---
id: 2026-10-vulncheck-single-researcher-agent-mcp-gateway-cve-wave-mini-swe-agent-env-leak
title: "VulnCheck CVE wave against agent sandboxes, MCP servers and LLM gateways, 22 records on day one, still growing; mini-swe-agent leaks host API keys"
date_disclosed: 2026-10-10
last_updated: 2026-11-10
severity: high
status: active
ecosystems: [pypi, npm, maven, mcp, ai-agents, llm-gateway, swe-agent, computer-use]
tools_affected: ["mini-swe-agent 1.10.0 to 2.4.6 (BubblewrapEnvironment backend)", "9router 0.4.1 to 0.5.99 with the Hermes Agent integration", "Hermes Agent (config.yaml written by 9router)", "@1mcp/agent 0.20.0 to 0.39.0", "mcp-remote 0.8.0 to 0.14.3 (--device-code grant)", "MCP Kotlin SDK through 0.15.0 (Application.mcpWebSocket)", "argocd-mcp through 0.9.0", "zotero-mcp (54yyyu) 0.10.0 to 0.14.1", "Phi 0.3.0 to 0.28.4", "@open-multi-agent/core 1.5.0 to 1.21.2", "Tabularis through 0.27.0", "LangChat through commit 2a6285a (CVE-2026-111704, 2026-10-16)", "GenOffice through 0.11.505", "Kortix Suna 0.10.7 before 0.13.52", "OpenLIT 2.1.0", "TencentCloud Octop through 1.0.2b6", "LLMGateway through 1.20.0", "Plastic Labs Honcho through 3.3.0", "Rill 0.77.0 to 0.90.5", "Open Computer Use (iFurySt) through 1.0.0", "open-computer-use (e2b-dev) through commit 610bac8", "Cheshire Cat AI core through 2.0.23", "Flyte 2.0.1 to 2.0.51", "NornicDB through 1.4.1", "AmoyLab Unla MCP gateway through 0.10.0 (added 2026-10-12)", "mcp-go through 1.2.1 (DoS) and 0.48.0 to 1.2.0 (OAuth resource validation, vendor advisory 2026-10-09, CVE-2026-123272 on 2026-11-05, fixed 1.2.1)", "ChatCLI (diillson) 1.159.0 to 1.215.1 (same OAuth resource bug, CVE-2026-123271, fixed 1.215.2)", "Katanemo Plano through 0.4.37", "hyper-mcp through 0.8.3", "pinclaw OpenClaw channel plugin through 0.3.0", "mac-shell-mcp (npm 1.0.4, the only published version)", "mistral.rs 0.9.0 to 0.9.4 (mistralrs-code-exec)", "MoAI-ADK through 3.1.2", "Odoo MCP (erpipe) 1.0.0 to 1.3.2", "Abilityai Trinity through 0.9.5", "Shepherd through 0.3.1", "Company Research Agent through 2.2.0", "iFlytek Astron Agent through 1.1.2", "RAGFlow before 0.27.0 (CVE-2026-49951, SSRF through the LLM-provider base_url; fixed 0.27.0)"]
tags: [cve, cna-wave, vulncheck, single-researcher, prompt-injection, sandbox, environment-leak, credential-exfiltration, mcp, mcp-client, mcp-server, oauth, ssrf, authorization-bypass, config-injection, agent-hooks, no-fix, dos, signature-verification, llm-gateway, api-key-exposure]
---

## TL;DR
Between 2026-10-10 and 2026-10-11 VulnCheck, acting as CNA, published 22 CVE records credited to one researcher (HaiND, Post and Telecommunication Institute of Technology) against agent frameworks, MCP servers and clients, LLM gateways and agent platforms. The ones that matter for this corpus's audience: **mini-swe-agent**'s optional Bubblewrap sandbox starts with the host's full environment, so a prompt-injected task can read API keys and send them out over the sandbox's shared network (CVE-2026-108592); **9router**'s dashboard writes an unvalidated base URL into **Hermes Agent**'s `config.yaml`, so a dashboard user can add a shell hook the agent later runs (CVE-2026-108593); **mcp-remote**'s `--device-code` grant sends client secrets and receives tokens over plain HTTP when discovery returns a plain-HTTP endpoint (CVE-2026-108716); and the **MCP Kotlin SDK**'s WebSocket server installs no frame-size limit (CVE-2026-108714). Every record's references are the researcher's HackMD write-up plus exact source lines; **no record names a fixed version**, the write-ups say coordinated disclosure is in progress, and the vendor advisory tabs for mini-swe-agent and SWE-agent are empty. Registry checks show the last affected version is the current release for mini-swe-agent, 9router, 1MCP, open-multi-agent, argocd-mcp and mcp-remote.

**Update 2026-10-12:** the wave continued through 10-11 and 10-12 with sixteen more VulnCheck records, now from two reporters. The ones that matter: the **Unla** MCP gateway's OAuth server issues tokens to anyone (CVE-2026-108865, 8.8, unauthenticated reach into every proxied upstream and injected credential), **Katanemo Plano** exposes its Envoy admin port on all interfaces with the configured LLM provider keys readable in plaintext (CVE-2026-108863, 8.7), **mcp-go**, the main Go MCP SDK, takes an unbounded POST body (CVE-2026-108859, 8.7) and separately fixed an OAuth resource-binding bug in 1.2.1 on 2026-10-09 (vendor advisory), **hyper-mcp** verifies plugin signatures against the wrong manifest and accepts any Sigstore signer (CVE-2026-108698, CVE-2026-108699, 8.3 each), **pinclaw**, an OpenClaw channel plugin, accepts unauthenticated prompt injection into the owner's agent session on a port bound to all interfaces (CVE-2026-108757, 7.1), and **mac-shell-mcp** lets a prompt run forbidden commands past its allowlist (CVE-2026-108953, 8.5) with a fix commit that no npm release carries. Details in the dated section below.

## What happened

The GitHub Advisory Database's `mcp` and `agent` recency listings showed a block of same-day unreviewed rows on 2026-10-10, and the VulnCheck advisory index showed a second block on 2026-10-11. Pulling each CVE record from CVE Services gave the same shape every time: CNA `VulnCheck`, one `hackmd.io/@haind` or `@haind03` reference, two or three permalinks to the vulnerable lines, and a VulnCheck advisory page. The researcher's write-ups (the two that rendered this run, for mini-swe-agent and 9router) each say "coordinated disclosure in progress," record no maintainer response and no fix commit, and were written before the CVE was assigned.

The scores below are VulnCheck's CVSS 4.0 base scores as printed in the CNA records on the fetch date (2026-10-11); the records also carry CVSS 3.1 values. Fix status is what the record and the registry show, not an inference.

### Agent sandboxes and file-write boundaries

| Product | CVE | CVSS 4.0 | Affected | What a prompt-injected task gets | Fix on record |
|---|---|---|---|---|---|
| mini-swe-agent, `BubblewrapEnvironment` | CVE-2026-108592 | 6.0 | 1.10.0 through 2.4.6 | `bwrap` is started without `--clearenv`, so commands in the sandbox inherit the host environment, including API keys loaded from `.env`; with network shared, a task can read and send them. The default `LocalEnvironment` backend has no isolation at all, so this only weakens the one backend that was supposed to. | None. PyPI latest is 2.4.6 (checked 2026-10-11); no security advisory on the mini-swe-agent or SWE-agent tab; no issue matching "bubblewrap clearenv" in the repository. Issue #843 (2026-05-27) had listed a related P0, host environment variables reaching prompt templates in the local backend, and was closed on 2026-06-03 with a request to file separate issues. |
| Phi (pulseaiclub) | CVE-2026-108595 | 6.0 | 0.3.0 through 0.28.4 | `agent_spawn` takes an unchecked `workdir`, so a spawned sub-agent escapes `workspace_only_writes` and read-only mode and writes anywhere the user can. | None recorded. |
| open-multi-agent (`@open-multi-agent/core`) | CVE-2026-108600 | 5.7 | 1.5.0 through 1.21.2 | The `file_write` sandbox follows dangling symlinks, so a planted link plus a steered write lands outside the workspace root. | None. npm latest 1.21.2 (published 2026-10-09). |
| Open Computer Use (iFurySt, macOS) | CVE-2026-108721 | 5.8 | through 1.0.0 | The password-manager denylist compares bundle identifiers case-sensitively, so a case-variant id reaches `get_app_state` and action tools against a denied app. | None recorded. |
| open-computer-use (e2b-dev) | CVE-2026-108722 | 2.3 | through commit 610bac8 | Transcript text is written into `log.html` unescaped, so content the sandbox saw runs as script when the operator opens the log. | None recorded. |

