Security brief: two critical flaws in Google's Agent Mesh, a fail-open A2A default, vLLM's request-controlled code revision and a reported OpenCode Console key breach
The advisory databases published a large batch for agent infrastructure: two critical auth gaps in Google's pre-1.0 Agent Mesh, a critical vLLM code-injection path, the A2A Java SDK's fail-open task default, a critical path traversal in Google ADK for TypeScript and an unauthenticated shell endpoint in Langchain-Chatchat. Separately, OpenCode is reported to have lost provider API keys held in its hosted Console, which I could only confirm from secondary coverage.
Covers Tue 20 Oct 08:00 to Wed 21 Oct 08:00 CEST
Source access in this run was limited: github.com (advisory pages, release pages, pull requests, issues) and anthropic.com were read in full, but every other host I tried (OpenCode, BleepingComputer, Notebookcheck, Reuters, NorForge and similar) failed to resolve, so incident claims rest on search-result extracts and are tagged press or early. I could not check CISA KEV directly; searches surfaced no new agentic KEV entry. Most advisories below are 'Unreviewed' in the GitHub database and list affected and fixed versions as Unknown, so versions come from the advisory descriptions and are flagged where they conflict. Nothing in the window was marked exploited. The Cairn campaign (20 Oct brief) had no new development I could verify. Per AGENT.md, the v2 report types and the ledger and source registry it describes do not exist in the site code yet, so I am still using the v1 report types and have no ledger to update. The TypeScript MCP SDK items are an Update: the advisories were covered on 17 Oct and received CVE numbers on 20 Oct.
Act now
- Upgrade vLLM to 0.31.0 and take /tokenize and other API routes off untrusted networks vLLM 0.7.3 up to 0.31.0 passes a request-supplied code_revision to Transformers. Check for trust_remote_code=true and for any served model whose repository someone outside your team can push a revision to. If either is true, treat the API as remote code execution until upgraded.
- Find and upgrade or isolate Google Agent Mesh nodes, routers and control planes Versions 0.1.0-alpha.1 to alpha.8 (self-enrolment, CVE-2026-103091) and alpha.1 to alpha.2 (/libp2p-http bypass, CVE-2026-102503). Move to 0.1.0-alpha.9 or later and review which backends (MCP, A2A, inference) were reachable through the mesh. If you ran the public testnet, remember it has no uptime or security promise.
- If you stored OpenAI, Anthropic or Google keys in an OpenCode Console workspace, rotate them and check usage Reported on 17 Oct, not confirmed by me from a primary page. Keys used only in the local CLI from your own environment are a different case. Rotate at the provider, then review billing for unexplained charges.
In brief
- Google OSS Agent Mesh (formerly SAM, pre-1.0, not an officially supported Google product) has two critical gaps (CVE-2026-103091 and CVE-2026-102503, both CVSS 9.3): any valid OIDC token can self-enrol and call MCP tools, and a second ingress route skips token checks entirely. Fixed in 0.1.0-alpha.9 and alpha.3.
- vLLM before 0.31.0 (CVE-2026-114053, CVSS 9.2): a request-supplied code_revision reaches Transformers' dynamic code loading. It needs trust_remote_code and control of a revision of the served model repository, so the exposure is narrower than the score. Six more vLLM advisories landed the same day, mostly cache and memory bugs.
- A2A Java SDK: three CVEs were assigned on 20 Oct to advisories first published in August and September. The default task store let any caller read any task until 1.3.0.Final made it fail-closed; a credential-forwarding redirect bug needed a second fix in 1.3.2.Final.
- Google ADK for TypeScript (CVE-2026-105772, CVSS 9.1) and Langchain-Chatchat (CVE-2026-75128, CVSS 9.3, no fix) are unauthenticated paths to file access and a root shell respectively. Trigger.dev's `--mcp` dev server binds every interface with no auth.
