome-devtools-mcp` ≥ 0.24.0, ≤ 1.0.1 — CVE-2026-53766 / GHSA-8qf9-62x2-82pp** (CVSS 6.1), patched **1.1.0**. `validatePath()` uses `path.resolve()` instead of `fs.realpath()`, so a **symlink that textually sits inside the workspace root escapes it**, bypassing the MCP `roots` capability model. Notable because it is **Google's own MCP server**. DB-published 2026-08-17; originally 2026-06-16.
- **`claude-faf-mcp` ≤ 5.7.1**, patched **5.7.2** — **GHSA-rr55-jp92-8wp2** (CVSS 7.5, no CVE): arbitrary local file read/write via an unconfined `path` argument accepting absolute paths and `../`. The advisory **explicitly names prompt injection as the exploitation path** (SSH keys, cloud credentials). Sibling advisories exist for `faf-mcp` (GHSA-j4r7-8ph4-43g3) and `grok-faf-mcp` (GHSA-cc2g-gq8c-r332).

`@ooples/token-optimizer-mcp` **CVE-2026-55157** also entered the database on 2026-08-14; it is already tracked in [the systemic MCP advisory](2026-05-mcp-stdio-systemic-rce.md).

### Update 2026-08-30 — a second week, same four mistakes: seven more MCP servers bind every interface with optional-at-best auth (2026-08-22 to 2026-08-29)

A researcher/scanning effort surfaced via VulnCheck (each confirmed directly on NVD for this update) found **seven more MCP-adjacent servers** shipping the exact "**listens on `0.0.0.0`/`::` by default, authentication is opt-in**" pattern this advisory already names as mistake #2 — none share an actor or a codebase; they repeat the same default because it's the path of least resistance for an MCP server author, not because anyone copied anyone:

- **`mcp-router` CLI — CVE-2026-81094 / GHSA-rx55-5c7h-r56r** (CVSS 3.1 9.1 critical, CVSS 4.0 9.3). The `serve` command (`apps/cli/src/commands/serve.ts`) defaulted its host to the all-interfaces address and required a caller token **only if the operator passed the flag for it** — a default invocation exposed the aggregator, and every MCP server it fronts, to the network. Affects **< 0.6.3**; fixed in **0.6.3**.
- **ToolUniverse — CVE-2026-81096 / GHSA-pxwq-22vf-87fm** (CVSS 3.1 10.0 critical). The `python_code_executor` tool's sandbox (`python_executor_tool.py`) denylisted specific attribute names/calls but left attribute-lookup builtins reachable via a string-based dunder lookup, and the server itself required no authentication — **unauthenticated sandbox escape to arbitrary code execution**. Affects **≤ 1.2.6**; the GHSA page returned 404 to direct fetch during this sweep, so no fixed version is confirmed here — check the upstream repo directly.
- **Telnyx MCP server — CVE-2026-81098 / GHSA-46jp-xr2h-fw7h** (CVSS 3.1 9.1 critical). `packages/mcp-server/src/http.ts` bound the Streamable HTTP transport to every interface and parsed caller auth headers in a mode that **didn't fail when they were absent** — a request with no credential completed initialization and dispatched tools. Affects **≤ 6.83.0**; fixed version not confirmed (GHSA page 404'd to direct fetch).
- **UI-TARS-desktop (`mcp-http-server` / `@agent-infra/mcp-server-*`) — CVE-2026-81735 / GHSA not confirmed** (CVSS 3.1 10.0 critical, CVSS 4.0 10.0). `startServer.ts` defaulted its listen address to `::` (every interface) when no host was given, and its auth middleware was **opt-in — applied only when a caller supplied it**, exposing arbitrary command execution. Fixed by [PR #1918](https://github.com/bytedance/UI-TARS-desktop/pull/1918) ("default host to 127.0.0.1, not all interfaces"), merged 2026-07-01 at commit `c2ad42e`; no released package version number is stated in the PR itself, so confirm your installed version postdates that commit rather than assuming a version number.
- **`mcp-use` Inspector proxy — CVE-2026-81091 / GHSA-f2jg-rm2x-hc5p** (CVSS 3.1 8.6 high). `mountMcpProxy` (`libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts`) read a proxy target from an `X-Target-URL` header or `__mcp_target` parameter and forwarded to it **without inspecting the host** — loopback, link-local, and RFC1918 destinations all accepted. Affects **≤ 2.3.2**; fixed version not confirmed (GHSA page 404'd to direct fetch).
- **Apify `actors-mcp-server` — CVE-2026-81093 / GHSA-m28f-9v8h-gg2f** (CVSS 3.1 8.6 high). The `get-html-skeleton` tool's URL validator (`isValidHttpUrl`) checked only that the input parsed as an `http(s)` URL, never the resolved host — the same read-SSRF-via-agent-tool shape as `langchain-community`'s `SitemapLoader` above, in a different codebase. Affects **< 0.9.12**; fixed in **0.9.12**.
- **`argocd-mcp` — CVE-2026-82456 / GHSA-rp45-5x3v-48mr** (CVSS 3.1 10.0 critical, CVSS 4.0 10.0). Binds its HTTP transport to every interface and, when `ARGOCD_API_TOKEN` is configured, **accepts MCP sessions without requiring a caller credential** — full tool surface (create applications, trigger syncs, modify resources) reachable by anyone who can reach the listener, using the operator's own stored token. Affects **0.8.0**; fixed in **0.9.0**.

All seven were confirmed directly against NVD for this update (published 2026-08-22 through 2026-08-29); each carries a vendor-repo GHSA cross-reference. **Running tally for this repo's "MCP servers are unauthenticated network services by default" pattern:** two batches, roughly three weeks apart, thirteen distinct MCP-adjacent projects, the same two defaults (bind-all-interfaces, auth-is-opt-in) in nearly every one.

### Update 2026-09-09 — three more single-server MCP CVEs, none sharing an actor

Three unrelated MCP-server CVEs surfaced this window, each confirmed against a primary source (NVD, VulnCheck, or the GitHub Advisory Database directly) rather than an aggregator paraphrase:

- **`mcp-atlassian` — CVE-2026-73498 / GHSA-g5r6-gv6m-f5jv** (CVSS 7.7, High). The `confluence_upload_attachment` function passes a client-supplied `file_path` straight to `open(file_path, "rb")` with no call to the codebase's own `validate_safe_path()` — a path-traversal that lets an authenticated MCP client, or an agent steered by indirect prompt injection, read and exfiltrate any file the server process can access (including environment variables such as `CONFLUENCE_API_TOKEN`). Affects **< 0.22.0**; fixed in **0.22.0**. Same "an SSRF/path guard exists elsewhere in the codebase but wasn't applied here" shape already tracked above for `chrome-devtools-mcp` and LangChain's `SitemapLoader`.
- **ArcadeDB — CVE-2026-67357 / GHSA-p9wc-4fhr-78wm** (CVSS 7.7, High). The MCP `get_server_settings` tool returns `arcadedb.ha.clusterToken` in cleartext; a client with MCP access can retrieve it and replay it via the `X-ArcadeDB-Cluster-Token` / `X-ArcadeDB-Forwarded-User` headers to impersonate root and take full administrative control. Affects **< 26.7.3**; fixed in **26.7.3**. **Do not confuse this with the sibling `CVE-2026-67343` / `GHSA-46hj-24h4-j8gf`** (CVSS 8.7) — a related but distinct cleartext-cluster-token disclosure in ArcadeDB's plain `GET /api/v1/server` REST endpoint (not the MCP tool), fixed one version earlier in **26.7.2**. Both leak the same token via different endpoints; an operator patching only one has not closed the other.
- **`facebook-ads-mcp-server` (gomarble-ai) — CVE-2026-19956** (CVSS 3.1: 6.3 Medium / CVSS 4.0: 5.3 Medium, CWE-918 SSRF). The `fetch_pagination_url` function in `server.py` forwards a pagination URL without validating its host, allowing an authenticated caller to drive SSRF from the server's network position. Affects **0.1.0**; fixed via [commit `4e53875`](https://github.com/gomarble-ai/facebook-ads-mcp-server/commit/4e53875aa22e8991c2fa4a7660d86e1caba66659) / [PR #32](https://github.com/gomarble-ai/facebook-ads-mcp-server/pull/32). No GHSA has been filed — this record is VulDB-sourced and confirmed only against NVD; noted here rather than given its own file per this repo's low-value-single-CVE threshold.