### MCP servers, clients and SDKs

| Product | CVE | CVSS 4.0 | Affected | What it lets an attacker do | Fix on record |
|---|---|---|---|---|---|
| mcp-remote (`--device-code`) | CVE-2026-108716 | 6.0 | 0.8.0 through 0.14.3 | `authorizeWithDeviceCode` sends the client secret and receives access and refresh tokens without requiring HTTPS; if discovery returns a non-loopback plain-HTTP device-authorization or token endpoint, an on-path attacker reads all three. Eighth finding against this bridge; see [the mcp-remote file](2026-09-mcp-remote-oauth-discovery-ssrf-cve-batch.md). | None. npm latest 0.14.3 (2026-09-21). |
| MCP Kotlin SDK | CVE-2026-108714 | 8.7 | through 0.15.0 | `Application.mcpWebSocket` installs Ktor WebSockets without `maxFrameSize`, so a few frames declaring near-2 GiB payloads exhaust server memory. DoS only. The Kotlin tab's three earlier advisories (June and September 2026) are all memory-exhaustion bugs in other transports. | None recorded; no tab entry for this one on 2026-10-11. |
| argocd-mcp (argoproj-labs) | CVE-2026-108585 | 5.3 | through 0.9.0 | `delete_application` does not validate `applicationName`, so a dot-segment value turns the authenticated DELETE into a request against repositories, clusters or projects within the token's rights. Third finding against this server after the bind-all-interfaces CVE-2026-82456 in the [MCP batch](2026-08-agent-framework-mcp-cve-batch.md). | None. npm latest 0.9.0 (2026-08-11). |
| 1MCP Agent (`@1mcp/agent`) | CVE-2026-108586 | 5.3 | 0.20.0 through 0.39.0 | OAuth tag-scope enforcement accepts negated filter expressions, so a token for one tag lists and calls tools on every backend MCP server outside its scope. | None. npm latest 0.39.0 (2026-10-09). |
| zotero-mcp (54yyyu) | CVE-2026-108583 | 2.3 | 0.10.0 through 0.14.1 | `zotero_add_by_url` fetches any URL, including loopback, private and link-local hosts, and returns citation metadata from the response. | None recorded. The PyPI package named `zotero-mcp` is at 0.3.1 and does not match this range; the affected project is the GitHub repository `54yyyu/zotero-mcp` and its release tags. |
| GenOffice (genspark-ai) | CVE-2026-108582 | 6.8 | through 0.11.505 | The HTTP MCP server's file store under the system temp directory is world-readable, so any local user reads client uploads and converted documents past the bearer token. | The record references the v0.11.505 release page; whether that release changes the permissions is not stated. Not on npm under `genoffice` or `@genspark-ai/genoffice`. |
| Tabularis | CVE-2026-108604 | 5.8 | through 0.27.0 | The MCP `run_query` read-only gate classifies by leading keyword, so a side-effecting `SELECT` (sequence functions, `query_to_xml` with an embedded write) modifies data without the approval prompt. | None recorded. Desktop app, not a PyPI package. |
| Rill (admin OAuth server for MCP) | CVE-2026-108718 | 8.6 | 0.77.0 through 0.90.5 | Dynamically registered OAuth clients get authorization codes without user consent; a client registered with the long-lived-token scope plus one clicked link yields a non-expiring API token with the victim's rights. Same dynamic-client-registration class as [Bifrost](2026-09-bifrost-mcp-client-registration-unauth-rce.md). | None recorded. |

### LLM gateways, routers and agent platforms

| Product | CVE | CVSS 4.0 | Affected | What it lets an attacker do | Fix on record |
|---|---|---|---|---|---|
| 9router → Hermes Agent | CVE-2026-108593 | 7.3 | 0.4.1 through 0.5.99 | `POST /api/cli-tools/hermes-settings` writes the submitted base URL into `~/.hermes/config.yaml` through string templates with no YAML encoding, so a dashboard user adds keys such as `hooks_auto_accept` and a `post_llm_call` shell command, which Hermes runs on its next LLM event. Needs a dashboard session under the default `requireLogin: true`; exposed to anyone who can reach the dashboard when that is off. Fifth 9router CVE in the corpus. | None. npm latest 0.5.99 (modified 2026-10-08). |
| LLMGateway (theopenco) | CVE-2026-108719 | 5.3 | through 1.20.0 | The video-generation `callback_url` is delivered without the webhook target check, so an API-key holder points it at loopback, private or cloud-metadata hosts. | None recorded. |
| TencentCloud Octop | CVE-2026-108581 | 7.1 | through 1.0.2b6 | `GET /api/providers` and `/api/voice/providers` validate only the JWT, so any low-privileged user reads the stored LLM and voice provider API keys in plaintext. | The record references pull requests #1265 and #1507; no fixed version stated. |
| Kortix Suna | CVE-2026-108115 | 2.3 | 0.10.7 before 0.13.52 | The `isPrivateIp` guard misses IPv6 6to4 and Teredo forms that embed a private IPv4 address, so a connector URL reaches internal services and metadata endpoints. | The CNA range ends at 0.13.52. The v0.13.52 release page (dated "07 Oct", year not shown) lists a "Security hardening" line about tenant isolation and sandbox proxy access checks and does not name SSRF. |
| OpenLIT | CVE-2026-108596 | 6.0 | 2.1.0 | A forged `x-openlit-project-id` header lets an authenticated user read another project's traces, including prompts and completions. | None recorded. The PyPI SDK `openlit` is at 1.45.0 and is a different artifact from the 2.1.0 platform. |
| Plastic Labs Honcho | CVE-2026-108711 | 5.3 | through 3.3.0 | A peer- or session-scoped key reads workspace metadata and configuration through `POST /v3/workspaces` because only the workspace claim is checked. | None recorded. |
| Cheshire Cat AI core | CVE-2026-108725 | 5.1 | through 2.0.23 | The uploads plugin accepts HTML without a type check and serves it from the application origin, so one link runs script as the signed-in victim. | None recorded. |

Two more records in the same batch are out of this corpus's audience and are listed for completeness: **Flyte** 2.0.1 through 2.0.51 writes file-mounted secrets base64-encoded into an init-container environment variable readable by anyone with Pod read access (CVE-2026-108728, 7.1), and **NornicDB** through 1.4.1 serves vector-search results past per-database read restrictions (CVE-2026-108710, 7.1). VulnCheck's index for 2026-10-11 also lists ten advisories against CRM, IPAM, CMS and ITSM products (SuiteCRM, LibreNMS, iTop, phpIPAM, Sylius, GLPI, EdgeEver, Corteza, `answer-me-with-html`) whose records this sweep did not open.

### Why one researcher's wave is one advisory

The shape repeats a pattern this corpus has recorded before ([the MITRE agent-framework wave](2026-09-ro1me-open-source-agent-framework-llm-output-execution-cve-wave.md), [the ZITADEL batch](2026-10-zitadel-login-account-takeover-advisory-wave.md)): a research CNA assigns ids for one reporter's findings in bulk, the database lists them as unreviewed rows with no package metadata, and the vendor channels say nothing. VulnCheck's assignment validates the affected range and the mechanism, which is why these are written as confirmed rather than `unconfirmed`, but nothing in any record establishes a maintainer response. The common thread across the agent entries is the one this corpus keeps meeting: **a check meant to contain the model** (a sandbox's environment, a workspace root, a read-only query gate, a denylist, a scope filter, a YAML writer) **is bypassed by input the model itself supplies**, so a prompt injection in a task, a page or a file becomes a credential read or a write outside the box. The gateway entries are the other recurring shape: the service that holds every provider key exposes those keys to any authenticated user or writes an agent's config for it.

