Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-09-01 · source-backed
NVD published CVE-2026-79743 through 79750 between 18:17:19 and 18:17:20 UTC on August 31, all against the same MCP aggregator (NVD). CVE-2026-79748 lets any authenticated non-admin POST to /api/servers with arbitrary command and args, which MCPHub hands straight to child_process.spawn. The rest cover cross-tenant tool execution on servers a user cannot see, bearer keys granting a whole group when scoped to one server, SSRF with no loopback or RFC1918 blocking, an SSRF guard missing NAT64/6to4/Teredo IPv6 transition ranges, and MCPB manifest path traversal. Fixes are scattered across 0.12.13, 0.12.15, 1.0.29, 1.0.30, 1.0.31 and 1.0.32, so anything below 1.0.32 is exposed to something.
Each link below shares sources, entities, or timing with this story.
NVD posted nine advisories on August 25, clustering into one shape: a local server assuming a browser can't reach it. PraisonAI validated MCP origins with request_origin.startswith(allowed) against a localhost allowlist, so an attacker-registered localhost.attacker.com passes...
Ten days from spec to shipped client. That's fast even for this ecosystem. The MCP 2026-07-28 revision replaced the bidirectional stateful protocol with request/response. Every request now independently carries protocol version, client identity and capabilities. Cloudflare's t...
NVD published CVE-2026-81091 through 81102 plus 81735 at 17:20 UTC on August 27, with GitHub advisories confirming same-day publication rather than backlog indexing (NVD). Eight are an HTTP transport that binds broadly or never enables the DNS-rebinding host allow-list the und...
CVE-2026-75130, published August 18, covers Upstash's Context7 through 2.1.2: the Custom AI Instructions feature serves unsanitized content through the MCP server, so poisoned instructions can exfiltrate credentials from environment files to an attacker-controlled service and...
Token Security researcher Ariel Simon will present at RSAC 2026 a vulnerability chain starting from SSRF in Microsoft's Azure MCP server (CVE-2026-26118, CVSS 8.8). The managed identity token included in outbound MCP requests is capturable without admin access, then escalatabl...
CVE-2026-82021 (CVSS 9.0) covers Hermes Agent 0.18.2 through 0.19.0, where the bundled MCP catalog referenced a third-party upstream by branch name rather than commit SHA. Compromise the upstream and your code reaches every host installing that catalog entry, with zero operato...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.