### Update 2026-09-12 — critical MCP-server RCEs entering the GHSA database, same two defaults again (and one that is command-injection, not misconfig)

The GitHub Advisory Database's reviewed-critical listing published a fresh batch of MCP-server CVEs in early September; per this repo's standing caution, a **GHSA database-publication date is not a disclosure date**, and most of these were originally disclosed in June–August, so they are dated by original disclosure below. All were fetched from their GHSA pages directly.

- **`chainlit` — CVE-2026-45018 / GHSA-w3fx-mc44-mf6j** (CVSS 9.8). With MCP enabled, the `/mcp` endpoint's `validate_mcp_command()` allowlists only the *executable name* and never inspects arguments, so `npx -y -c '<command>'` reaches a shell — unauthenticated RCE for any client with a session. Affects **≥ 2.4.0rc0, ≤ 2.11.1**; fixed **2.12.0** (2026-08-25). Chainlit is a common vibe-coding chat-UI framework; disable MCP (`features.mcp.enabled = false`) if you cannot upgrade.
- **`mcp-contextforge-gateway` — CVE-2026-53710 / GHSA-xm98-3vcf-fph7** (CVSS **10.0**). RestrictedPython sandbox bypass in `python_sandbox_server`: raw `getattr` in `safe_builtins` plus runtime-constructed dunder names lets an attacker on the HTTP/SSE transport walk to `subprocess.Popen` and execute commands. Affects **≤ 1.0.1**; fixed **1.0.2** (2026-08-24). This is the same IBM ContextForge gateway family already tracked in [the MCP stdio systemic-RCE advisory](2026-05-mcp-stdio-systemic-rce.md) — a distinct new sandbox-bypass CVE, not the earlier finding.
- **`mysql-mcp-server` — CVE-2026-59971 / GHSA-rqfv-2mw9-78g2** (CVSS **10.0**). In SSE mode the server sets no `security_settings`, so DNS-rebinding protection defaults off, there is no CORS/TrustedHost middleware, routes are unauthenticated, and it binds `0.0.0.0` — unauthenticated SQL execution (and file R/W / RCE via MySQL FILE). ~25 instances were found publicly exposed. Affects **< 0.4.2**; fixed **0.4.2** (disclosed 2026-06-21, reviewed into the advisory database 2026-09-11). The exact bind-all-interfaces / auth-optional pattern this advisory has now tracked across ~20 MCP projects.
- **`PraisonAI` — CVE-2026-55536 / GHSA-6g6r-q6gw-w8fg** (CVSS 9.1). A patch bypass of CVE-2026-40289: the browser server validates the WebSocket `Origin` with `re.match()` (anchored only at the start), so `chrome-extension://<32 chars><extra>` passes and an attacker drives browser automation, exfiltrates cookies, and screenshots authenticated sessions. Affects **< 4.6.58**; fixed **4.6.58**. Folds into this repo's existing [PraisonAI advisory](2026-05-praisonai-auth-bypass.md) thematically but is logged here with the MCP/agent-server batch; the fix replaces `re.match()` with `re.fullmatch()`.
- **Also reviewed into the advisory database this window (older disclosures, lower vibe-relevance, noted not detailed):** `qwed-mcp` CVE-2026-55546 (SymPy `parse_expr()` RCE, fixed 0.2.1), `nextcloud-mcp-server` CVE-2026-55640 (unauthenticated webhook when `WEBHOOK_SECRET` unset, fixed 0.117.2), and the trojanized **`pantheon-agents`** PyPI package (0.6.1/0.6.2, June 2026 maintainer-token compromise, `.pth` Bun credential-stealer) — the last is a supply-chain compromise rather than a code-level MCP CVE.

**Running tally:** across the three batches this file now tracks (August, 2026-08-30, and this one), the "an MCP server is an unauthenticated network service by default, and the guard that exists elsewhere in the codebase wasn't applied here" pattern holds in nearly every case; the chainlit and contextforge entries add unsandboxed-command-execution as a second recurring root cause alongside missing origin/host validation.

**Update 2026-09-13 — Grafana's official MCP server: an unauthenticated session-spoof chained into a CVSS 9.1 SSRF that reaches the cloud metadata service (CVE-2026-19516, fixed 1.1.0).** Pillar Security (Ariel Fogel et al., published 2026-09-02) found two flaws in `mcp-grafana` — Grafana Labs' own MCP server, which Pillar counts at over 1.9M cumulative Docker Hub pulls — that combine into one unauthenticated path to the internal network:

- **Session spoofing (no CVE).** The server validated the *format* of an MCP session id rather than whether it had issued it, so a remote caller could mint its own session id locally and invoke tools with the **server's Grafana service-account token**. Session ids are state references, not credentials — the exact mistake the [DeepSeek Harness](2026-09-deepseek-harness-host-header-sandbox-escape.md) and [NemoClaw](2026-08-nvidia-nemoclaw-openshell-cve-batch.md) findings make with `Host` headers.
- **CVE-2026-19516** (Grafana-assigned CVSS 3.1 **9.1**, `AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L`, CWE-918; published 2026-08-11). The `grafana_api_request` tool honoured a caller-supplied **`X-Grafana-URL`** header for its outbound destination, method, path, body and headers. Grafana's advisory states this is an **incomplete fix for CVE-2026-15583**: the earlier patch stopped the token leaking to foreign hosts but never restricted the destination, so the server still executed the request and returned the response — "a readable, method-capable proxy from its own network location," in Pillar's words — reaching loopback, private ranges and **AWS IMDSv2** credentials. The vector says `PR:L`; the session-spoof supplies the "L".

Timeline per Pillar: reported via Intigriti 2026-08-02; **v1.1.0 released 2026-08-10** with the SSRF fix and *optional* bearer-token authentication (401 for unauthenticated requests, plus a logged warning when the server binds beyond loopback); CVE published 2026-08-11. "Optional" is the word to notice — an upgraded server that never sets the token is still unauthenticated. Affected **≤ 1.0.0**. CSA's 2026-09-08 research note on the finding titles it "identity confusion by design": the MCP server acts with its own service-account identity on behalf of any caller it cannot tell apart. Fifth entry in this file where the fix note reads "added authentication (optional)".

**Update 2026-09-14 — three vendor-bulletin batches: AWS's official database MCP servers (read-only gates that weren't), four more IBM ContextForge CVEs, and a coding agent whose repo config could switch on its shell tool.** All confirmed against the vendor bulletin or NVD record, not an aggregator.

*AWS Labs MCP servers (AWS Security Bulletins 2026-097, 2026-101, 2026-103; CNA AWS):*
- **`awslabs.postgres-mcp-server` — CVE-2026-85787** (CVSS 4.0 **7.1**, CWE-184). The SQL validation blocklist that enforces read-only mode was incomplete: crafted SQL placed in content an authenticated user submits to the MCP server could modify data "beyond the read-only scope." Affects **< 1.1.7**; fixed **1.1.7** (2026-09-04). AWS's own workaround is the real fix — run the server as a minimal Postgres role with only `CONNECT`/`USAGE`/`SELECT`, never a superuser or master user. Reporter: Ashwak N.
- **`awslabs.mysql-mcp-server` — CVE-2026-85788** (CVSS 5.7). The mutable-SQL detector missed SQL **inline comments** that the regex did not treat as whitespace, letting statements bypass the read-only gate and reach file-read/file-write SQL sinks. Affects **≤ 1.0.21**; fixed **1.0.23** (2026-09-09). Same advice: no `FILE` privilege on the database user. Reporter: Jaeyoung Yun.
- **`awslabs.dynamodb-mcp-server` — CVE-2026-85654** (CVSS 4.0 **7.1**, CWE-1336 template injection). The **CDK generator** — the tool that turns a data-model JSON into deployable infrastructure code — did not neutralise table, index, or attribute names, so a crafted `dynamodb_data_model.json` executes arbitrary code on the host that runs the generator. Affects **2.0.10 – 2.1.5**; fixed **2.1.6** (2026-09-04). Local vector, but the data-model file is exactly the artifact an agent writes from an untrusted spec. Reporter: Jaimen Bell.
  Pattern note: two of the three are "the read-only mode is a regex" — the guard is a denylist over SQL text, and the model (or a prompt-injected model) writes the SQL. Prefer database-side privileges to server-side string filtering, as AWS's own bulletins recommend.