## Update 2026-10-12: sixteen more records, a second reporter, and one fix that exists only as a commit

The `mcp` and `agent` listings on 2026-10-12 showed a further block of same-day unreviewed rows dated 10-11 and 10-12, and the VulnCheck index added one more on 10-12. Pulling the records gave the same shape as before, with one change: the HackMD references now come from three profiles. `@haind` and `@haind03` are the 10-10 and 10-11 researcher; the records dated 10-11 for Unla, Plano, mcp-go, hyper-mcp, Odoo MCP, phpMyFAQ, Company Research Agent and Astron Agent reference `hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q`, whose Unla write-up names the reporter as hieuPenguinnn and says "coordinated disclosure pending, no CVE assigned yet" on a page whose heading already prints the CVE. The mac-shell-mcp record (10-12) is a third reporter (Bandana, HackWitHer, APIsec Research Labs) and has a different history, below. Scores are VulnCheck's CVSS 4.0 base scores as printed in the CNA records on 2026-10-12, with the 3.1 value in brackets.

### MCP gateways, SDKs and servers

| Product | CVE | CVSS 4.0 (3.1) | Affected | What it lets an attacker do | Fix on record |
|---|---|---|---|---|---|
| AmoyLab Unla (MCP gateway) | CVE-2026-108865 | 8.8 (8.2) | through 0.10.0 | The built-in OAuth2 server never authenticates a resource owner: an unauthenticated caller registers a client, requests a code from `/authorize` and exchanges it at `/token` for a bearer token the MCP gate accepts, reaching OAuth-protected MCP prefixes, the proxied upstream APIs and the credentials the gateway injects into them. Same dynamic-client-registration class as Rill above and [Bifrost](2026-09-bifrost-mcp-client-registration-unauth-rce.md). | None. The write-up reviewed v0.10.0 and `main` as of 2026-10-11 and records no maintainer response; the repository has no `SECURITY.md`. |
| mcp-go (mark3labs) | CVE-2026-108859 | 8.7 (7.5) | through 1.2.1 | `StreamableHTTPServer.ServeHTTP` reads the whole POST body with `io.ReadAll` before any validation, so oversized or many concurrent bodies exhaust memory. DoS only. | None recorded for the DoS. The vendor tab carries one advisory, GHSA-xf6j-693p-wqxx (2026-10-09, High, no CVE): the OAuth client accepted the `resource` declared in well-known Protected Resource Metadata without checking it against the server addressed, so a malicious MCP server could obtain a token scoped to another resource; affected 0.48.0 through 1.2.0, **fixed 1.2.1** (PR #1053), reporter Theodoros Lampropoulos. That is the Go twin of the Python SDK's [issuer-validation bug](2026-09-mcp-python-sdk-oauth-issuer-validation-credential-redirect.md). |
| hyper-mcp (WebAssembly plugin MCP server) | CVE-2026-108698, CVE-2026-108699 | 8.3 (6.5) each | through 0.8.3 | `load_wasm` verifies the Cosign signature of a separately resolved tag rather than the manifest it loads, so a registry answering differently to the loader and to Cosign serves an unsigned plugin (CWE-367); and `cosign_verify_args()` accepts any signer identity and OIDC issuer by default, so a free Sigstore keyless certificate on an attacker's image passes (CWE-347). Plugins run with the configured host, filesystem and environment access. | None recorded. The vendor tab is empty. |
| MCP Kotlin SDK | CVE-2026-108714 | 8.7 | through 0.15.0 | Already in the table above; listed here because the vendor tab's three earlier advisories (GHSA-74gp-qhv5-v493, GHSA-f47c-p7wj-q7gx, GHSA-4x39-xh35-w96w) are all memory-exhaustion findings and none covers the WebSocket frame size. | None. |
| Odoo MCP (erpipe) | CVE-2026-108861 | 5.3 (4.3) | 1.0.0 through 1.3.2 | `execute_method` reaches `read` and `search_read` with denied field names, bypassing the field-level ACL the other tools enforce. | None recorded. |
| phpMyFAQ MCP server | CVE-2026-108851 | 4.8 (3.3) | through 4.1.10 | `faq_search` never applies user or group permission checks, so a connected client reads restricted entries. | None recorded. |
| mac-shell-mcp | CVE-2026-108953 | 8.5 (7.8) | "before 2.0.0" per the record | `execute_command` matched the command name against the allowlist but passed arguments to a shell, so an allowed `pwd` with a metacharacter argument runs any command as the server user without approval. A prompt injection is enough. | **Conflict.** The record's range implies 2.0.0 fixes it and references commit 932ce73 ("rebuild on confinement, allowlists and no shell (2.0.0)"), which removes seven policy-mutating tools, drops shell interpretation and builds the child environment from scratch. The repository has no releases page entries, and `npm view mac-shell-mcp` shows a single published version, 1.0.4 (2025-04-12). As of 2026-10-12 no npm release carries the fix. The reporter had filed a private advisory (GHSA-2h3j-235x-vx2q) on 2026-01-28, followed up in June and October with no reply (issue #45, 2026-10-04), and said a third-party CNA would be used after 2026-10-10, which is what happened. |

### Agent frameworks, plugins and gateways

| Product | CVE | CVSS 4.0 (3.1) | Affected | What it lets an attacker do | Fix on record |
|---|---|---|---|---|---|
| Katanemo Plano (LLM gateway) | CVE-2026-108863 | 8.7 (7.5) | through 0.4.37 | The generated Envoy config binds the admin interface to all interfaces on port 9901 with no authentication; `/config_dump` returns the WASM filter configuration with every configured LLM provider API key in plaintext. | None recorded. PyPI `planoai` latest is 0.4.37, the last affected version. |
| pinclaw (OpenClaw channel plugin, Nexting) | CVE-2026-108757 | 7.1 (6.5) | through 0.3.0 | `POST /pinclaw/send` skips the `authToken` check; port 18790 binds all interfaces by default; the body is delivered to the user's main OpenClaw agent session as user instructions. Blind prompt injection from anyone on the network. | None recorded. npm latest 0.3.0 (2026-05-20). Not on the OpenClaw vendor tabs; a companion-plugin finding of the kind the [Windows node batch](2026-09-openclaw-2026-8-1-advisory-batch.md) showed those tabs never carry. |
| mistral.rs (`mistralrs-code-exec`) | CVE-2026-108759 | 7.6 (6.8) | 0.9.0 through 0.9.4 | Sandboxed shell code names a symlink as an output or reuses a session with a symlinked input path and reads or overwrites files outside the sandbox with the server's permissions. | None recorded. PyPI `mistralrs` latest is 0.9.4. |
| MoAI-ADK (`moai init`) | CVE-2026-108751 | 4.8 (4.4) | through 3.1.2 | The template deployer stages through `<target>.moai-tmp`; a repository committing a symlink named `.claude/settings.json.moai-tmp` makes `atomicWriteFile` truncate and overwrite whatever the link points at. A write into the agent's own config file, from a cloned repository, is the [tensorlake](2026-10-tensorlake-npm-shai-hulud-hostage-token-wipe.md) persistence shape by a different route. | None recorded. |
| Abilityai Trinity | CVE-2026-108756 | 5.3 (5.4) | through 0.9.5 | Agent-scoped MCP API keys can perform the human-only Telegram binding operations: send through the owner's bot token, replace the binding, delete it. | None recorded. |
| Shepherd (citation-checker extra) | CVE-2026-108741 | 2.3 (3.1) | through 0.3.1 | The `public_url` guard resolves once and `fetch` re-resolves at connect time, so a planted reference URL with attacker DNS rebinds to internal addresses. | None recorded. |
| Company Research Agent | CVE-2026-108850 | 6.9 (5.3) | through 2.2.0 | Unescaped ReportLab markup in `/generate-pdf` lets an unauthenticated caller make the server fetch arbitrary hosts and return the responses inside the PDF. | None recorded. |
| iFlytek Astron Agent | CVE-2026-108864 | 2.3 (4.2) | through 1.1.2 | `POST /workflow/v1/resume` accepts another application's predictable Snowflake `event_id`, injecting into and reading the other tenant's paused workflow. | None recorded. |

Also on the listings and not opened: UnicomAI Wanwu (CVE-2026-108853, CVE-2026-108854, CVE-2026-108855, CVE-2026-108856), JeecgBoot (CVE-2026-108605, CVE-2026-108669, CVE-2026-108671, CVE-2026-108879, CVE-2026-108883), TencentCloud Octop's second record and the two houtini-ai `*-mcp` Low entries (CVE-2026-108786, CVE-2026-108787). Two VulDB records against Agno published the same day are a different reporter and a different CNA and have [their own file](2026-10-agno-tool-call-confirmation-gate-team-delegation-vuldb-cves.md).

