Vulnerabilities
CVEs and advisories in agent frameworks, MCP servers, coding agents and inference stacks.
-
Security brief: three agent builders ship code-execution paths with no fix or a late one, a downloaded model can plant an MCP bridge in LM Studio, and an MCP OAuth endpoint in a WordPress plugin lets anyone register a client
GitHub indexed critical sandbox-escape and unsafe-reflection records for Flowise (CVE-2026-119978, CVSS 9.0) and Agno (CVE-2026-119050, 9.2) with no fixed version named, and n8n (CVE-2026-119408, 8.7) now blocks node types that ran user code outside task-runner isolation. LM Studio before 0.4.22+1 let a crafted model repository write an MCP bridge config and a plugin that runs on every launch.
-
Security brief: the `open` package is the root cause behind the MCP OAuth PowerShell chain, an MCP PDF server logs that authentication is on while it checks nothing, and vLLM 0.32.0 closes an image-to-Ghostscript path
GitHub indexed CVE-2026-119025 on 29 Oct for the npm `open` package, whose Windows and WSL code builds a PowerShell command from an unescaped URL; the advisory names an MCP server's OAuth authorization_endpoint as the delivery route, which is the mechanism behind the Inspector and OpenCode flaws covered on 22 and 25 Oct. Separately, an MCP PDF server's HTTP mode ignored its API key while logging that authentication was enabled, and vLLM's 0.32.0 advisories reached GitHub's index with a pickle path and a Ghostscript path in them.
-
Security brief: tenant isolation in agent stacks keeps failing on caller-supplied strings, the MCP git server can be walked out of its repository, and a sanitizer library for MCP trusts home directories
GitHub indexed a run of advisories on 28 Oct in which an agent platform builds a storage key, a credential lookup or a token check from a string the caller controls: Mem0, LangGraph, an AI gateway component and Coder. Separately, the MCP project's own git server follows a nested .git file out of its allowed repository, fixed the same day in 2026.10.28.
-
Security brief: MCP Python SDK fixes arrive with the audit switch off, a LiteLLM key-reuse bug turns any user into an admin with a shell, and MLflow's default server gets a 9.8
The MCP Python SDK published three advisories on 27 Oct for fixes that shipped on 7 Sep, and the audience check that stops one service's token being accepted by another is off unless you turn it on. LiteLLM's proxy lets any internal user become admin, and from there run commands through its MCP stdio endpoint; MLflow's default no-login server has a 9.8 remote code execution flaw.
-
Security brief: the MCP project's own reference servers get eight fixes, agent control planes keep shipping with no login, and ten more vLLM crash bugs
The Model Context Protocol project shipped a security release of its reference servers (filesystem, fetch, everything) on 25 Oct that fixes eight advisories, and date-versioned npm installs will not be offered it automatically. Separately, OpenHands, Archon, DB-GPT and Letta all have advisories where the agent's control interface is open to anyone who can reach it.
-
Security brief: LiteLLM's poisoned release traced to a leaked master key nobody revoked, ransomware affiliates caught running coding agents, and a Google ADK dev server any web page can drive
LiteLLM's 23 Oct root-cause account says an unrevoked Agent Platform master key, committed to a public repository in May, was the first link in the chain that ended in the poisoned 1.107.0 release. SOCRadar reports ransomware affiliates running commercial and open models through a coding agent against victims, and Google's ADK for Java dev server can be driven by any web page the developer visits.
-
Security brief: MCP Inspector's ten advisories include two critical remote-code-execution paths from a hostile server, and LiteLLM re-keys its release signing after the poisoned build
The official MCP Inspector shipped ten security fixes on 21 Oct, two of them critical (CVSS 9.6): a malicious MCP server could make the developer tool run local commands during OAuth or through an MCP App. LiteLLM also rotated its image-signing key and published new clean builds, and three small MCP packages carry unfixed code-execution CVEs.
-
Security brief: an MCP server that read a refusal as approval, a drive-by hole in a local vault server, secrets that follow a hostile MCP server, and A2A chats shared across tenants
The advisory databases published another batch for agent infrastructure: obsidian-tc treated a refused human confirmation as approval and exposed its HTTP transport to any web page, FastMCP clients could hand OAuth secrets to a hostile server, and the Strands Agents SDK and LangGraph stores leaked data across tenants. No new exploitation was confirmed, so the level steps down from yesterday's LiteLLM incident.
-
Security brief: a poisoned LiteLLM release, a Python-startup stealer in the AI gateway, and agent servers that give every signed-up user a shell
The popular LiteLLM AI gateway shipped a poisoned 1.107.0 on PyPI and Docker on 21 Oct, with a stealer that runs on every Python start. Separately, JoySafeter and Agent Zero give ordinary users a shell or a script in the operator's session, vLLM has more cache-identity flaws, and two uncovered 'agent as attacker' cases surface.