*IBM ContextForge MCP Gateway (IBM PSIRT bulletins, published 2026-09-02; NVD 2026-09-04)* — four CVEs, distinct from the CVSS 10.0 RestrictedPython bypass (CVE-2026-53710) logged in the 2026-09-12 update:
- **CVE-2026-18486** (CVSS 3.1 **8.8**): unrestricted **jq filters** let an authenticated developer call built-ins like `$ENV` and read environment variables holding "cryptographic keys and database credentials that can be leveraged to forge administrator tokens." Affects **≤ 1.0.7**; fixed **1.0.8**. IBM's remediation includes running the re-encryption migration and **rotating `JWT_SECRET_KEY`, `AUTH_ENCRYPTION_SECRET`, `DATABASE_URL`, `REDIS_URL`, `BASIC_AUTH_PASSWORD`** — no workaround.
- **CVE-2026-77822** (CVSS **8.2**): SSRF via DNS rebinding in the **A2A agent invocation** path — the resolved IP is not pinned at connection time. Affects **≤ 1.0.8**; fixed **1.0.9**.
- **CVE-2026-18905** (CVSS **7.7**): DNS-rebinding TOCTOU — URL validation runs at tool *registration*, not invocation, so a low-privilege user changes the DNS record afterwards and redirects outbound gateway requests to internal targets. Affects **≤ 1.0.6**; fixed **1.0.7**.
- **CVE-2026-18489** (CVSS **7.1**, CWE-488): the **Translate** utility with `--enable-dynamic-env` could execute a second client's request under the first client's credential-derived environment. Affects **≤ 1.0.8**; IBM's "fix" (PR #6388) is documentation stating Translate is for local single-session development only — if you run it multi-client, stop, rotate, audit.
  Six ContextForge CVEs across two files in three weeks; IBM's bulletin pages (`ibm.com/support/pages/node/<id>`) are the record, per this repo's corporate-parent rule.

*CodeWhale (Hmbown/CodeWhale, a terminal coding agent for open-weight models; VulnCheck CNA; disclosed 2026-07-16, database-reviewed 2026-09-04):*
- **CVE-2026-75911** (CVSS 4.0 **8.5**): a repo-committed `.codewhale/config.toml` could set `allow_shell = true`, which the agent applied silently, enabling its `exec_shell`/`task_shell` tools with no prompt. `approval_policy` and `sandbox_mode` had tightening-only guards; `allow_shell` did not. Affects **0.8.41 – 0.8.63**; fixed **0.8.64**. Same class as [aider's `.aider.conf.yml`](2026-09-aider-conf-yml-command-execution.md): a project config file the attacker wrote is trusted as if the user wrote it. Reported by VinSOC Labs.
- **CVE-2026-75858** (CVSS **8.5**): the `rlm_eval` tool executed model-supplied Python and returned `ApprovalRequirement::Auto`, which the engine treats as never-prompt — unsandboxed code execution from any prompt injection. Same affected/fixed range (plus the older `deepseek-tui` package name it was forked from, 0.8.33 – 0.8.40).
- **CVE-2026-75856** (CVSS **9.2**): SSRF-guard DNS-pinning TOCTOU — a DNS server that fails the first resolution and answers the second with `127.0.0.1` reaches local services and cloud metadata. Same range; fixed 0.8.64.

**Update 2026-09-15 — a fourth week: an unauthenticated-by-default AI gateway (Bifrost, 9.8), an IAM server whose MCP endpoint skips authorization (Casdoor, 9.9/9.4, unpatched), default credentials in ContextForge (9.8), and three more June disclosures reviewed into the database.** All fetched from the primary advisory or the CNA record, not an aggregator.

- **Bifrost — CVE-2026-90898** (CVSS 3.1 **9.8**, CNA JFrog, 2026-09-14). One unauthenticated `POST /api/mcp/client` registers a stdio MCP client, which the gateway starts immediately — code execution as the gateway process whenever `governance.auth_config.is_enabled=false`, the shipped default. Fixed **transports/v2.1.0** (2026-09-08). Written up on its own: [Bifrost — unauthenticated MCP client registration RCE](2026-09-bifrost-mcp-client-registration-unauth-rce.md).
- **Casdoor — CVE-2026-91998** (CVSS 3.1 **9.9** / 4.0 **9.4**, CNA VulnCheck, published 2026-09-15; CWE-863). Casdoor is an open-source IAM / SSO server. Its **`/api/mcp`** endpoint resolves any request carrying *any* application's OAuth `clientId`/`clientSecret` to an `app/<name>` subject that hits an unconditional global allow, skipping the Casbin policy and organization scoping. Whoever holds one application's credentials can enumerate users (password salts and emails included), create administrators, and modify or delete users **in every organization**. Affects **through 4.4.0**; **no fixed version** as of 2026-09-15. The researcher (George Chen) reports emailing the project on 2026-06-13, opening GitHub issues around 2026-06-26 after no response, and the issues being deleted; the same write-up carries two further unpatched findings (unauthenticated file upload; organization admins reading the global JWT signing key). If your app's auth server is Casdoor, treat every application credential as an admin credential until a fix ships, and keep `/api/mcp` off the internet.
- **IBM ContextForge MCP Gateway — CVE-2026-78573** (CVSS **9.8**, CWE-1392 use of default credentials; IBM bulletin 7286834 published 2026-09-09, NVD 2026-09-10). The gateway ships with known default values for `platform_admin_password`, `default_user_password` and `basic_auth_password`, so remote attackers obtain administrative access. IBM's bulletin says **v1.0.0 through v1.0.9, fixed v1.0.10**; the GitHub Advisory Database copy says 1.0.0 – 1.0.7 — prefer IBM's range. Set all three to strong values before enabling authentication features. Seventh ContextForge CVE in this file.
- **FrontMCP / mcp-from-openapi — CVE-2026-59973** (CVSS 8.5; vendor advisory 2026-06-22, database-reviewed 2026-09-11). A **bypass of the earlier SSRF fix** (CVE-2026-39885) for external OpenAPI `$ref` resolution: the hostname denylist still admitted loopback and private targets via DNS names resolving to loopback, redirect chains and IPv4-mapped IPv6. `@frontmcp/adapters` and `frontmcp` ≥ 1.2.1 < 1.5.0 → **1.5.0**; `mcp-from-openapi` ≥ 2.3.0 < 2.5.0 → **2.5.0**.
- **functype-mcp-server — CVE-2026-59176** (CVSS 7.8; 2026-06-20, database-reviewed 2026-09-09). The `set_functype_version` tool interpolates an unvalidated version string into `pnpm add functype@<version>`; npm alias and `file:` syntax install an attacker-chosen package which the server then dynamically imports. **≤ 1.4.3 → 1.4.4**. A package-manager invocation with model-supplied arguments is the same primitive as the "install a dependency" tool in every coding agent.
- **knowns — CVE-2026-88938** (CVSS 4.0 7.1 / 3.1 6.5, CNA VulnCheck, 2026-09-10), plus two siblings the database lists for the same project (**CVE-2026-86541**, `handleCodeReplace` path traversal; **CVE-2026-86439**, MCP tool path validation; both 2026-09-08, not fetched individually). `knowns` (knowns-dev/knowns) is a Go MCP server that gives AI agents project context; its `code.find` tool did not confine the path argument to the project root, so agent sessions read any file on the host. Affects **through 0.33.0**; no fixed version on the CNA record as of this date.

Bifrost and Casdoor are the two ends of this file's pattern: one ships with authentication off, the other has authentication on but exempts the MCP route from authorization. An `/api/mcp` or `/api/mcp/client` route is a control plane and needs the same gate as the admin UI.