What changed in the assessment: nothing in the status. Unla and Plano move the gateway shape from "any authenticated user reads the keys" to "anyone who can reach the port," and the mac-shell-mcp history shows the other way a research-CNA record arises: not a researcher skipping the vendor, but a vendor ignoring a private advisory for eight months.

## Update 2026-10-13: the batch continued, and the records with an audience here have their own file

The `agent` and `mcp` listings on 2026-10-13 showed the next block, dated 2026-10-12 and 2026-10-13, with the same shape (VulnCheck as CNA, no package metadata, issue and permalink references). Four of them concern products this corpus's readers run and are written up in [the Continue CLI / sandboxed.sh / deepsec / Network-AI file](2026-10-continue-cli-bash-rule-chaining-bypass-vulncheck-agent-sandbox-batch.md): Continue CLI's Bash prefix rules are bypassed by command chaining (CVE-2026-109560, no fix), sandboxed.sh attached shells to container workspaces with the host root visible (CVE-2026-109569, 9.3, opt-in flag), Vercel deepsec extracted sandbox result tarballs with plain `tar` (CVE-2026-109375, fixed 1.1.17 in May), and Network-AI's Claude Code PreToolUse hook matched deny patterns against one field (CVE-2026-109331, fixed 5.15.2). Also on the listings and not opened: EdgeEver (CVE-2026-109557, CVE-2026-109558), TinyLLaVA (CVE-2026-108957) and the FreeRDP and OTRS rows, which are out of audience. Nothing in this file's own tables changed; the registry checks of 2026-10-12 were not repeated.


## Update 2026-10-15: two agent control planes with allow-all defaults, holaOS and NullHub

Three more VulnCheck records dated 2026-10-14 share the wave's shape (hackmd write-up by the second reporter, permalinks, no vendor response, no fix):

- **holaOS, CVE-2026-110769 (8.3) and CVE-2026-110768 (6.3), through 2026.822.1.** holaOS (`holaboss-ai/holaOS`, about 11,400 stars) is a local-first agent workspace whose channel gateway connects a workspace agent to Telegram, Slack and Discord. The per-connection `allowFrom` sender list is the only authorization, and an empty list, which the environment quick-connect path leaves empty, accepts every sender; for Telegram `requireMention` is also off, and direct messages on Slack and Discord skip the mention check. Anyone who can message the bot can hand the agent a task, and the agent runs with the workspace tool set, which the write-up says can include runtime, browser and MCP tools and a coding-agent harness with shell and filesystem reach. The second record: when an allowlist is configured, Telegram entries can be `@username` handles matched against the sender's current handle, and a released handle re-registered by someone else inherits the authorization; the numeric sender id is the stable identity and is not what is matched. The write-up is a static review of the `main` branch at a 2026-08-21 commit, states that runtime behaviour and any tool-confirmation step were not tested, and records no vendor response. The repository publishes no release tags, so the record's `2026.822.1` is the only version line.
- **NullHub, CVE-2026-110616 (9.2), through 2026.5.29.** NullHub (`nullclaw/nullhub`, about 1,800 stars) is the management console for the NullClaw agent ecosystem, written in Zig. Its `/api/` routes carry bearer-token code, but the token is never assigned at startup and the handler enforces the check only when a token exists, so authentication is off in every build; the record's affected product is NullClaw's hub, not OpenClaw. Exposure needs the server bound to a non-loopback address (`--host`); the default is 127.0.0.1. An unauthenticated caller on the port can read instance status, configuration and logs and start, stop, update or delete managed instances. The write-up is marked "pending submission" and the CNA record cites the `v2026.5.29` source and Dockerfile; no fix.

Both are the same class as the 9router, Unla and mini-swe-agent records above and as OpenClaw's early pairing bugs: the control plane in front of an agent trusts whoever reaches it. If you run either, make the sender list default-deny (holaOS) or keep the hub on loopback behind an authenticating proxy (NullHub) until a fix exists. The same day's Komodo Periphery record (CVE-2026-110631, 9.3, a different reporter, CERT/CC VU#456950) is a container-management agent outside this corpus's audience and is noted, not tracked.

## Update 2026-10-17: LangChat, an unauthenticated REST API in front of stored passwords and provider keys (CVE-2026-111704, 9.3), same reporter profile, source-only

- **LangChat, CVE-2026-111704 (VulnCheck, 2026-10-16, CVSS 4.0 9.3, 3.1 9.8, CWE-306), through commit 2a6285a.** LangChat (`LangChat/langchat`) is a Java Spring Boot and LangChain4j agent platform with an admin console, model registry and knowledge bases. The record says no Sa-Token interceptor is registered, so the REST controllers answer without login; the referenced hackmd write-up by hieuPenguinnn (the Archon and holaOS reporter) says only two auth endpoints carry a login-check annotation, that `/api/v1/auth/users` returns stored passwords the login endpoint accepts as-is, that provider API keys and base URLs, datasource connection records and live schema introspection are readable, and that accounts, including a super-admin, can be created. Preconditions: network reach to the backend port, default 8080. The write-up is explicit that it is a static source review: "Runtime validation was not performed." No release tags, no fix, no maintainer contact recorded, no advisory on the repository. The record's version is a commit on the default branch, so there is no "upgrade to" line to give.

Same class as Archon, Unla and Plano above: the control plane holds every provider key and trusts whoever reaches it. If you run LangChat, put an authenticating gateway or allowlist in front of port 8080 now, rotate the provider keys and passwords it stores if it was ever internet-reachable, and verify the exposure in your own deployment, because the finding has not been run against a live instance.

## Am I affected?

```bash
# Agent frameworks and MCP packages from the batch
pip show mini-swe-agent 2>/dev/null | grep -i version          # affected: 1.10.0 to 2.4.6 (all current releases)
grep -rn "BubblewrapEnvironment\|environment_class.*bubblewrap" ~/.config/mini-swe-agent* *.yaml 2>/dev/null
npm ls -g 9router @1mcp/agent @open-multi-agent/core argocd-mcp mcp-remote 2>/dev/null
npm ls 9router @1mcp/agent @open-multi-agent/core argocd-mcp mcp-remote 2>/dev/null
grep -rn "mcp-remote" ~/.claude.json ~/.cursor/mcp.json ~/.config/Code/User/settings.json 2>/dev/null | grep -- "--device-code"
# Hermes Agent config written by 9router: any hook is suspect
grep -n "hooks\|post_llm_call\|hooks_auto_accept" ~/.hermes/config.yaml 2>/dev/null
# MCP Kotlin SDK pin
grep -rn "io.modelcontextprotocol" build.gradle* gradle/libs.versions.toml 2>/dev/null
# Added 2026-10-12
grep -rn "github.com/mark3labs/mcp-go" go.mod 2>/dev/null                     # OAuth fix 1.2.1; DoS unfixed through 1.2.1
npm ls -g pinclaw mac-shell-mcp 2>/dev/null; grep -rn "pinclaw\|mac-shell-mcp\|hyper-mcp" ~/.claude.json ~/.cursor/mcp.json ~/.openclaw 2>/dev/null
pip show planoai mistralrs moai-adk 2>/dev/null | grep -i "^name\|^version"
ss -ltnp 2>/dev/null | grep -E ':(9901|18790) '                                 # Plano admin, pinclaw: should not be on 0.0.0.0
```

- **mini-swe-agent:** affected only if you selected the Bubblewrap backend and run it with secrets in the host environment. The default local backend offers no isolation, so the practical exposure is the same: a task that reads untrusted content can read your keys. Unattended or `--yolo` runs remove the approval step that would otherwise show the command.
- **9router:** affected if the Hermes integration is configured and anyone untrusted can reach the dashboard. With `requireLogin` off, that is anyone on the network.
- **mcp-remote:** affected only on the `--device-code` grant against a server whose discovery metadata points at a plain-HTTP endpoint off loopback. Standard browser-redirect flows are not in this record.
- **Hosted platforms (Suna, OpenLIT, Octop, LLMGateway, Honcho, Rill):** affected if you self-host a listed version and let more than one trust level sign in.