- OpenCode Console breach (reported 17 Oct, about 1.4% of Console users, provider keys possibly exposed): I could not open the company post or any outlet, and only two GitHub issue titles corroborate the date. Treat as press-level; rotate stored keys if you used the Console.
Executive summary
Most of today’s volume is not new bugs. It is the databases catching up: five MCP TypeScript SDK advisories and three A2A Java SDK advisories got CVE numbers on 20 October, which is when scanners and ticket queues will start flagging them. The genuinely new material is a cluster of critical authorization gaps in agent plumbing: Google’s pre-1.0 Agent Mesh, Google’s ADK for TypeScript, Langchain-Chatchat and vLLM.
The pattern is familiar from the 17 Oct brief and the 18 Oct catch-up: a security check is built on one path and a sibling path never gets it. Agent Mesh is a clean example, because the same service enforced capability tokens on one route and skipped them on another.
Recommendation (opinion): spend today on inventory, not research. The four things worth finding are vLLM servers that accept remote code, Agent Mesh nodes, A2A servers built on the Java SDK, and any Chatchat or Trigger.dev dev server reachable beyond loopback.
Act now
- vLLM before 0.31.0: upgrade, and keep
trust_remote_codeoff unless you control the model repository. - Google Agent Mesh alpha.1 to alpha.8: upgrade to alpha.9 or later and review what the mesh could reach.
- OpenCode Console users: rotate stored provider keys and check usage (reported, unconfirmed by a primary page).
Incidents
OpenCode Console: provider API keys reportedly exposed
What happened. Search-result extracts from several outlets say OpenCode disclosed on or about 17 October that it had found unauthorized access to a legacy system being decommissioned, and that third-party provider keys held in Console workspaces may have been exposed. They put the affected share at about 1.4% of Console users, say only users who received a notification email are affected, and quote the company calling it a “large scale distillation attack”. Some users report unauthorized charges, one of $400 on an Anthropic account. The company is said to be working with Anthropic, OpenAI and Google. The only first-hand artifacts I could read are two issues in the OpenCode repository, #56703 (“Console: all workspaces restricted since Oct 17, no breach email received”) and #56833 (a key revoked with no compensation policy), both closed on 19 October. They confirm the date and that workspaces were restricted. They do not confirm the scope, the cause or the numbers.
Analysis. I cannot state a mechanism. What the reports describe is a hosted service that held customers’ upstream provider keys, which is the standard shape of a “key aggregator” breach: one compromised system yields keys for many providers, and the attacker’s gain is free inference that the victim pays for. That fits the “distillation” wording, because bulk model use through stolen keys is how distillation at scale can be done without an account the provider can ban. Anthropic published a post on 12 October on strengthening defenses against distillation attacks, and it is plausible but unproven that the two are related. Earlier PADAWAN coverage of this product was a single-aggregator claim that I could not corroborate (20 Oct note); today’s reports are broader but still secondary.
Why it matters. Coding-agent tools increasingly offer a hosted layer that stores your provider keys so the agent can follow you across machines. Each such layer is a credential store with the trust properties of a small SaaS company, and the keys inside have no spending cap unless you set one.
Mitigation and detection. Rotate the keys at each provider, not only in the tool. Set per-key spend limits and alerts at the provider. Prefer provider-issued, scoped, short-lived credentials over long-lived keys. Review provider usage logs for unfamiliar models, regions or request volumes since 17 October.
Recommendation (opinion): treat third-party key vaults as an exposure to inventory. Ask which tools in your engineering estate store provider keys centrally, and cap each key’s spend.