**Update 2026-09-16 — two more unauthenticated-RCE agent-infra servers reviewed into the database (LightLLM, atomic-agents-stack), both VulnCheck CNA.**

- **LightLLM — CVE-2026-90919** (CVSS 4.0 **9.3**, VulnCheck, published 2026-09-14). LightLLM (ModelTC, a high-performance LLM inference/serving framework) exposes an **unauthenticated `/visual_register` WebSocket endpoint on its Config Server that passes the first client frame straight to `pickle.loads()`** — send a serialized payload with a `__reduce__` method and get code execution as the Config Server process. Affects **through 1.2.0**; the CNA record lists no fixed version as of this date, so treat it as **unpatched** and keep the Config Server port off any untrusted network. Pickle-over-the-wire is the same primitive as the [LangGraph msgpack chain](2026-06-langgraph-rce-chain.md) and the NLTK/`unstructured` pickle findings — a "load this object" endpoint is a "run this code" endpoint.
- **atomic-agents-stack — CVE-2026-91988** (CVSS 4.0 **9.2**, VulnCheck, published 2026-09-15). The HTTP MCP **server-registry backend factory accepts cleartext `http://` schemes**, so a network man-in-the-middle rewrites the catalog response and injects command/argument values that `MCPClientPool` spawns as local subprocesses — RCE on the agent host. Affects **before 1.1.0**; fixed **1.1.0**. This is the MITM-on-the-registry cousin of the [Coder registry compromise](2026-09-coder-registry-cloudflare-terraform-supply-chain.md): when the thing that tells your agent *which* MCP servers to run is fetched over plaintext, whoever sits on the wire chooses the command.

**Update 2026-09-17 — the official Rust MCP SDK (`rmcp`): a client-side OAuth token-theft bug and an unauthenticated session-table leak, both fixed in 2.0.0 (CVE-2026-63127 / CVE-2026-63128, published 2026-09-16).** `rmcp` is the Model Context Protocol organisation's Rust SDK — the library behind Rust-built MCP servers *and clients*. Two GitHub-reviewed advisories landed on 2026-09-16, both fetched directly:

- **CVE-2026-63127 / GHSA-33f5-2c5q-wgwj** (CVSS **8.2**, High). The OAuth Protected Resource Metadata discovery in rmcp's *client* never validated the **`resource`** field RFC 9728 requires it to check ("the client MUST ensure that the resource identifier URL it is using as the prefix for the metadata request exactly matches the `resource` value in the returned metadata document") — the `ResourceServerMetadata` struct had no such field at all. A **malicious MCP server** can therefore serve metadata that names a *legitimate* server's authorization server; the user's OAuth flow runs against the real provider, and the resulting **access token, valid for the legitimate MCP server, is returned to the attacker's**. Every rmcp-based client talking to OAuth-protected MCP servers is exposed; the fix is "full account impersonation on the legitimate server" territory. Affects **< 2.0.0**; fixed **2.0.0**. This is the client-side mirror of the [rmcp DNS-rebinding server bug](https://github.com/advisories/GHSA-89vp-x53w-74fx) (CVE-2026-42559, 2026-05-06, High) the advisory database also lists for this crate, which this repo had not logged — and a reminder that "connect to this MCP server" is an authorization decision even when the server is only *pretending* to be someone else's.
- **CVE-2026-63128 / GHSA-9pj6-vhgr-3mwh** (CVSS **7.5**, High). The Streamable HTTP *server* transport allocated a session and spawned a worker **before** validating the request body, then returned 422 for any non-`InitializeRequest` without cleaning up — so an unauthenticated client leaks one ~400–550-byte session-table entry per request, permanently. The reporter sustained 2,100 requests/second from one Python client, i.e. tens of gigabytes a day, plus lock contention on the session manager's `RwLock` for legitimate clients. Affects **< 2.0.0**; fixed **2.0.0**.

Rust MCP servers are a small share of the ecosystem, but the SDK-level pattern is the one to carry: an MCP *client* has its own trust decisions (which authorization server, which resource) that a hostile server can steer, and a transport that "accepts a connection then checks" is a resource-exhaustion primitive. Upgrade `rmcp` to **≥ 2.0.0** on both sides.

**Update 2026-09-18 — a third rmcp client bug, and the fix line moves to 2.1.0: custom headers (API keys) follow a cross-origin redirect (CVE-2026-64684 / GHSA-9g45-5xwm-f3wc, CVSS 6.8, published 2026-09-16).** `StreamableHttpClientTransport` built its default `reqwest` client with automatic redirects on and applied `StreamableHttpClientTransportConfig.custom_headers` without marking them sensitive, so "when a malicious or compromised MCP endpoint returns a cross-origin 307 or 308 redirect, reqwest follows the redirect and `apply_custom_headers` causes custom API keys or authentication tokens to be replayed to the new origin, where an attacker can capture and reuse them" (NVD, CNA GitHub). The separate `auth_header` path was not affected. Affects **< 2.1.0**; fixed **2.1.0** (rust-sdk PR 936, commit `496902b9…`). Same shape as the Clerk proxy SSRF and the LiteLLM credential-forwarding bugs elsewhere in this repo: a client that forwards a secret to wherever the server points it. Combined with the two 2026-09-16 advisories above, every rmcp *client* built before 2.1.0 has a token-theft path that a hostile MCP server can trigger; upgrade to **≥ 2.1.0** and, where you control the transport config, disable redirect-following or set headers as sensitive.

### Update 2026-09-20 — the MCP *runtime* layer joins the list (ToolHive containers reach the host, Obot's OAuth mints over-scoped tokens), plus three Claude-Code-ecosystem tools no vendor tab will ever show you

Six items from the `mcp` recency listing and the `?query=claude` / `?query=agent` database queries, three of them entering the database weeks or months after their vendor dates:

- **ToolHive — containerised MCP servers reach host-local services via `host.docker.internal` (CVE-2026-58197 / GHSA-qg2g-g9w3-m5h8, CVSS 8.8 `AV:A/AC:L/PR:N/UI:R/S:C`, vendor advisory 2026-07-28, database 2026-09-18).** Stacklok's ToolHive is the "run every MCP server in its own container" runtime this repo's [MCP hygiene guide](../prevention/mcp-hygiene.md) is the shape of. Its advisory: "A containerized MCP server running with the default network permission profile can reach host-local services via `host.docker.internal`. This includes the ToolHive API itself, other ToolHive-managed MCP server proxies" — and any self-hosted model or service bound to the host. Three weaknesses stacked: insecure-by-default networking, unauthenticated API endpoints, and Docker's built-in DNS name for the host — no container escape needed. A malicious MCP server in one container can enumerate and call the *native* MCP tools ToolHive manages with elevated privileges, poke the control plane, and exfiltrate through other servers. Affects **< 0.30.1**; fixed **0.30.1** (PRs stacklok/toolhive#5583, toolhive-studio#2469). The lesson is the one the whole batch keeps teaching, one layer down: the isolation product's *default profile* is the boundary, and it was open.
- **Obot (obot-platform/obot, Go — an MCP gateway/registry platform) — three vendor advisories dated 2026-06-22, GitHub-reviewed 2026-09-18, all fixed 0.23.0, no CVEs.** [GHSA-xwmw-prc4-v3cr](https://github.com/advisories/GHSA-xwmw-prc4-v3cr) (**8.8**): OAuth **Dynamic Client Registration accepted unauthenticated clients with arbitrary redirect URIs**, the authorization flow auto-completed with no consent screen for a logged-in victim who clicked a crafted link, and the token issued "contained the victim's full group permissions rather than being scoped to just the requested MCP server" — API access to everything the victim could reach (credit EQSTLab; the fix adds a consent screen, per-MCP token scope and audience validation). [GHSA-jgh3-fggc-mcpm](https://github.com/advisories/GHSA-jgh3-fggc-mcpm) (**7.6**, PR:H): a Power User registering a remote MCP server supplies a URL that is "fetched server-side with no validation of the destination" — loopback, RFC1918, and `169.254.169.254` all reachable, responses reflected in error messages (non-blind), cloud IAM credentials on the table; 0.23.0 adds a single egress chokepoint that rejects internal ranges at dial time. [GHSA-pr6h-vr44-xq8j](https://github.com/advisories/GHSA-pr6h-vr44-xq8j) (5.3): with `OBOT_SERVER_ENABLE_REGISTRY_AUTH=true` set, the `/v0.1/*` MCP-registry endpoints were still readable anonymously because the authorizer's protected-prefix list omitted `/v0.1` (catalog metadata and connection URLs, no credentials). Same DCR/redirect shape as [Bifrost's](2026-09-bifrost-mcp-client-registration-unauth-rce.md) unauthenticated client registration and the rmcp OAuth bugs above.
- **cc-connect — Feishu card callbacks skip the per-user allowlist (CVE-2026-92801 / GHSA-2qg4-97v5-72x5, CVSS 8.7, database 2026-09-16, CNA VulnCheck).** cc-connect (chenhg5/cc-connect, ~15.6K stars) bridges a *local* Claude Code / Cursor / Gemini CLI / Codex session to Feishu, Telegram, Slack and Discord so you can drive your coding agent from a chat app with no public IP. Through **1.5.0** it validated per-user permissions on text messages but not on Feishu **interactive-card actions**, so "attackers can dispatch agent commands by triggering card actions in admitted chats" — anyone in a chat the bridge is admitted to, not only the allow-listed operator, can send instructions to the agent on your machine. The database record lists no patched version and the repository's newest tag at fetch time was v1.5.1-beta.1; treat every version as affected until the project says otherwise (repo issue #1852). This is the messaging-bridge variant of OpenClaw's non-owner-sender bugs — the chat platform's membership is not the agent's authorization.
- **Tencent BrowserSkill — any 32-character `chrome-extension://` origin is accepted by the local daemon (CVE-2026-94111 / GHSA-x6f2-qp26-2xrh, CVSS 6.9 on the database record, published 2026-09-20).** BrowserSkill is an agent browser-automation tool; its local daemon's WebSocket origin check "accepts any chrome-extension origin with 32 characters in range a-p" — which is every extension id. A malicious extension registers itself as the browser client and "intercept[s] or alter[s] page content, DOM elements, and screenshots sent to the AI agent." Through **0.3.0**, no patched version listed (repo issue Tencent/BrowserSkill#273). It is [BragJack](2026-09-bragjack-browser-extension-builtin-ai-assistant-hijack.md)'s mechanism applied to an agent's eyes rather than its prompt: what the model *sees* is attacker-chosen.
- **OpenPanel — MCP auth tokens from URL query parameters written to plaintext logs (CVE-2026-93982, CVSS 4.8, published 2026-09-19).** Through commit `bad75bdd`, the analytics platform logged base64 MCP credentials unredacted; anyone with stdout or centralised-log access can replay them against the MCP endpoint. Low score, familiar shape (CWE-532); rotate MCP tokens if your logs are shared.
- **Two "Claude Code ecosystem" tools with no vendor and no tab — found only by querying the advisory database for the agent's name.** [**claude-code-templates** (npm) — CVE-2026-73222 / GHSA-79wm-x847-7cvg, CVSS 8.8](https://github.com/advisories/GHSA-79wm-x847-7cvg): the `--studio` development server (an Express app) **binds `0.0.0.0` with no authentication and accepts cross-origin requests**, and `POST /api/execute` and `POST /api/install-agent` pass input to a shell with `shell: true` — a web page you visit while Studio is running, or anyone on the same network, runs commands as you. Affects **≤ 1.29.2**, fixed **1.29.4** (vendor advisory 2026-07-14, CVE 08-11, database 09-03, reporter spartan8806, commit `bc4618b`); the registry shows 1.29.6 on 2026-09-17 and ~1,930 downloads in the week to 09-19. [**claude-skill-antivirus** — CVE-2026-84810 / GHSA-gvgj-r6pg-m42w, CVSS 7.1](https://github.com/advisories/GHSA-gvgj-r6pg-m42w): a scanner meant to vet skills before you run them "reads only SKILL.md while ignoring Python source, bytecode, and other artifacts," returning **SAFE, 100/100 trust** for a skill whose payload lives in any other file (CNA VulnCheck, database 2026-09-02, repo issue claude-world/claude-skill-antivirus#33, no versions listed). A skill scanner that scans the manifest is worse than none, because it produces a green badge; if you rely on one, confirm it opens every file in the directory.

```bash
# ToolHive: below 0.30.1 the default network profile reaches the host
thv version 2>/dev/null
# Obot: below 0.23.0 the OAuth DCR + registry bugs are live
# claude-code-templates Studio: is it listening on all interfaces right now?
ss -tlnp 2>/dev/null | grep -E '0\.0\.0\.0:(3[0-9]{3}|[0-9]{4,5})' | grep -i node
npm ls -g claude-code-templates 2>/dev/null   # < 1.29.4 = unauthenticated RCE when --studio runs
# cc-connect: any Feishu chat the bridge is admitted to can drive the agent through card actions — remove the bridge from shared chats until a fix ships
```

## Am I affected?

```bash
# Spring AI (Maven/Gradle)
grep -rn 'spring-ai' pom.xml build.gradle* 2>/dev/null

# LangChain community + any MCP servers in a Python env
pip list 2>/dev/null | grep -Ei 'langchain-community|mcp'

# npm-side MCP servers named above
npm ls @contentful/mcp-server @contentful/mcp-tools chrome-devtools-mcp \
       claude-faf-mcp faf-mcp grok-faf-mcp 2>/dev/null

# PyCharm build number — need 2026.2.1 or later
ls ~/Library/Application\ Support/JetBrains/ 2>/dev/null || ls ~/.config/JetBrains/ 2>/dev/null

# 2026-08-30 update: the second MCP bind-all-interfaces batch
npm ls mcp-router @agent-infra/mcp-server-commands @agent-infra/mcp-server-filesystem 2>/dev/null
pip list 2>/dev/null | grep -Ei 'tooluniverse'
npm ls mcp-use 2>/dev/null
npm ls @apify/actors-mcp-server 2>/dev/null
npm ls argocd-mcp 2>/dev/null
# Any of the above reachable beyond loopback (check listening address, not just process presence):
ss -tlnp 2>/dev/null | grep -E ':(3000|4000|8000|8080|3333)\b' || netstat -tlnp 2>/dev/null

# 2026-09-14 update
pip list 2>/dev/null | grep -Ei 'awslabs\.(postgres|mysql|dynamodb)-mcp-server|mcp-contextforge-gateway'
npm ls -g codewhale deepseek-tui 2>/dev/null; cargo install --list 2>/dev/null | grep -i codewhale
# Need: postgres-mcp-server >= 1.1.7, mysql-mcp-server >= 1.0.23, dynamodb-mcp-server >= 2.1.6,
#       mcp-contextforge-gateway >= 1.0.9, codewhale >= 0.8.64

# 2026-09-09 update
pip list 2>/dev/null | grep -Ei 'mcp-atlassian'
# ArcadeDB — check server version, not just an installed client library
# facebook-ads-mcp-server (gomarble-ai)
pip list 2>/dev/null | grep -Ei 'facebook-ads-mcp'
```

Minimum safe versions established in this batch: **Spring AI 2.0.1** · **PyCharm 2026.2.1** · **Splunk MCP Server app 1.2.1** · **Splunk AI Toolkit 6.0.0/6.0.1** · **`@contentful/mcp-server` 1.7.19 / `@contentful/mcp-tools` 0.4.5** · **`chrome-devtools-mcp` 1.1.0** · **`claude-faf-mcp` 5.7.2** · **`mcp-router` 0.6.3** · **`actors-mcp-server` 0.9.12** · **`argocd-mcp` 0.9.0** · **`mcp-atlassian` 0.22.0** · **ArcadeDB 26.7.3** (26.7.2 closes the sibling REST-endpoint leak only) · **`facebook-ads-mcp-server`** at or after commit `4e53875`. For **`langchain-community`**, **Headroom**, **Spring AI's CVE-2026-59279**, **ToolUniverse**, **Telnyx MCP server**, **UI-TARS-desktop's `mcp-http-server`** (fixed at commit `c2ad42e`, no version number stated), and **`mcp-use`'s Inspector proxy**, the advisory pages do not state a fixed version — check upstream directly rather than assuming.