## If you are affected

1. **mini-swe-agent and the other sandboxes:** take long-lived keys out of the runner's environment until a release adds `--clearenv` (the researcher's proposed fix) and re-injects only what the agent needs; run sandboxed tasks with networking unshared; keep command approval on for untrusted repositories. If a task has already processed untrusted content with keys present, rotate them: [playbooks/if-your-local-ai-agent-was-exploited.md](../playbooks/if-your-local-ai-agent-was-exploited.md), [playbooks/rotating-cloud-credentials.md](../playbooks/rotating-cloud-credentials.md).
2. **9router with Hermes:** keep `requireLogin: true`, restrict dashboard access, and audit `~/.hermes/config.yaml` for hook keys you did not write. Treat an unexpected hook as a compromise of that user account.
3. **mcp-remote:** do not use `--device-code` against a server you do not control until a release enforces HTTPS; prefer a client that speaks Streamable HTTP natively. If you did, revoke the tokens that flow issued: [playbooks/if-an-mcp-server-was-malicious.md](../playbooks/if-an-mcp-server-was-malicious.md).
4. **argocd-mcp, 1MCP, Rill:** scope the token the server holds to the least it needs, and treat a model-supplied identifier as untrusted input to every tool. Watch each repository for a release that references the CVE.
5. **MCP Kotlin SDK servers:** put the WebSocket endpoint behind a proxy that enforces a frame and message size limit until the SDK does.
6. **Added 2026-10-12. Unla and Plano:** take the gateway off routable interfaces now; for Plano, firewall port 9901 and rotate every provider key in its config, because the admin page has been printing them to anyone who asked; for Unla, disable or restrict dynamic client registration and treat every upstream credential the gateway injects as exposed. **mcp-go:** upgrade to 1.2.1 for the OAuth fix and put a body-size limit in front of the Streamable HTTP endpoint. **hyper-mcp:** pin plugin images by digest and set an explicit signer identity and issuer; the defaults verify nothing. **pinclaw:** stop the plugin or bind it to loopback until a release checks the token on `/send`; an exposed instance has been taking instructions from the network since May. **mac-shell-mcp:** remove it; the fixed code exists only in the repository and the npm package is the vulnerable 1.0.4. [playbooks/if-an-mcp-server-was-malicious.md](../playbooks/if-an-mcp-server-was-malicious.md) covers the token revocation in each case.

## Prevention

- **A sandbox that inherits the host environment is a sandbox for the filesystem only.** Start sandboxed commands from an empty environment and pass secrets through a scoped file or a short-lived token: [prevention/agent-sandboxing.md](../prevention/agent-sandboxing.md).
- **Anything the model supplies to a tool is attacker input.** Path segments, identifiers, URLs, SQL and config values each need validation at the tool boundary, not in the prompt: [prevention/mcp-hygiene.md](../prevention/mcp-hygiene.md).
- **The LLM router or gateway holds every provider key.** Give it its own network segment, its own login, and keys you can revoke per consumer: [prevention/credential-hygiene.md](../prevention/credential-hygiene.md).
- **Watch the CNA records, not the vendor tabs, for products this size.** None of the 22 records had a vendor advisory on the sweep date; the database listings and the VulnCheck index were the only signal.

## Update 2026-10-28: nine more VulnCheck records on 2026-10-27, all MCP tools that pass tool parameters to a shell, including a Gemini CLI extension (CVE-2026-117560); no fixes on the records

VulnCheck published nine records on 2026-10-27, six credited to one reporter (Nguyễn Văn Tiến) and three with no credit (ai-sdlc, DroidMind, hagent), each referencing a GitHub issue on the project and a source line, with no fix version on any record: **ai-sdlc MCP Server** through 0.31.2, command injection via `check_issue` and `check_pr_status` (CVE-2026-117558, 8.5 / 7.8; the record references a fix commit 717d7ec on the project); **DroidMind** through 0.4.0, a shell allowlist bypass (CVE-2026-117559, 8.5); **sf-mcp** through 1.3.2, OS command injection via Salesforce CLI flag values (CVE-2026-117561, 8.5); **esp-mcp** through commit 28afddf (CVE-2026-117567, 8.5); **mcp-ffmpeg** through 1.0.5, via `videoPath` and `outputDir` (CVE-2026-117568, 7.3); **Kali-GPT** through commit a608c74, via scanner tool parameters (CVE-2026-117569, 8.5); **nmap-mcp** through commit 3636afa, a permissive NSE script allowlist (CVE-2026-117570, 4.8); **hagent** through commit 761eec6, via Arduino and ESP32 MCP tools (CVE-2026-117573, 8.5); and **ATXP Gemini CLI extension** through 1.0.0, OS command injection in `runAtxp()` through unsanitised MCP tool parameters (CVE-2026-117560, CVSS 4.0 8.5, 3.1 7.8, credited to the same reporter, reference `atxp-dev/atxp` issue #15 and `src/server.ts`). The ATXP record is the one with an audience: the CNA description says instructions planted in email or SMS content the extension reads can carry shell substitutions into parameters such as `message_id`, `subject` or `query`, which run as the user, so a Gemini CLI user with the extension installed is exposed to the content of their inbox. The database lists all nine on the `mcp` listing dated 10-27 with no package field. The shape is this file's: the records are VulnCheck's reading of the source, the projects are single-maintainer, and "through commit X" means no release has moved past the finding. Remove what you do not need; for ATXP, uninstall the extension until a release past 1.0.0 states a fix.

## Update 2026-11-06: VulnCheck issued CVE-2026-123272 for mcp-go's OAuth resource bug and CVE-2026-123271 for the same bug in ChatCLI, both from the researcher who reported them in October

The vendor-advisory-only item in the 2026-10-12 table now has an id. On 2026-11-05 VulnCheck published [CVE-2026-123272](https://github.com/advisories/GHSA-h3x9-8c36-m89w) for mark3labs/mcp-go: "OAuthHandler.fetchServerMetadata" accepted the `resource` a server declared in its well-known Protected Resource Metadata without checking it against the server addressed, so "attackers can declare a different MCP server as the RFC 8707 resource indicator, causing the authorization server to mint tokens the attacker replays against that resource." The CNA record carries two scores for one description: CVSS 4.0 5.1 Medium (`AT:P`, `UI:A`, subsequent-system confidentiality and integrity High) and CVSS 3.1 8.0 High; the vendor advisory [GHSA-xf6j-693p-wqxx](https://github.com/mark3labs/mcp-go/security/advisories/GHSA-xf6j-693p-wqxx) (2026-10-09, reporter Theodoros Lampropoulos) says High with no vector. Affected 0.48.0 through 1.2.0, fixed 1.2.1, which the Go module proxy dates 2026-10-09 08:34 UTC, one day after 1.2.0; the newest release is 1.5.0 (2026-10-30). The release note for 1.2.1 is one line, "fix(oauth): validate resource in well-known protected resource metadata" (PR #1053). The record was published to the GitHub database the same day as "Unreviewed" with no package, so a `go.mod` scanner keyed on the database may not flag it.

The same day VulnCheck published [CVE-2026-123271](https://github.com/advisories/GHSA-2gm2-hpg7-78f2) for ChatCLI, a Go terminal LLM client with MCP support, from the same reporter and with the same two scores: its MCP OAuth login "uses server-supplied Protected Resource Metadata as the resource indicator without checking it matches the configured server URL." The vendor advisory [GHSA-95vg-3r9c-2v5q](https://github.com/diillson/chatcli/security/advisories/GHSA-95vg-3r9c-2v5q) (2026-10-11, High, CVSS 3.1 8.0) adds that `resource_metadata` from a `WWW-Authenticate` challenge was followed on any origin and that discovery documents had no size cap; affected 1.159.0 through 1.215.1, fixed 1.215.2 (Go proxy 2026-10-11), newest 1.228.0 (2026-11-03). Its workaround line is the reader action for both products: after upgrading, log out of any MCP server you did not trust and revoke the client at the authorization server, because a token minted for the wrong resource stays valid until revoked.