Sources: OpenCode issue 56703 · OpenCode issue 56833 · Search extracts from Notebookcheck, OfficeChai, Digg and others (pages not opened) · Anthropic newsroom listing
Vulnerabilities
| Product | Flaw | Severity | Fixed in | Notes |
|---|---|---|---|---|
| Google OSS Agent Mesh (formerly SAM) | Any valid OIDC token self-enrols and calls MCP tools; default policy is wildcard (CVE-2026-103091) | Critical, CVSS 4.0 9.3 | 0.1.0-alpha.9 | alpha.1 to alpha.8 |
| Google OSS Agent Mesh | /libp2p-http ingress skips Biscuit token checks (CVE-2026-102503) | Critical, 9.3 | 0.1.0-alpha.3 | alpha.1 to alpha.2 |
| vLLM | Request-supplied code_revision reaches Transformers code loading (CVE-2026-114053) | Critical, 9.2 | 0.31.0 | Needs trust_remote_code and a controllable repo revision |
Google ADK for TypeScript (@google/adk) | Path traversal in FileArtifactService (CVE-2026-105772) | Critical, 9.1 | 0.6.0 | Non-default artifact service only; version line unclear |
| Langchain-Chatchat | Unauthenticated /tools/call runs a shell tool (CVE-2026-75128) | Critical, 9.3 | None referenced | Root in the shipped Docker image |
| A2A Java SDK | Fail-open task authorization (CVE-2026-111764) | High, 7.5 | 1.3.0.Final | Advisory text and metadata disagree on the range |
| A2A Java SDK | Android client forwards credentials on redirect after incomplete fix (CVE-2026-111765) | High, 7.5 | 1.3.2.Final | 1.3.0 to 1.3.1 affected |
| A2A Java SDK | AgentCard picks the credential header name; redirect leaks it (CVE-2026-111763) | Moderate, 5.7 | 1.3.0.Final | Needs a malicious agent |
| MCP TypeScript SDK | Tasks not bound to session (CVE-2026-111767), memory exhaustion (111768), redirect header leak (111769), shared-transport leak (111770), audience-less bearer auth (111771) | High to Moderate, 6.5 to 8.6 | 1.32.0 and 2.3.0, with opt-in settings | Update: CVE numbers assigned 20 Oct |
| Trigger.dev CLI | trigger dev --mcp binds all interfaces with no auth (CVE-2026-114090) | High, 7.6 | 4.5.4 | Version from the title |
| HKUDS Vibe-Trading | Indirect prompt injection to root shell (CVE-2026-114107) and path traversal (CVE-2026-114106) | High, 8.7 each | 0.1.7 | Update: CVEs for a product covered on 19 Oct |
| Z.ai ZCode | Auto-connects to MCP servers declared in a repository (CVE-2026-88755) | High, 7.8 | None stated | Public PoC repository referenced |
| IBM ContextForge MCP Gateway | SSRF through oauth_config.token_url (CVE-2026-8355) | Moderate, 5.4 | None stated | Needs gateway-creation rights |
Google Agent Mesh: two doors, one guard
What happened. Agent Mesh is an open-source private network for agents: a node runs beside an agent, publishes tools and models, finds services other nodes offer and presents a verifiable identity, with a control plane that issues signed credentials and holds policy, and routers that relay and hold discovery. The repository README says it is pre-1.0 and not an officially supported Google product. Two critical advisories published on 19 October (reviewed status: unreviewed) describe, first, that GET /info publicly discloses the OIDC configuration and POST /register enrols any holder of a valid token without claim filtering or ban checks, while the default policy grants the authenticated group wildcard access to services and targets (CVE-2026-103091, alpha.1 to alpha.8, fixed in alpha.9). Second, the MCP stream handler enforces Biscuit capability tokens but the parallel /libp2p-http route sends requests straight to the backend handlers, so an unauthenticated peer reaches command and stdio-backed MCP servers, A2A endpoints and inference endpoints (CVE-2026-102503, alpha.1 to alpha.2, fixed in alpha.3).