If you run **Headroom** or any Spring AI MCP HTTP transport reachable beyond loopback, treat every upstream LLM provider key it holds as potentially exposed and rotate — the SSRF forwards `Authorization` headers verbatim. The same applies to **`argocd-mcp`**: if `ARGOCD_API_TOKEN` was configured and the listener was reachable, treat that token as exposed and rotate it.

## If you are affected

- [If an MCP server was malicious](../playbooks/if-an-mcp-server-was-malicious.md)
- [Rotating cloud credentials](../playbooks/rotating-cloud-credentials.md)
- [If your local AI agent was exploited](../playbooks/if-your-local-ai-agent-was-exploited.md)

## Prevention

- [MCP hygiene](../prevention/mcp-hygiene.md)
- [Agent sandboxing](../prevention/agent-sandboxing.md)
- [Credential hygiene](../prevention/credential-hygiene.md)

The four repeating mistakes in this batch, stated plainly: **(1)** a limit shown to the model is not a limit enforced at dispatch (Spring AI); **(2)** an MCP surface opened on the user's behalf still needs authentication (PyCharm, Spring AI transport); **(3)** an SSRF guard on the obvious path misses the indirection one hop away (LangChain nested sitemaps, Headroom's base-URL override); **(4)** a request header is never an identity (Headroom).

## Sources
- [GitHub Advisory Database — GHSA-33f5-2c5q-wgwj (CVE-2026-63127, rmcp OAuth resource validation)](https://github.com/advisories/GHSA-33f5-2c5q-wgwj) and [GHSA-9pj6-vhgr-3mwh (CVE-2026-63128, rmcp session-table leak)](https://github.com/advisories/GHSA-9pj6-vhgr-3mwh) — fetched 2026-09-17; published 2026-09-16, CVSS 8.2 / 7.5, affected < 2.0.0, patched 2.0.0, the RFC 9728 quotation and the 2,100 req/s measurement; the [advisory-database "rmcp" listing](https://github.com/advisories?query=rmcp+sort%3Apublished-desc) (fetched 2026-09-17) also carries GHSA-89vp-x53w-74fx / CVE-2026-42559 (2026-05-06).

- [GitHub Advisory Database — GHSA-wmqr-wxf2-6449 (CVE-2026-59318, Spring AI)](https://github.com/advisories/GHSA-wmqr-wxf2-6449) and [spring.io — CVE-2026-59318](https://spring.io/security/cve-2026-59318) — CVSS, CWE-863, affected ranges and the 2.0.1 / Enterprise-backport version split.
- [GitHub Advisory Database — GHSA-2g9x-r8w8-qjff (CVE-2026-59279)](https://github.com/advisories/GHSA-2g9x-r8w8-qjff) — MCP Streamable HTTP transport session exhaustion, CVSS 7.5, CWE-770, no default client auth.
- [GitHub Advisory Database — GHSA-h4jw-w55g-65gf (CVE-2026-59308)](https://github.com/advisories/GHSA-h4jw-w55g-65gf) — Semantic Cache cross-context response leakage, CVSS 4.2, CWE-668.
- [GitHub Advisory Database — GHSA-5686-8wvm-pm8w (CVE-2026-75060, PyCharm)](https://github.com/advisories/GHSA-5686-8wvm-pm8w) — CVSS 8.4, CWE-306, unauthenticated Jupyter MCP tools, fixed 2026.2.1.
- [Splunk — SVD-2026-0808](https://advisory.splunk.com/advisories/SVD-2026-0808) and [GitHub Advisory Database — GHSA-3v49-2fcm-3rcj (CVE-2026-76404)](https://github.com/advisories/GHSA-3v49-2fcm-3rcj) — Splunk MCP Server deserialization RCE (CVSS 9.1, fixed 1.2.1) and the nine Splunk AI Toolkit CVEs with versions and scores.
- [GitHub Advisory Database — GHSA-vg8m-4p2q-gcjh (CVE-2026-72848, langchain-community)](https://github.com/advisories/GHSA-vg8m-4p2q-gcjh) — fetched directly: SitemapLoader nested-sitemap SSRF, CVSS 7.7, published 2026-08-21, affected/patched versions not stated on the page.
- [GitHub Advisory Database — GHSA-5vg3-c628-vf56 (CVE-2026-77776, Headroom)](https://github.com/advisories/GHSA-5vg3-c628-vf56) and [GHSA-4j5r-9p93-j2px (CVE-2026-77775)](https://github.com/advisories/GHSA-4j5r-9p93-j2px) — `x-headroom-user-id` impersonation and `x-headroom-base-url` SSRF with verbatim `Authorization` forwarding; handler file paths; the `0.0.0.0`-binding reference Compose file.
- [GitHub Advisory Database — GHSA-2xhg-73j7-rrgx (CVE-2026-53957, Contentful MCP)](https://github.com/advisories/GHSA-2xhg-73j7-rrgx), [GHSA-8qf9-62x2-82pp (CVE-2026-53766, chrome-devtools-mcp)](https://github.com/advisories/GHSA-8qf9-62x2-82pp), [GHSA-rr55-jp92-8wp2 (claude-faf-mcp)](https://github.com/advisories/GHSA-rr55-jp92-8wp2) — the June-disclosed MCP advisories ingested into the GHSA database this window, with the original-vs-database date discrepancy noted above.

**2026-08-30 update sources** — all seven CVEs below confirmed directly against the NVD API (`services.nvd.nist.gov/rest/json/cves/2.0`) rather than paraphrased from an aggregator; each NVD record's own reference list is cited alongside it:
- [NVD — CVE-2026-81094](https://nvd.nist.gov/vuln/detail/CVE-2026-81094) / [GHSA-rx55-5c7h-r56r](https://github.com/mcp-router/mcp-router/security/advisories/GHSA-rx55-5c7h-r56r) — `mcp-router` CLI, CVSS 9.1/9.3, fixed 0.6.3.
- [NVD — CVE-2026-81096](https://nvd.nist.gov/vuln/detail/CVE-2026-81096) / [GHSA-pxwq-22vf-87fm](https://github.com/mims-harvard/ToolUniverse/security/advisories/GHSA-pxwq-22vf-87fm) — ToolUniverse, CVSS 10.0/9.3, ≤1.2.6 affected, fixed version not confirmed (GHSA page 404'd to direct fetch this sweep).
- [NVD — CVE-2026-81098](https://nvd.nist.gov/vuln/detail/CVE-2026-81098) / [GHSA-46jp-xr2h-fw7h](https://github.com/team-telnyx/telnyx-node/security/advisories/GHSA-46jp-xr2h-fw7h) — Telnyx MCP server, CVSS 9.1/9.3, ≤6.83.0 affected, fixed version not confirmed.
- [NVD — CVE-2026-81735](https://nvd.nist.gov/vuln/detail/CVE-2026-81735) and [PR #1918](https://github.com/bytedance/UI-TARS-desktop/pull/1918) — UI-TARS-desktop `mcp-http-server`, CVSS 10.0/10.0, fixed at commit `c2ad42e` (2026-07-01), no released version number stated.
- [NVD — CVE-2026-81091](https://nvd.nist.gov/vuln/detail/CVE-2026-81091) / [GHSA-f2jg-rm2x-hc5p](https://github.com/mcp-use/mcp-use/security/advisories/GHSA-f2jg-rm2x-hc5p) — `mcp-use` Inspector proxy, CVSS 8.6/8.7, ≤2.3.2 affected, fixed version not confirmed.
- [NVD — CVE-2026-81093](https://nvd.nist.gov/vuln/detail/CVE-2026-81093) / [GHSA-m28f-9v8h-gg2f](https://github.com/apify/apify-mcp-server/security/advisories/GHSA-m28f-9v8h-gg2f) — Apify `actors-mcp-server`, CVSS 8.6/8.7, fixed 0.9.12.
- [NVD — CVE-2026-82456](https://nvd.nist.gov/vuln/detail/CVE-2026-82456) / [GHSA-rp45-5x3v-48mr](https://github.com/argoproj-labs/mcp-for-argocd/security/advisories/GHSA-rp45-5x3v-48mr) — `argocd-mcp`, CVSS 10.0/10.0, affects 0.8.0, fixed 0.9.0.