Both are client-side instances of the rule the MCP authorization specification (2025-06-18) states for clients: the `resource` parameter "MUST identify the MCP server that the client intends to use the token with" and use its canonical URI. The server-side twin, a server accepting a token minted for another resource, is the pair of official-SDK advisories in the [Python SDK file](2026-09-mcp-python-sdk-oauth-issuer-validation-credential-redirect.md) (CVE-2026-116684 and the TypeScript GHSA-rvq5-wwqv-78pq), where the fix is a setting an upgrade does not turn on.

```bash
grep -n 'github.com/mark3labs/mcp-go ' go.mod go.sum 2>/dev/null     # need >= v1.2.1 for the OAuth fix; the DoS (CVE-2026-108859) has no fix through 1.2.1
go list -m github.com/diillson/chatcli 2>/dev/null                    # need >= v1.215.2; then /mcp logout <server> for untrusted servers
```

## Update 2026-11-07: VulnCheck issued CVE-2026-49951 for a RAGFlow SSRF through the LLM-provider `base_url`, fixed in 0.27.0, another record whose product shipped the fix before the id

CVE-2026-49951 (VulnCheck CNA, published 2026-11-06, CVSS 4.0 5.3 `AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L`, CVSS 3.1 6.3): "RAGFlow before 0.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to force the server to issue requests to arbitrary internal or external endpoints by supplying an unvalidated base_url to the POST /v1/llm/set_api_key endpoint handled by set_api_key() in api/apps/llm_app.py", which the record says reaches "MySQL, Elasticsearch, Redis, MinIO, the Infinity vector database, and cloud metadata endpoints" with raw upstream exception text in responses. The record references PR #17641, commit b058229 and the v0.27.0 release; the database row GHSA-ghwm-jvhv-h9gp (unreviewed, 2026-11-06, CWE-918) lists no package. The v0.27.0 release page shows "19 Aug" with no year and a long list of dependency CVE lines, none of which names SSRF, `set_api_key` or `base_url`; the fix is a silent one on the release page and a dated one on the record. As with mcp-go and ChatCLI in the 2026-11-06 update, and unlike the October records above, there is a vendor fix to upgrade to: RAGFlow 0.27.0 or later. The "set the provider's base URL" form is the same shape as the [LLM-router files](2026-09-ro1me-open-source-agent-framework-llm-output-execution-cve-wave.md) in this corpus: any UI field that takes a provider endpoint is a server-side fetch an authenticated user controls.

## Update 2026-11-10: two VulnCheck records on 2026-11-09, an agent approval allowlist that trusts `find` (OmniAgent, no fix) and a sub-agent authorization bypass in NocoBase's AI plugin

**OmniAgent, CVE-2026-125368 (2026-11-09 23:27 UTC; CVSS 4.0 7.7, CVSS 3.1 7.5).** The record says OmniAgent "through commit 12b98c5 contains an approval bypass vulnerability in ReflexionAgent._is_safe_bash_command that treats any command starting with find as safe without inspecting -execdir arguments", so a prompt-injected agent can run other binaries through `find` "without human approval". The affected range is a commit hash, the references are a GitHub issue (#67) and a source line, and no fix commit or release is referenced. No registry package is named. This is the safe-command-allowlist class that recurs across this file: a prefix match on a command name is not a statement about what the command does. Treat it as unfixed. If you run OmniAgent, do not rely on its approval gate for shell commands and run it in a container with no credentials mounted.

**NocoBase plugin-ai, CVE-2026-125397 (2026-11-09 23:28 UTC; CVSS 4.0 7.1, CVSS 3.1 7.1).** NocoBase is a self-hosted no-code platform with an AI employees plugin. The record says plugin-ai 2.1.0 through 2.2.41 "contains an authorization bypass vulnerability in getAccessibleAIEmployee() that lets authenticated users access unassigned AI employees by overriding the role-derived filter with a supplied username", so a signed-in user can run an AI employee they were not granted, with that employee's tools and permissions, through the sub-agent dispatch tool, and read its prompts and tool configuration. The record references a fix pull request (#11009) and commit and states no fixed version; the range ends at 2.2.41. The pull request and the NocoBase release list were not opened this run, so this file names no "upgrade to" version: check the NocoBase releases for the first version after 2.2.41 that includes that pull request.

Neither product had a file here. Both records carry the VulnCheck CNA's 2026-11-09 timestamp, and the advisory database dated their rows 2026-11-10. Page 1 of the CNA's index that day held twenty other records (FFmpeg, ION-DTN, rConfig, Tasmota), which this corpus does not track.

