Scroll over the globe to enter the agentic world
The MCP project documented enterprise-managed authorization support, and a maintainer note says the table rests on vendor claims, not tests.
Claude Code 2.1.316 (31 Oct) checks every model a request names against the organisation's allow and deny lists at the apps gateway and fixes restricted sessions that uploaded files from outside the working directories. MCP pull request 3306 on enterprise-managed authorization merged on 30 Oct, and the Events extension review kept adding security points.
Act now
- Take Flowise's custom-function route and builtin-dependency switch out of reach until a fixed build is named
Flowise up to 3.1.4 with ALLOW_BUILTIN_DEP=true is the affected configuration. Unset ALLOW_BUILTIN_DEP, block /api/v1/node-custom-function at the proxy for anyone who is not a trusted builder, and run Flowise in a container with no cloud credentials or other-service tokens in its environment. Watch the Flowise releases page: I found no fixed version.
From the security brief, 31 Oct 2026 - Upgrade n8n to 2.42.6, 2.43.3, 2.44.0 or 3.0.1 and re-save any workflow that uses Function, Function Item or LangChain Code nodes
The patched builds reject saving these nodes but let existing workflows keep running, so an upgrade alone does not close the path. Search your workflows for the three node types, replace them with the Code node, and as a stopgap add n8n-nodes-base.function, n8n-nodes-base.functionItem and @n8n/n8n-nodes-langchain.code to NODES_EXCLUDE. Do not set N8N_DEPRECATED_NODES_BLOCK=false.
From the security brief, 31 Oct 2026 - Upgrade DBHub to 0.22.6 and give its database account no write rights
0.22.6 carries both the DNS-rebinding fix from the 19 Oct item and the engine-level read-only enforcement; versions before it are affected by the new double-dash bypass on MySQL and MariaDB. Check with `npm ls @bytebase/dbhub`. Use a read-only database role regardless of the version.
From the security brief, 31 Oct 2026 - Find every Windows or WSL tool that opens a URL it got from an MCP server, and move it to open 11.0.0 or a build that has the fix
Run `npm ls open` (and `npm ls open --all`) in each Node-based MCP client, inspector, coding agent and desktop wrapper you ship or allow, and look for 7.2.0 up to before 11.0.0. The advisory's route is an OAuth authorization_endpoint supplied by an MCP server, so until fixed, developers on Windows and WSL should connect only to MCP servers they control. MCP Inspector 2.12.0 already carries its own fix (GHSA-q978-78c7-phqw). A search extract lists OpenCode 1.18.33 as the fixed build; I could not read the vendor page, so verify before relying on it.
From the security brief, 30 Oct 2026
Latest reports
Open the library-
Daily signal: Claude Code 2.1.316 makes the gateway enforce model policy and stops restricted sessions uploading outside the workspace, and MCP's enterprise-auth table merges with vendor claims it did not verify
Claude Code 2.1.316 (31 Oct) checks every model a request names against the organisation's allow and deny lists at the apps gateway and fixes restricted sessions that uploaded files from outside the working directories. MCP pull request 3306 on enterprise-managed authorization merged on 30 Oct, and the Events extension review kept adding security points.
-
Security brief: three agent builders ship code-execution paths with no fix or a late one, a downloaded model can plant an MCP bridge in LM Studio, and an MCP OAuth endpoint in a WordPress plugin lets anyone register a client
GitHub indexed critical sandbox-escape and unsafe-reflection records for Flowise (CVE-2026-119978, CVSS 9.0) and Agno (CVE-2026-119050, 9.2) with no fixed version named, and n8n (CVE-2026-119408, 8.7) now blocks node types that ran user code outside task-runner isolation. LM Studio before 0.4.22+1 let a crafted model repository write an MCP bridge config and a plugin that runs on every launch.
-
Daily signal: Claude Code 2.1.314 closes policy and sandbox gaps in resumed sessions and Monitor commands, MCP's extension lifecycle is merged, and Codex 0.166.0 adds secret substitution at the proxy
Claude Code 2.1.314 (30 Oct) fixes remote managed settings that stopped applying when the server was unreachable, sandbox protections missing in a worktree entered with --resume, and Bash hooks that did not run on Monitor commands, and adds a switch that blocks writes outside the working directories. SEP-3392 (Extension Lifecycle) was merged on 29 Oct, confirming that a Stable extension changes only with a new core revision.
-
Security brief: the `open` package is the root cause behind the MCP OAuth PowerShell chain, an MCP PDF server logs that authentication is on while it checks nothing, and vLLM 0.32.0 closes an image-to-Ghostscript path
GitHub indexed CVE-2026-119025 on 29 Oct for the npm `open` package, whose Windows and WSL code builds a PowerShell command from an unescaped URL; the advisory names an MCP server's OAuth authorization_endpoint as the delivery route, which is the mechanism behind the Inspector and OpenCode flaws covered on 22 and 25 Oct. Separately, an MCP PDF server's HTTP mode ignored its API key while logging that authentication was enabled, and vLLM's 0.32.0 advisories reached GitHub's index with a pickle path and a Ghostscript path in them.
-
Daily signal: MCP's Stable extensions can change only with a new core revision, the Events proposal keeps collecting security comments, and Tasks reaches Claude Code
The extension lifecycle proposal (SEP-3392) was approved and labelled final on 27 Oct, and its summary says a Stable extension changes only with a new core protocol revision, which answers yesterday's open question the wrong way for security fixes. The Events extension (SEP-3415) moved signing keys onto the Server Card on 28 Oct while review comments on header injection and logged subscription ids stay open.
-
Security brief: tenant isolation in agent stacks keeps failing on caller-supplied strings, the MCP git server can be walked out of its repository, and a sanitizer library for MCP trusts home directories
GitHub indexed a run of advisories on 28 Oct in which an agent platform builds a storage key, a credential lookup or a token check from a string the caller controls: Mem0, LangGraph, an AI gateway component and Coder. Separately, the MCP project's own git server follows a nested .git file out of its allowed repository, fixed the same day in 2026.10.28.