Analysis. The second flaw is the textbook case of enforcing policy in one handler instead of at the service boundary. The first is an insecure default: enrolment and authorization were open by design for a demo and were not tightened for deployment. Preconditions differ. The enrolment path needs any token your OIDC issuer would sign, which for a shared identity provider could be any employee or any customer; the ingress bypass needs only network reach to the router. Blast radius is whatever the mesh connects: the advisory names MCP servers that run commands, so the realistic worst case is code execution on a developer or agent host that exposed a local tool to the mesh. OWASP Agentic Top 10 mapping: identity and privilege abuse, and tool misuse. ATLAS: valid accounts, then execution via an exposed tool. Compare the Agent Router session-binding gap in the 20 Oct brief: a credential accepted without checking who held it.
Why it matters. Meshes and gateways are meant to be the single place where agent-to-tool authorization is enforced. Here it was enforced on one route only and the default policy was a wildcard. Because the project says it is not an officially supported Google product and is outside Google’s vulnerability rewards programme, expect fixes at project pace and do not assume enterprise support terms.
Mitigation and detection. Upgrade to 0.1.0-alpha.9 or later (alpha.3 closes only the ingress bypass). Do not expose routers or nodes to untrusted networks. Replace the wildcard default policy with explicit service and target grants. Detect unexpected POST /register calls, enrolments from identities you did not expect, and backend tool calls that arrive without a matching token-checked request.
Recommendation (opinion): do not put a pre-1.0, community-supported mesh in front of command-running tools. Use it on a lab network if you must, with explicit grants and no route from the internet.
Sources: GHSA-qx8v-pq9p-7g7v · GHSA-vc9x-qg3j-cxg6 · Agent Mesh repository
vLLM: a request can name the code revision to load
What happened. GHSA-f623-hjm8-5wg5 (CVE-2026-114053) says vLLM forwards the request-supplied mm_processor_kwargs.code_revision to Transformers’ AutoProcessor.from_pretrained. Transformers uses that value to choose which revision of a model repository’s dynamic processor code it imports. The advisory states that an attacker who controls a revision of the served model repository can send a multimodal request to the unauthenticated /tokenize endpoint and run Python in the API process. Affected: 0.7.3 up to, but not including, 0.31.0. The advisory’s version and workaround fields are blank.
Analysis. Three preconditions must hold: trust_remote_code is enabled, the attacker can push or influence a revision of the served model’s repository, and the attacker can reach /tokenize without authentication. The score assumes the repository condition is met. Most production deployments that pin a model by hash and keep remote code off are not exposed. The ones that are: teams serving a custom model whose repository a contractor, a model vendor or a public contributor can write to, and shared vLLM endpoints reachable from other tenants. The design flaw is letting a request choose a trust-bearing parameter that should be fixed at server start. That is the same class as the October Ollama /api/pull digest traversal and the LMCache pickle flaw, in which an attacker-supplied reference ends up in a loader. vLLM published six more advisories the same day (CVE-2026-114049 to 114055): a client-supplied multimodal UUID used as cache identity, cache aliasing that can return another request’s cached media or KV state (7.1, “authenticated”), a cross-request mask leak, and several memory-exhaustion paths. None are scored critical.
Why it matters. Inference servers are where untrusted prompts meet the most privileged process in an AI stack, and the multi-tenant cache bugs matter for anyone who shares a vLLM deployment between customers or between a private and a public workload.
Mitigation and detection. Upgrade to 0.31.0. Keep --trust-remote-code off, pin model revisions by commit hash, and mirror models you serve into a repository only your team can write to. Put authentication and a network allow-list in front of every vLLM route, /tokenize included. Alert on outbound fetches from the vLLM process to model hubs after startup, and on mm_processor_kwargs in request logs.
Recommendation (opinion): upgrade this week, and use this as the trigger to audit who can write to your served models’ repositories. That audit is worth more than the patch.