## Sources
- [GitHub Advisory Database — GHSA-h3x9-8c36-m89w / CVE-2026-123272 (mcp-go)](https://github.com/advisories/GHSA-h3x9-8c36-m89w) and [GHSA-2gm2-hpg7-78f2 / CVE-2026-123271 (ChatCLI)](https://github.com/advisories/GHSA-2gm2-hpg7-78f2) — fetched 2026-11-06: both published 2026-11-05, Unreviewed, no package, CVSS 4.0 5.1; the CNA records at `cveawg.mitre.org` carry the 3.1 8.0 beside it. Vendor advisories [GHSA-xf6j-693p-wqxx](https://github.com/mark3labs/mcp-go/security/advisories/GHSA-xf6j-693p-wqxx) (2026-10-09) and [GHSA-95vg-3r9c-2v5q](https://github.com/diillson/chatcli/security/advisories/GHSA-95vg-3r9c-2v5q) (2026-10-11) fetched the same day; [mcp-go v1.2.1 release](https://github.com/mark3labs/mcp-go/releases/tag/v1.2.1); Go module proxy `.info` for v1.2.0, v1.2.1, v1.215.1, v1.215.2 and `@latest`; [MCP authorization specification 2025-06-18](https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization), the Resource Parameter Implementation section.
- [CVE-2026-110769](https://cveawg.mitre.org/api/cve/CVE-2026-110769), [CVE-2026-110768](https://cveawg.mitre.org/api/cve/CVE-2026-110768), [CVE-2026-110616](https://cveawg.mitre.org/api/cve/CVE-2026-110616) — CVE Services records (VulnCheck CNA, 2026-10-14), fetched 2026-10-15.
- [hieuPenguinnn, holaOS channel-gateway allow-all sender default](https://hackmd.io/@hieuPenguinnn/holaos-channel-gateway-allow-all-sender-default) — the two holaOS findings, the static-review scope, no vendor response.
- [NullHub write-up (second reporter profile)](https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/rJrLma3izg) — the unassigned token, loopback default, "pending submission".
- [holaboss-ai/holaOS](https://github.com/holaboss-ai/holaOS), [nullclaw/nullhub](https://github.com/nullclaw/nullhub) — what each product is, star counts, no release tags; read 2026-10-15.
- CVE Services (CNA: VulnCheck), fetched 2026-10-11, the affected ranges, scores, descriptions and references above: [CVE-2026-108592](https://cveawg.mitre.org/api/cve/CVE-2026-108592) (mini-swe-agent), [CVE-2026-108593](https://cveawg.mitre.org/api/cve/CVE-2026-108593) (9router), [CVE-2026-108586](https://cveawg.mitre.org/api/cve/CVE-2026-108586) (1MCP), [CVE-2026-108595](https://cveawg.mitre.org/api/cve/CVE-2026-108595) (Phi), [CVE-2026-108600](https://cveawg.mitre.org/api/cve/CVE-2026-108600) (open-multi-agent), [CVE-2026-108604](https://cveawg.mitre.org/api/cve/CVE-2026-108604) (Tabularis), [CVE-2026-108585](https://cveawg.mitre.org/api/cve/CVE-2026-108585) (argocd-mcp), [CVE-2026-108583](https://cveawg.mitre.org/api/cve/CVE-2026-108583) (zotero-mcp), [CVE-2026-108582](https://cveawg.mitre.org/api/cve/CVE-2026-108582) (GenOffice), [CVE-2026-108115](https://cveawg.mitre.org/api/cve/CVE-2026-108115) (Suna), [CVE-2026-108596](https://cveawg.mitre.org/api/cve/CVE-2026-108596) (OpenLIT), [CVE-2026-108581](https://cveawg.mitre.org/api/cve/CVE-2026-108581) (Octop), [CVE-2026-108716](https://cveawg.mitre.org/api/cve/CVE-2026-108716) (mcp-remote), [CVE-2026-108714](https://cveawg.mitre.org/api/cve/CVE-2026-108714) (MCP Kotlin SDK), [CVE-2026-108719](https://cveawg.mitre.org/api/cve/CVE-2026-108719) (LLMGateway), [CVE-2026-108711](https://cveawg.mitre.org/api/cve/CVE-2026-108711) (Honcho), [CVE-2026-108721](https://cveawg.mitre.org/api/cve/CVE-2026-108721) and [CVE-2026-108722](https://cveawg.mitre.org/api/cve/CVE-2026-108722) (the two open-computer-use projects), [CVE-2026-108725](https://cveawg.mitre.org/api/cve/CVE-2026-108725) (Cheshire Cat), [CVE-2026-108718](https://cveawg.mitre.org/api/cve/CVE-2026-108718) (Rill), [CVE-2026-108728](https://cveawg.mitre.org/api/cve/CVE-2026-108728) (Flyte), [CVE-2026-108710](https://cveawg.mitre.org/api/cve/CVE-2026-108710) (NornicDB).
- [VulnCheck — mini-swe-agent 1.10.0 through 2.4.6 Environment Exposure via BubblewrapEnvironment](https://www.vulncheck.com/advisories/mini-swe-agent-1.10.0-through-2.4.6-environment-exposure-via-bubblewrapenvironment) and [VulnCheck — mcp-remote 0.8.0 through 0.14.3 Cleartext Credential Transmission via --device-code OAuth Grant](https://www.vulncheck.com/advisories/mcp-remote-0.8.0-through-0.14.3-cleartext-credential-transmission-via-device-code-oauth-grant) — fetched 2026-10-11: published 10/10 and 10/11, CWE-526 and CWE-319, the credit, "fixed version: not stated." [VulnCheck advisories index](https://www.vulncheck.com/advisories) — fetched 2026-10-11: the twenty 10-11 entries, including the ten not opened.
- [HaiND — mini-swe-agent Bubblewrap backend leaks runner environment secrets into the sandbox](https://hackmd.io/@haind/minisweagent-bubblewrap-host-environment-leak) and [HaiND — 9router Hermes settings injection](https://hackmd.io/@haind/9router-hermes-config-injection) — fetched 2026-10-11: the mechanism, the "coordinated disclosure in progress" status, no maintainer response, no fix commit, the proposed fixes, the `--yolo` and `requireLogin` preconditions. The `@haind03` write-ups referenced by the 10-11 records (mcp-remote, LLMGateway, Rill, Cheshire Cat, e2b open-computer-use) returned HackMD sign-in boilerplate instead of content on the sweep date and are not cited.
- [SWE-agent/mini-swe-agent — issue #843 "Various issues"](https://github.com/SWE-agent/mini-swe-agent/issues/843) — fetched 2026-10-11: opened 2026-05-27, the P0 "local environment exposes host environment variables to prompt templates," closed 2026-06-03 by the maintainer asking for separate issues, no linked fix. [mini-swe-agent security advisories](https://github.com/SWE-agent/mini-swe-agent/security/advisories) and [SWE-agent security advisories](https://github.com/SWE-agent/SWE-agent/security/advisories) — fetched 2026-10-11: none published. [mini-swe-agent issue search "bubblewrap clearenv"](https://github.com/SWE-agent/mini-swe-agent/issues?q=bubblewrap+clearenv) — no results on 2026-10-11.
- [modelcontextprotocol/kotlin-sdk security advisories](https://github.com/modelcontextprotocol/kotlin-sdk/security/advisories) — fetched 2026-10-11: three earlier memory-exhaustion advisories (2026-06-02, two on 2026-09-03), nothing for the WebSocket frame finding.
- [kortix-ai/suna — release v0.13.52](https://github.com/kortix-ai/suna/releases/tag/v0.13.52) — fetched 2026-10-11: "07 Oct" (no year shown), the "Security hardening: tenant isolation for invites, usage and setup links … sandbox proxy access checks" line; SSRF not named.
- [GitHub Advisory Database — `mcp` listing sorted by published date](https://github.com/advisories?query=mcp+sort%3Apublished-desc) and [`agent` listing](https://github.com/advisories?query=agent+sort%3Apublished-desc) — fetched 2026-10-11: the 10-10 rows for Tabularis, argocd-mcp, zotero-mcp, GenOffice, 1MCP, Suna, open-multi-agent, Phi, 9router and mini-swe-agent, all unreviewed with no package metadata.
- Registries, checked 2026-10-11: `pip index versions mini-swe-agent` (2.4.6 latest), `npm view 9router version time.modified` (0.5.99, 2026-10-08), `npm view @1mcp/agent` (0.39.0, 2026-10-09), `npm view @open-multi-agent/core` (1.21.2, 2026-10-09), `npm view argocd-mcp` (0.9.0, 2026-08-11), `npm view mcp-remote` (0.14.3, 2026-09-21), `pip index versions zotero-mcp` (0.3.1, a different range from the record), `pip index versions openlit` (1.45.0, the SDK, not the 2.1.0 platform), `npm view genoffice` and `@genspark-ai/genoffice` (not found).
- Related in this corpus: [mcp-remote OAuth discovery batch](2026-09-mcp-remote-oauth-discovery-ssrf-cve-batch.md) (seven earlier findings, one researcher, same no-maintainer-response shape), [agent-framework / MCP CVE batch](2026-08-agent-framework-mcp-cve-batch.md) (argocd-mcp CVE-2026-82456 and the earlier 9router CVEs), [SWE-agent CVE-2026-75482](2026-08-swe-agent-inspector-path-traversal.md), [Bifrost dynamic client registration](2026-09-bifrost-mcp-client-registration-unauth-rce.md).

