Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-09-17 · source-backed
CVE-2026-61560 chains two defects in @zereight/mcp-gitlab. In SSE transport mode, the mode the project's own docker-compose.yaml uses, /sse and /messages carry no authentication middleware, exposing all ~100 tools. The upload_markdown tool then reads arbitrary local files through an unsanitized file_path. Read /proc/self/environ, lift GITLAB_PERSONAL_ACCESS_TOKEN, own the account. Fixed in 2.1.27, and distinct from the SSRF, DNS-rebinding and read-only-bypass advisories published a day earlier. Four advisories in two days on one server is a maintenance signal independent of the bugs.
Each link below shares sources, entities, or timing with this story.
On August 25 the advisory database published 20 advisories against PraisonAI and praisonaiagents: 1 critical, 15 high, 4 medium. The recurring pattern is authentication that's declared but never enforced. praisonai serve agents --api-key is silently ignored. AgentServer declar...
CVE-2026-59973: the fix for CVE-2026-39885 added a hostname denylist for OpenAPI external $ref dereferencing, but mcp-from-openapi 2.3.0 still reaches loopback via hostname resolution, redirects, or IPv4-mapped IPv6 syntax. FrontMCP 1.2.1 and current main both pin that depende...
CVE-2026-45018 covers Chainlit >=2.4.0rc0 <2.12.0. With features.mcp.enabled = true, POST /mcp accepts a user-controlled fullCommand for stdio transport. validate_mcp_command() checks the executable name against an allowlist and never inspects arguments, so npx -y -c '<command...
NVD posted nine advisories on August 25, clustering into one shape: a local server assuming a browser can't reach it. PraisonAI validated MCP origins with request_origin.startswith(allowed) against a localhost allowlist, so an attacker-registered localhost.attacker.com passes...
GHSA-5648-rgj9-v224 at CVSS 8.1 documents the safety controls operators actually depend on, and each one has a hole: a GraphQL query starting with a comma slips past the write-detection regex, execute_graphql never checks GITLAB_ALLOWED_PROJECT_IDS at all, --cookie-path/--use-...
CVE-2026-63127 (8.2) covers crates/rmcp/src/transport/auth.rs omitting the RFC 9728 resource field and never confirming the returned resource identifier matches the configured MCP server, so a hostile server publishes metadata for a different legitimate resource and you finish...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.