Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-09-16 · source-backed
CVE-2026-53710, published September 15, affects MCP Context Forge before 1.0.2. The python_sandbox_server exposes raw getattr through safe_builtins, omits the _getattr_ guard, and relies on validate_code checking for literal dangerous dunder strings. Build the dunder names at runtime, walk the class hierarchy to subprocess.Popen, and you have OS commands as the server process. The HTTP/SSE transport can expose execute_code with no auth at all. This is the sandbox built to contain agent-generated code, and the containment is string matching.
Each link below shares sources, entities, or timing with this story.
Between September 14 and September 15, NVD published seven entries hitting MCP infrastructure. I read all of them expecting to find something clever. There's nothing clever in any of them. CVE-2026-57124, 9.8, published September 14. PraisonAI's default UI exposes POST /api/mc...
Full 10.0. Network vector, low complexity, no authentication, no user interaction, high impact on confidentiality, integrity and availability. CVE-2026-79696, published September 9, is a code injection flaw in adk web affecting Google's Agent Development Kit for Python 2.0.0 t...
The trick is one line in a file you never read. Manifold Security published eight findings across seven coding agents (Claude Code, Codex, Cursor, Grok Build, Qwen Code, goose, Hermes Agent) that all reduce to the same mechanism. A repository's own .git/config sets core.fsmoni...
CVE-2026-90474, published September 12 at CVSS 7.6, is an authentication bypass in MCPHub's embedded OAuth 2.0 authorization server: client authentication is off by default and PKCE enforcement is optional (NVD). Two days after the Langflow and ContextForge cluster, the same s...
OX Security researchers found a design-level flaw in Anthropic's Model Context Protocol STDIO transport that turns MCP tool invocations into OS command execution via configuration-to-command injection. Affected projects include LiteLLM (CVE-2026-30623, patched), Agent Zero, an...
Ten days from spec to shipped client. That's fast even for this ecosystem. The MCP 2026-07-28 revision replaced the bidirectional stateful protocol with request/response. Every request now independently carries protocol version, client identity and capabilities. Cloudflare's t...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.