**2026-09-09 update sources:**
- [GitHub Advisory Database — GHSA-g5r6-gv6m-f5jv (CVE-2026-73498, mcp-atlassian)](https://github.com/advisories/GHSA-g5r6-gv6m-f5jv) — fetched directly: CVSS 7.7, affected < 0.22.0, fixed 0.22.0, `confluence_upload_attachment` path traversal.
- [VulnCheck — ArcadeDB information disclosure via get_server_settings (CVE-2026-67357 / GHSA-p9wc-4fhr-78wm)](https://www.vulncheck.com/advisories/arcadedb-information-disclosure-via-get-server-settings) — fetched directly: CVSS 7.7, affected < 26.7.3, fixed 26.7.3. Cross-checked against the distinct sibling [VulnCheck — ArcadeDB cluster token disclosure via GET /api/v1/server (CVE-2026-67343 / GHSA-46hj-24h4-j8gf)](https://www.vulncheck.com/advisories/arcadedb-before-cluster-token-disclosure-via-get-api-v1-server) to confirm the two CVEs are separate endpoints, not a duplicate pairing.
- [NVD — CVE-2026-19956](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-19956) — fetched directly via the NVD API: CVSS 3.1 6.3 / 4.0 5.3, CWE-918, `fetch_pagination_url` SSRF in `facebook-ads-mcp-server` 0.1.0, fixed via [commit `4e53875`](https://github.com/gomarble-ai/facebook-ads-mcp-server/commit/4e53875aa22e8991c2fa4a7660d86e1caba66659) / [PR #32](https://github.com/gomarble-ai/facebook-ads-mcp-server/pull/32). No GHSA filed; VulDB-sourced record.
- [Adversa AI — MCP security September 2026: Deadbugz + 3 server CVEs](https://adversa.ai/blog/top-mcp-security-resources-september-2026/) — surfaced all three CVEs in this update; each confirmed against a primary source rather than this roundup.

**2026-09-12 update sources** — all fetched directly from the GitHub Advisory Database:
- [GHSA-w3fx-mc44-mf6j (CVE-2026-45018, chainlit)](https://github.com/advisories/GHSA-w3fx-mc44-mf6j) — CVSS 9.8, `/mcp` argument-injection RCE, affected ≥2.4.0rc0 ≤2.11.1, fixed 2.12.0, 2026-08-25.
- [GHSA-xm98-3vcf-fph7 (CVE-2026-53710, mcp-contextforge-gateway)](https://github.com/advisories/GHSA-xm98-3vcf-fph7) — CVSS 10.0, RestrictedPython bypass to `subprocess.Popen`, ≤1.0.1 → 1.0.2, 2026-08-24.
- [GHSA-rqfv-2mw9-78g2 (CVE-2026-59971, mysql-mcp-server)](https://github.com/advisories/GHSA-rqfv-2mw9-78g2) — CVSS 10.0, SSE no-auth/DNS-rebinding, ~25 exposed instances, <0.4.2 → 0.4.2, disclosed 2026-06-21 / reviewed 2026-09-11.
- [GHSA-6g6r-q6gw-w8fg (CVE-2026-55536, PraisonAI)](https://github.com/advisories/GHSA-6g6r-q6gw-w8fg) — CVSS 9.1, `re.match()` origin-validation bypass (patch bypass of CVE-2026-40289), <4.6.58 → 4.6.58.
- [GHSA-mw6r-2hvm-4rp2 (CVE-2026-55546, qwed-mcp)](https://github.com/advisories/GHSA-mw6r-2hvm-4rp2) and [GHSA-8vh3-g2qg-2h2c (CVE-2026-55640, nextcloud-mcp-server)](https://github.com/advisories/GHSA-8vh3-g2qg-2h2c) and [GHSA-93qj-5q5v-3c2h (pantheon-agents trojanized PyPI)](https://github.com/advisories/GHSA-93qj-5q5v-3c2h) — the lower-relevance items noted above. independently against its own primary source above rather than taken from this aggregator summary.

**2026-09-13 update sources:**
- [Pillar Security — Valid but never issued: session spoofing and SSRF in Grafana MCP](https://www.pillar.security/blog/valid-but-never-issued-session-spoofing-and-ssrf-in-grafana-mcp) — fetched 2026-09-13; published 2026-09-02: both flaws, the chain to IMDSv2, the 1.9M-pull figure, and the Intigriti/Grafana timeline (08-02 report, 08-10 v1.1.0, 08-11 CVE, 08-12 Hall of Fame).
- [Grafana Labs — CVE-2026-19516: Grafana MCP server-side request forgery via X-Grafana-URL header](https://grafana.com/security/security-advisories/cve-2026-19516) — fetched 2026-09-13; vendor advisory: CVSS 9.1 vector, fixed ≥ 1.1.0, the "incomplete fix for CVE-2026-15583" statement.
- [NVD — CVE-2026-19516](https://nvd.nist.gov/vuln/detail/CVE-2026-19516) — fetched via the NVD API 2026-09-13; published 2026-08-11, CWE-918, `mcp-grafana` ≤ 1.0.0, Grafana advisory as reference.
- [CSA Lab Space — Identity Confusion by Design: The Grafana MCP SSRF](https://labs.cloudsecurityalliance.org/research/csa-research-note-mcp-server-identity-ssrf-20260908-csa-styl/) — fetched 2026-09-13; 2026-09-08 research note that surfaced the finding for this sweep; links Pillar as primary.

**2026-09-14 update sources** — all fetched 2026-09-14:
- [AWS Security Bulletin 2026-101 — CVE-2026-85787 (awslabs postgres-mcp-server)](https://aws.amazon.com/security/security-bulletins/2026-101-aws/), [AWS Security Bulletin 2026-097 — CVE-2026-85654 (awslabs.dynamodb-mcp-server)](https://aws.amazon.com/security/security-bulletins/2026-097-aws/), [AWS Security Bulletin 2026-103 — CVE-2026-85788 (awslabs mysql-mcp-server)](https://aws.amazon.com/security/security-bulletins/2026-103-aws/) — vendor bulletins: affected/fixed versions, least-privilege workarounds, reporter credits.
- [GitHub Advisory Database — GHSA-f4f4-39r8-8gj4 (CVE-2026-85787)](https://github.com/advisories/GHSA-f4f4-39r8-8gj4) and [GHSA-hh4r-pcm9-jh93 (CVE-2026-85654)](https://github.com/advisories/GHSA-hh4r-pcm9-jh93) — CVSS 7.1, CWE-184 / CWE-1336.
- NVD API records for [CVE-2026-85787](https://nvd.nist.gov/vuln/detail/CVE-2026-85787), [CVE-2026-85788](https://nvd.nist.gov/vuln/detail/CVE-2026-85788), [CVE-2026-85654](https://nvd.nist.gov/vuln/detail/CVE-2026-85654) — CNA AWS, publication dates, description text.
- [IBM Security Bulletin 7286052 — CVE-2026-18486](https://www.ibm.com/support/pages/node/7286052), [7286055 — CVE-2026-77822](https://www.ibm.com/support/pages/node/7286055), [7286053 — CVE-2026-18905](https://www.ibm.com/support/pages/node/7286053), [7286056 — CVE-2026-18489](https://www.ibm.com/support/pages/node/7286056) — IBM PSIRT bulletins, published 2026-09-02: CVSS vectors, affected/fixed versions, the credential-rotation list, the Translate "local single-session only" statement.
- NVD API records for [CVE-2026-18486](https://nvd.nist.gov/vuln/detail/CVE-2026-18486), [CVE-2026-18489](https://nvd.nist.gov/vuln/detail/CVE-2026-18489), [CVE-2026-77822](https://nvd.nist.gov/vuln/detail/CVE-2026-77822), [CVE-2026-18905](https://nvd.nist.gov/vuln/detail/CVE-2026-18905) — CNA `psirt@us.ibm.com`, published 2026-09-04.
- [GitHub Advisory Database — GHSA-gx45-xrj5-g6c4 (CVE-2026-75911, CodeWhale `allow_shell`)](https://github.com/advisories/GHSA-gx45-xrj5-g6c4), [GHSA-wrj3-vj8c-784f (CVE-2026-75858, `rlm_eval` auto-approval)](https://github.com/advisories/GHSA-wrj3-vj8c-784f), [GHSA-6v2g-fpxh-pmmh (CVE-2026-75856, DNS-pinning TOCTOU)](https://github.com/advisories/GHSA-6v2g-fpxh-pmmh) — affected/fixed ranges, the `deepseek-tui` predecessor package, VinSOC Labs credit, 2026-07-16 disclosure vs 2026-09-04 database review.
- NVD API records for [CVE-2026-75911](https://nvd.nist.gov/vuln/detail/CVE-2026-75911) and [CVE-2026-75856](https://nvd.nist.gov/vuln/detail/CVE-2026-75856) — CNA VulnCheck, CVSS 4.0 8.5 / 9.2, published 2026-08-18.