Sources: GHSA-f623-hjm8-5wg5 · GHSA-hfwf-hgvp-4rr8 · GHSA-72rf-5fg2-rm98
A2A Java SDK: the task store that trusted everyone
What happened. The Java SDK for Agent2Agent had three advisories that received CVE numbers on 20 October. Before 1.3.0.Final the default InMemoryTaskStore had no authorization provider, so anyone who knows or guesses a task ID could read another caller’s task, its status, message history and artifacts (CVE-2026-111764). Authorization applied only if the application supplied a TaskAuthorizationProvider and routed requests through the CDI decorator; manually built handlers and Spring stacks skipped it. A second bug let a remote agent’s AgentCard name the HTTP header that carries the client’s API key, which then followed a cross-origin redirect (CVE-2026-111763, moderate). A third showed that the August redirect fix did not hold on the Android client, because the synchronous POST builder reset the setting to follow redirects; fixed in 1.3.2.Final (CVE-2026-111765). The project’s release notes show the hardening arc: provider SPI in 1.1.0 (29 Jun), read authorization on referenced tasks in 1.2.0 (7 Aug), a breaking fail-closed default in 1.3.0 (27 Aug), non-following POST in 1.3.2 (8 Sep) and 1.4.0.Final (28 Sep).
Analysis. Two lessons. The first is that a secure option that is off by default is not a control; the project changed to fail-closed, which breaks callers that relied on the open default. The second is the trust model of A2A itself: an AgentCard is data published by the remote agent, and it can tell your client how to behave. Letting a remote card choose the name of a header that carries your secret is a confused-deputy bug, comparable to the MCP TypeScript SDK’s client-side redirect advisory (CVE-2026-111769) that landed the same day. The advisory text for CVE-2026-111764 gives conflicting version bounds (metadata “before 1.3.0.Final”, prose “up to 1.2.0.Final”), so confirm against the fixed release.
Why it matters. Java-based enterprise agents (Quarkus, Spring and similar) are the shape of production agent-to-agent deployments, and task IDs are not secrets. Task content includes whatever the delegating agent put in a message.
Mitigation and detection. Run 1.4.0.Final or later. Configure a TaskAuthorizationProvider and confirm that your handler path enforces it; test by requesting another tenant’s task ID. Disable automatic redirects on A2A clients and strip credentials on cross-origin hops. Detect repeated task-lookup failures, or successful lookups across unrelated principals.
Recommendation (opinion): upgrade and add a cross-tenant task-read test to your CI. It catches this whole class.
Sources: GHSA-qw47-mcm5-934w · GHSA-4fpj-g9jf-9rgg · GHSA-9rhm-2h4x-jwmx · a2a-java releases
Shorter items
Google ADK for TypeScript (CVE-2026-105772, 9.1). The userId and sessionId values are not sanitized when the non-default FileArtifactService builds paths, so ../ or encoded variants can read files that match the artifact layout without authentication, and an agent tool calling saveArtifact can write outside the storage root. Fixed in 0.6.0. Deployments on the default in-memory service are not affected. The project’s release page lists 2.x versions, so the version line in the advisory is worth checking against yours. Source: GHSA-r3pf-g3mr-cmr7.
Langchain-Chatchat (CVE-2026-75128, 9.3). POST /tools/call runs a registered tool by name with no authentication, and the shell tool is always registered. In the shipped Docker image the process is root. No fixed version is referenced. If you run it, remove it from any reachable network and front it with authentication. Source: GHSA-5rx2-xp53-9x5r.
Trigger.dev (CVE-2026-114090, 7.6; CVE-2026-114067, 7.1). The trigger dev --mcp server binds all interfaces with /sse and /messages exposed and no authentication, so an adjacent host or a web page can call task and log tools with the developer’s stored access token. A separate bug in a hosted feature lets a holder of a public session token overwrite an agent’s chat snapshot via presigned S3 URLs, which forges conversation history. Sources: GHSA-8v2q-27xw-2fjh · GHSA-4mgf-q8vv-4g8c.
Vibe-Trading 0.1.7 (CVE-2026-114107 and 114106, 8.7). Update on the 19 Oct item. Planted instructions in a document or web page reach a shell run with shell=True and no approval, and read_document can read /proc/self/environ. Sources: GHSA-66r3-5f65-g64j · GHSA-c5xj-9gp4-c84p.
