Vibe Coding
Pattern: six MCP CVEs in 36 hours and every one is a missing boundary, not a clever exploit
NVD published CVE-2026-57124, CVE-2026-57139, CVE-2026-57134 (PraisonAI), CVE-2026-73496, CVE-2026-73497 (MCP Atlassian), CVE-2026-53708 (ContextForge) and CVE-2026-89141 (WordPress AI Engine) between 2026-09-14 and 2026-09-15. The root causes are four repeats of the same three mistakes: binding 0.0.0.0 with no auth, passing a caller-controlled path or command straight to the OS, and validating a hostname then re-resolving it. None required a novel technique. An MCP server audit that only checks those three things catches this entire batch.
Source
↳ Follow the thread