**2026-09-15 update sources** — all fetched 2026-09-15 (Bifrost's JFrog, NVD and release sources are in [its own advisory](2026-09-bifrost-mcp-client-registration-unauth-rce.md)):
- [VulnCheck — Casdoor through 4.4.0 cross-organization user administration via /api/mcp (CVE-2026-91998)](https://www.vulncheck.com/advisories/casdoor-through-4.4.0-cross-organization-user-administration-via-api-mcp) — CNA advisory: CVSS 9.4, through 4.4.0, no fixed version, credit George Chen.
- [NVD — CVE-2026-91998](https://nvd.nist.gov/vuln/detail/CVE-2026-91998) — published 2026-09-15, CVSS 3.1 9.9 / 4.0 9.4, CWE-863, references to `authz/authz.go`, `mcpself/user.go`, `routers/base.go` at v4.4.0.
- [George Chen — Casdoor findings (geo-chen/oss)](https://github.com/geo-chen/oss/blob/main/casdoor.md) — researcher write-up: mechanism of all three findings, the 06-13 report / ~06-26 issue / deletion timeline.
- [GitHub Advisory Database — GHSA-jvmw-g7rg-x26f (CVE-2026-91998)](https://github.com/advisories/GHSA-jvmw-g7rg-x26f) — CVE-sourced copy, published 2026-09-15.
- [IBM Security Bulletin 7286834 — ContextForge MCP Gateway is affected by use of default credentials (CVE-2026-78573)](https://www.ibm.com/support/pages/node/7286834) — published 2026-09-09: v1.0.0 – v1.0.9 → v1.0.10, the three password settings to change.
- [GitHub Advisory Database — GHSA-87q9-x2gp-qchr (CVE-2026-78573)](https://github.com/advisories/GHSA-87q9-x2gp-qchr) — CVSS 9.8, CWE-1392; the narrower 1.0.0 – 1.0.7 range noted above.
- [GitHub Advisory Database — GHSA-65h7-9wrw-629c (CVE-2026-59973, FrontMCP / mcp-from-openapi)](https://github.com/advisories/GHSA-65h7-9wrw-629c) — CVSS 8.5, bypass of GHSA-v6ph-xcq9-qxxj / CVE-2026-39885, fixed 1.5.0 / 2.5.0.
- [GitHub Advisory Database — GHSA-wcjj-9m6g-2fr2 (CVE-2026-59176, functype-mcp-server)](https://github.com/advisories/GHSA-wcjj-9m6g-2fr2) — CVSS 7.8, `set_functype_version` alias / `file:` install, ≤ 1.4.3 → 1.4.4, fix commit `c0d58ad`.
- [GitHub Advisory Database — GHSA-629c-j52g-h978 (CVE-2026-88938, knowns)](https://github.com/advisories/GHSA-629c-j52g-h978) and [NVD — CVE-2026-88938](https://nvd.nist.gov/vuln/detail/CVE-2026-88938) — CNA VulnCheck, published 2026-09-10, `code.find` path confinement, through 0.33.0, CWE-22. The vendor advisory id these reference (GHSA-5cj9-fcqq-g2h7) returned 404 on 2026-09-15.
- [NVD — CVE-2026-64684 (rmcp custom headers leak to cross-origin redirect targets)](https://nvd.nist.gov/vuln/detail/CVE-2026-64684) — CNA GitHub, published 2026-09-16, CVSS 6.8, CWE-200, affected < 2.1.0, fixed 2.1.0; the description quoted in the 2026-09-18 update was taken from the NVD API record, and the advisory appears as GHSA-9g45-5xwm-f3wc in the `mcp` recency listing below (fetched 2026-09-18).
- [GitHub Advisory Database — advisories matching `mcp`, newest first](https://github.com/advisories?query=mcp+sort%3Apublished-desc) — the recency listing that surfaced Casdoor, Bifrost, knowns, functype and FrontMCP this sweep; each confirmed against its own record above.

**2026-09-20 update sources** — all fetched 2026-09-20:
- [GitHub Advisory Database — GHSA-qg2g-g9w3-m5h8 (CVE-2026-58197, ToolHive)](https://github.com/advisories/GHSA-qg2g-g9w3-m5h8) — CVSS 8.8 vector, < 0.30.1 → 0.30.1, the `host.docker.internal` / three-weakness description, PR and release references, vendor date 2026-07-28.
- [GitHub Advisory Database — GHSA-xwmw-prc4-v3cr (Obot OAuth DCR token theft)](https://github.com/advisories/GHSA-xwmw-prc4-v3cr), [GHSA-jgh3-fggc-mcpm (Obot SSRF via remote MCP server URL)](https://github.com/advisories/GHSA-jgh3-fggc-mcpm), [GHSA-pr6h-vr44-xq8j (Obot registry API readable without auth)](https://github.com/advisories/GHSA-pr6h-vr44-xq8j) — vendor advisories dated 2026-06-22, all fixed 0.23.0; CVSS 8.8 / 7.6 / 5.3, mechanisms and credits as quoted.
- [GitHub Advisory Database — GHSA-2qg4-97v5-72x5 (CVE-2026-92801, cc-connect)](https://github.com/advisories/GHSA-2qg4-97v5-72x5) — CVSS 8.7, through 1.5.0, the Feishu card-callback allowlist bypass, issue #1852; [chenhg5/cc-connect](https://github.com/chenhg5/cc-connect) — project description, ~15.6K stars, v1.5.1-beta.1 newest tag, no advisory mention.
- [GitHub Advisory Database — GHSA-x6f2-qp26-2xrh (CVE-2026-94111, Tencent BrowserSkill)](https://github.com/advisories/GHSA-x6f2-qp26-2xrh) — CVSS 6.9, through 0.3.0, the 32-character `a-p` origin check, issue #273.
- [GitHub Advisory Database — GHSA-xvpp-2hfw-c93c (CVE-2026-93982, OpenPanel)](https://github.com/advisories/GHSA-xvpp-2hfw-c93c) — CVSS 4.8, CWE-532, commit `bad75bdd`, VulnCheck reference.
- [GitHub Advisory Database — GHSA-79wm-x847-7cvg (CVE-2026-73222, claude-code-templates)](https://github.com/advisories/GHSA-79wm-x847-7cvg) — CVSS 8.8, ≤ 1.29.2 → 1.29.4, the `0.0.0.0` / cross-origin / `shell: true` description, reporter and commit; npm `time` field for `claude-code-templates` (2026-09-20): 1.29.4 2026-07-14, 1.29.5 09-09, 1.29.6 09-17; weekly downloads 1,930 (2026-09-13 → 09-19, `api.npmjs.org`).
- [GitHub Advisory Database — GHSA-gvgj-r6pg-m42w (CVE-2026-84810, claude-skill-antivirus)](https://github.com/advisories/GHSA-gvgj-r6pg-m42w) — CVSS 7.1, CWE-693, the SKILL.md-only scanning description, issue #33, VulnCheck reference.
- [GitHub Advisory Database — advisories matching `claude`, newest first](https://github.com/advisories?query=claude+sort%3Apublished-desc) and [matching `agent`, newest first](https://github.com/advisories?query=agent+sort%3Apublished-desc) — the listings that surfaced claude-code-templates, claude-skill-antivirus, cc-connect and BrowserSkill; none had appeared in any vendor tab or search query.