### Sources added 2026-10-12
- CVE Services (CNA: VulnCheck), fetched 2026-10-12, the ranges, CVSS 4.0 and 3.1 scores, CWEs and references in the update tables: [CVE-2026-108865](https://cveawg.mitre.org/api/cve/CVE-2026-108865) (Unla), [CVE-2026-108859](https://cveawg.mitre.org/api/cve/CVE-2026-108859) (mcp-go), [CVE-2026-108698](https://cveawg.mitre.org/api/cve/CVE-2026-108698) and [CVE-2026-108699](https://cveawg.mitre.org/api/cve/CVE-2026-108699) (hyper-mcp), [CVE-2026-108863](https://cveawg.mitre.org/api/cve/CVE-2026-108863) (Plano), [CVE-2026-108757](https://cveawg.mitre.org/api/cve/CVE-2026-108757) (pinclaw), [CVE-2026-108953](https://cveawg.mitre.org/api/cve/CVE-2026-108953) (mac-shell-mcp), [CVE-2026-108759](https://cveawg.mitre.org/api/cve/CVE-2026-108759) (mistral.rs), [CVE-2026-108751](https://cveawg.mitre.org/api/cve/CVE-2026-108751) (MoAI-ADK), [CVE-2026-108861](https://cveawg.mitre.org/api/cve/CVE-2026-108861) (Odoo MCP), [CVE-2026-108851](https://cveawg.mitre.org/api/cve/CVE-2026-108851) (phpMyFAQ), [CVE-2026-108756](https://cveawg.mitre.org/api/cve/CVE-2026-108756) (Trinity), [CVE-2026-108741](https://cveawg.mitre.org/api/cve/CVE-2026-108741) (Shepherd), [CVE-2026-108850](https://cveawg.mitre.org/api/cve/CVE-2026-108850) (Company Research Agent), [CVE-2026-108864](https://cveawg.mitre.org/api/cve/CVE-2026-108864) (Astron Agent).
- [VulnCheck — AmoyLab Unla through 0.10.0 OAuth2 Authentication Bypass via /authorize](https://www.vulncheck.com/advisories/amoylab-unla-through-0.10.0-oauth2-authentication-bypass-via-authorize) — fetched 2026-10-12: dated 10/11/2026, CWE-287, 8.8, credit hieuPenguinnn, no fixed version. [VulnCheck — mac-shell-mcp before 2.0.0 OS Command Injection via execute_command Arguments](https://www.vulncheck.com/advisories/mac-shell-mcp-before-2.0.0-os-command-injection-via-execute-command-arguments) — fetched 2026-10-12: dated 10/12/2026, CWE-78, 8.5, credit "Bandana (HackWitHer), APIsec Research Labs." [VulnCheck advisories index](https://www.vulncheck.com/advisories) — fetched 2026-10-12: the twenty 10-12 entries, of which mac-shell-mcp is the only one in this corpus's audience.
- [hieuPenguinnn — Unla MCP gateway OAuth self-issued token write-up](https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/amoylab-unla-oauth-self-issued-token-authz) — fetched 2026-10-12: reviewed commit 5da380b (v0.10.0) and `main` as of 2026-10-11, static review only, "coordinated disclosure pending," no maintainer response, no `SECURITY.md`, the proposed fixes. The page carries both "no CVE assigned yet" and the published CVE id.
- [mark3labs/mcp-go — GHSA-xf6j-693p-wqxx](https://github.com/mark3labs/mcp-go/security/advisories/GHSA-xf6j-693p-wqxx) — fetched 2026-10-12: published 2026-10-09, High, no CVE, CWE-346, affected 0.48.0 through 1.2.0, patched 1.2.1, commit 90d247e / PR #1053 / issue #1052, reporter Theodoros Lampropoulos. [mark3labs/mcp-go security advisories](https://github.com/mark3labs/mcp-go/security/advisories) — fetched 2026-10-12: that one entry. [hyper-mcp-rs/hyper-mcp security advisories](https://github.com/hyper-mcp-rs/hyper-mcp/security/advisories) — fetched 2026-10-12: none.
- [cfdude/mac-shell-mcp — issue #45 "Security advisory GHSA-2h3j-235x-vx2q awaiting response"](https://github.com/cfdude/mac-shell-mcp/issues/45) — fetched 2026-10-12: opened 2026-10-04 by hackwither, private report 2026-01-28, follow-ups in June and the week before, no maintainer comment, the 2026-10-10 deadline for a third-party CNA. [Commit 932ce73 "feat(security)!: rebuild on confinement, allowlists and no shell (2.0.0)"](https://github.com/cfdude/mac-shell-mcp/commit/932ce733cde07bb30b1f186303e6692dbb5d087a) — fetched 2026-10-12: seven tools removed, no shell interpretation, environment built from scratch, per-command argument allowlists, 2.0.0 in the title; no authoring date shown. [cfdude/mac-shell-mcp releases](https://github.com/cfdude/mac-shell-mcp/releases) — fetched 2026-10-12: "There aren't any releases here."
- [GitHub Advisory Database — `mcp` listing](https://github.com/advisories?query=mcp+sort%3Apublished-desc) and [`agent` listing](https://github.com/advisories?query=agent+sort%3Apublished-desc) — fetched 2026-10-12: the 10-11 and 10-12 unreviewed rows named above. [modelcontextprotocol/kotlin-sdk security advisories](https://github.com/modelcontextprotocol/kotlin-sdk/security/advisories) — fetched 2026-10-12: the three earlier memory-exhaustion advisories, still nothing for CVE-2026-108714.
- Registries, checked 2026-10-12: `npm view mac-shell-mcp time` (one version, 1.0.4, 2025-04-12; no repository field), `npm view pinclaw` (0.3.0, 2026-05-20; repository `ericshang98/pinclaw`), `pip index versions planoai` (0.4.37), `pip index versions mistralrs` (0.9.4).

### Sources added 2026-10-17
- [CVE-2026-111704, CVE Services record (VulnCheck CNA)](https://cveawg.mitre.org/api/cve/CVE-2026-111704) — published 2026-10-16; 9.3 and 9.8, through commit 2a6285a, CWE-306, credit hieuPenguinnn, the hackmd and VulnCheck references.
- [hieuPenguinnn, LangChat missing global auth and credential exposure](https://hackmd.io/@hieuPenguinnn/langchat-missing-global-auth-credential-exposure) — the static-review scope ("Runtime validation was not performed"), what is readable, the default port, no maintainer contact, no fix.
- [GitHub Advisory Database, query llm](https://github.com/advisories?query=llm+sort%3Apublished-desc) — the 2026-10-16 row (GHSA-hgqj-chvw-c4p5) that surfaced the record.
- **2026-10-28 update sources** — [CVE Services — CVE-2026-117558](https://cveawg.mitre.org/api/cve/CVE-2026-117558), [CVE-2026-117559](https://cveawg.mitre.org/api/cve/CVE-2026-117559), [CVE-2026-117560](https://cveawg.mitre.org/api/cve/CVE-2026-117560), [CVE-2026-117561](https://cveawg.mitre.org/api/cve/CVE-2026-117561), [CVE-2026-117567](https://cveawg.mitre.org/api/cve/CVE-2026-117567), [CVE-2026-117568](https://cveawg.mitre.org/api/cve/CVE-2026-117568), [CVE-2026-117569](https://cveawg.mitre.org/api/cve/CVE-2026-117569), [CVE-2026-117570](https://cveawg.mitre.org/api/cve/CVE-2026-117570), [CVE-2026-117573](https://cveawg.mitre.org/api/cve/CVE-2026-117573) (queried 2026-10-28: CNA VulnCheck, published 2026-10-27, titles, vendor and product, upper bounds, CVSS 4.0 and 3.1 scores, credits, the GitHub issue and source-line references, the ATXP description quoted in part); [GitHub Advisory Database — mcp listing, sorted by publication](https://github.com/advisories?query=mcp+sort%3Apublished-desc) (fetched 2026-10-28: the nine rows dated 10-27); [VulnCheck advisories index](https://www.vulncheck.com/advisories) (fetched 2026-10-28, pages 1 and 2: 10-27 rows are Semantic MediaWiki; the MCP records were not on the first two pages).
- **2026-11-07 update sources** — [CVE Services — CVE-2026-49951](https://cveawg.mitre.org/api/cve/CVE-2026-49951) — fetched 2026-11-07: VulnCheck CNA, published 2026-11-06, description quoted, affected `infiniflow ragflow` before 0.27.0, both scores with vectors, four references; [GitHub Advisory Database — GHSA-ghwm-jvhv-h9gp](https://github.com/advisories/GHSA-ghwm-jvhv-h9gp) — fetched 2026-11-07: unreviewed, Moderate 5.3, CWE-918, no package; [infiniflow/ragflow — release v0.27.0](https://github.com/infiniflow/ragflow/releases/tag/v0.27.0) — fetched 2026-11-07: "19 Aug", no year, dependency CVE lines only, no SSRF line; [GitHub Advisory Database — `llm` listing](https://github.com/advisories?query=llm+sort%3Apublished-desc) — fetched 2026-11-07: the 2026-11-06 row that surfaced the record.
- **2026-11-10 update sources:** [CVE Services: CVE-2026-125368](https://cveawg.mitre.org/api/cve/CVE-2026-125368) and [CVE-2026-125397](https://cveawg.mitre.org/api/cve/CVE-2026-125397), fetched 2026-11-10: VulnCheck CNA, published 2026-11-09, titles, descriptions, ranges, both scores and the references as described; the referenced issue, pull request and commit were not opened. [GitHub Advisory Database: `agent` listing](https://github.com/advisories?query=agent+sort%3Apublished-desc), fetched 2026-11-10 for the two rows dated Nov 10, 2026. [VulnCheck advisories index](https://www.vulncheck.com/advisories), fetched 2026-11-10: page 1 holds twenty records dated November 9, 2026, none of them these two.