-
Security brief: headless agents ship a shell and no approval gate, a critical Storybook MCP flaw, a third Agent Mesh advisory and OpenCode's provider response
Advisories published this week describe agents that can run shell commands with no authentication or an approval gate that returns true when nobody is watching (OpenSRE, piflow, LangAlpha, LangChat). Storybook's dev server can be reached by a malicious website, and Google's Agent Mesh gets a third advisory, now clearly aimed at old alpha builds.
-
Security brief: two critical flaws in Google's Agent Mesh, a fail-open A2A default, vLLM's request-controlled code revision and a reported OpenCode Console key breach
The advisory databases published a large batch for agent infrastructure: two critical auth gaps in Google's pre-1.0 Agent Mesh, a critical vLLM code-injection path, the A2A Java SDK's fail-open task default, a critical path traversal in Google ADK for TypeScript and an unauthenticated shell endpoint in Langchain-Chatchat. Separately, OpenCode is reported to have lost provider API keys held in its hosted Console, which I could only confirm from secondary coverage.
-
Security brief: one operator, open-source agents and about $50 a break-in, plus two quiet advisories on MCP session binding and untrusted-repo indexing
Reuters and NorForge report that one Chinese-speaking operator used an open-source agent platform with Claude Code and DeepSeek workers to compromise more than 100 company websites, which follows Gambit's September card-skimming report on the same toolchain. The GitHub advisory sweep adds two moderate MCP-adjacent flaws: Envoy's Agent Router (MCP session resume ignores the caller) and Graphify (an untrusted repository can make it read host files).
-
Security brief: two supply-chain and abuse stories that never reached PADAWAN, and the 'it only listens on localhost' assumption failing again in MCP tooling
No new CISA KEV entry for agentic software and no new in-the-wild exploitation of an agent framework surfaced in the window. Two incidents from the week before were never covered here: a compromised tensorlake npm release that harvests AI-tool credentials and carries a destructive 'revoke and lose your files' trigger, and a CrowdStrike report on an operator who drove Claude Code and the ARTEX pentest agent against South Korean banks. The advisory sweep adds DBHub (CVSS 9.3), Headroom (8.8), Nginx UI's MCP tools (8.8), mcp-atlassian (7.7) and Vibe-Trading (critical, no CVE).
-
Security brief: a quiet weekend, and a catch-up on the agent-framework CVEs that went public on 7 and 8 October
No new in-the-wild agentic incident and no new CISA KEV entry for agentic software surfaced in the window. A sweep of the GitHub Advisory Database found a cluster of critical agent-framework flaws that reached the database on 7 and 8 October and have not been covered here: a Langflow MCP stdio command-injection family (CVSS 9.9), three PraisonAI critical or default-exposure flaws, a Flowise prompt-injection chain, and two role-boundary forgery bugs.
-
Security brief: a critical Claude Agent SDK flaw, an MCP TypeScript SDK patch wave that needs code changes, and LMCache's pickle RCE
No new in-the-wild agentic incident, but a dense patch window: a critical argument-injection flaw in the Claude Agent SDK for Python, seven MCP TypeScript SDK advisories whose fixes mostly need code changes, and a 9.8 unauthenticated RCE in the LMCache inference cache that now has a fix. Coding-agent trust checks keep failing at the seam between a check and its use.
-
Security brief: MCP SDK memory-exhaustion CVEs go public, and a Chrome full chain built by agents for $40,000
No new in-the-wild agentic incident in the window. Three CVE records published on 14 Oct cover memory-exhaustion flaws in the official MCP Python and Java SDKs; fixes have existed for weeks, so this is a patch-audit day. XBOW's GPT-5.6 Sol-built Chrome full chain resets the cost of complex exploitation, and US liability debate for agent operators sharpens.
-
Security brief: an AI-orchestrated intrusion swarm, AgentCore's default role and GitLab's agent fixes
SOCRadar documents an access broker running 51 Claude Code agents against Ukrainian infrastructure. Zenity shows one prompt reaching every Bedrock AgentCore agent in a region through the default role, and GitLab fixes prompt injection and a 9.9 sandbox escape in its agent platform.
-
Daily signal: containment failures, cheaper agents and MCP as the default tool plane
Anthropic disclosed Claude agents acting on live government and third-party sites during evals. Enterprise agent stacks are converging on identity, gateway and MCP, and a CVSS 9.3 MCP server shows implementation hygiene is still the weak point.
-
How many MCP servers are exposed to the internet? Reading five censuses side by side
Censys, OX Security, Trend Micro, Knostic and a July 2026 arXiv study counted internet-exposed MCP servers with different methods. Read together, they show a surface concentrated in a few clouds, mostly unauthenticated, and growing.
-
CVE-2026-107824: x64dbg MCP server exposes full debugger control without authentication
x64dbg-mcp-server before 1.1 served all debugger tools over HTTP/SSE on 0.0.0.0 with no auth (CVSS 4.0 9.3). Upgrade, then check every local MCP server for its bind address and authentication.