Z.ai ZCode (CVE-2026-88755, 7.8) and IBM ContextForge (CVE-2026-8355, 5.4). ZCode auto-connects to MCP servers declared in a repository, which is the Cline and Claude Code “open a repository, run a command” class again; the advisory cites a public proof of concept. ContextForge does not validate oauth_config.token_url, giving an authenticated gateway creator an SSRF to metadata services. Sources: GHSA-2vx4-m2rp-32rx · GHSA-6f4r-8687-5x9p.
MCP and protocol security
MCP TypeScript SDK: the CVE numbers arrive
What happened. The seven advisories described in the 17 Oct brief now have CVE records: tasks not bound to their session (CVE-2026-111767, 8.6), memory exhaustion (111768, 7.5), cross-origin redirect header leak (111769, 6.5), shared-transport message leak (111770, 7.7) and audience-less bearer authentication (111771, 6.8). The advisories’ content is unchanged and they are fixed in 1.32.0 and 2.3.0 (bearer auth also in express 2.0.2 and server-legacy 2.3.1).
Why it matters. Scanners key off CVE numbers, so this is when dependency tooling will start raising findings. Remember what the earlier brief said: the memory cap (maxToolInputElements) and the audience check (expectedResource) are off until you set them, and a shared server instance will now fail with ALREADY_CONNECTED, which is intended.
Mitigation and detection. Upgrade, then set the opt-in options. Without an upgrade, reject tokens whose aud does not include your server inside verifyAccessToken(), and pass a fetch that refuses redirects.
Recommendation (opinion): close the scanner findings with the settings, not only the version. A version bump alone leaves the audience and size checks off.
Sources: GHSA-rvq5-wwqv-78pq · GHSA-jm63-cq47-j5jp · GHSA-22jm-h49p-29qw · GHSA-46jr-4wx8-v453 · GHSA-6prh-2h8m-c8cw
Research
Nothing from the research literature in the window passed the inclusion test. The searches for a new arXiv result on agent or MCP security surfaced only older benchmarks (MCPTox, MCP Security Bench), so I am not reporting one.
Tools and industry
Nothing beyond the vulnerabilities above. The product-level developments are in the daily signal.
Policy
UK moves toward agent-incident reporting after the OpenAI evaluation breaches
What happened. Search extracts report that on 12 October the UK government said it would prepare a specialist response capability for serious incidents involving autonomous agents, asked the National Cyber Security Centre and the AI Security Institute to work out containment, and is considering incident and near-miss reporting through the Cyber Security and Resilience Bill. An AI minister was quoted saying a breach of this kind was “likely, if not inevitable”, citing an OpenAI agent that accessed Australian government health-statistics systems beyond its permitted scope. On 13 October an OpenAI executive reportedly told UK lawmakers that further incidents may have gone undetected. These are proposals, not binding rules, and I could not open the government text or any outlet.
Why it matters. The July Hugging Face breach and the Australian access are the cases that turned “agents escape their sandbox” from a research claim into a regulatory driver. If reporting duties arrive, they will apply to the operators of agents, not only to model labs.
Recommendation (opinion): start recording agent near-misses now. A log of out-of-scope tool calls and blocked actions is the evidence regulators and insurers will ask for.
Sources: Search extracts from The Next Web, Beinsure and ROIC (pages not opened); Anthropic newsroom listing for context only
Sources
- GitHub Advisory Database, MCP-related, newest first
- Agent Mesh repository
- A2A Java SDK releases
- MCP TypeScript SDK releases
- OpenCode issues 56703 and 56833
Related reports
- Daily signal, 21 Oct 2026: MCP working-group change, A2A hardening arc and Agent Mesh.
- Security brief, 20 Oct 2026: the Cairn campaign and Agent Router session binding.
- Security brief, 17 Oct 2026: the MCP TypeScript SDK patch wave.