Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-09-21 · source-backed
NVD published it September 20 against 0-Gaurav-0 nexus-mcp at commit aed0026, where the nexus_reauth MCP tool passes its url argument into child_process.exec in src/auth/browser.ts. Remote command injection, public exploit, and no versioning in the project so there's nothing to pin to. Same shape as CVE-2026-93965 in SxDevOps a day earlier. The pattern is an MCP tool that shells out to open a browser and treats a model-supplied string as a command. If your server has a verb that launches anything, use execFile with an argument array and stop.
Each link below shares sources, entities, or timing with this story.
Between September 14 and September 15, NVD published seven entries hitting MCP infrastructure. I read all of them expecting to find something clever. There's nothing clever in any of them. CVE-2026-57124, 9.8, published September 14. PraisonAI's default UI exposes POST /api/mc...
CVE-2026-90474, published September 12 at CVSS 7.6, is an authentication bypass in MCPHub's embedded OAuth 2.0 authorization server: client authentication is off by default and PKCE enforcement is optional (NVD). Two days after the Langflow and ContextForge cluster, the same s...
The trick is one line in a file you never read. Manifold Security published eight findings across seven coding agents (Claude Code, Codex, Cursor, Grok Build, Qwen Code, goose, Hermes Agent) that all reduce to the same mechanism. A repository's own .git/config sets core.fsmoni...
Full 10.0. Network vector, low complexity, no authentication, no user interaction, high impact on confidentiality, integrity and availability. CVE-2026-79696, published September 9, is a code injection flaw in adk web affecting Google's Agent Development Kit for Python 2.0.0 t...
Your read-only flag is a claim, not a guarantee. Two independent Postgres MCP servers proved it on September 4. Postgres MCP Pro got CVE-2026-85620 at CVSS 9.2. The bug is one line of reasoning in safe_sql.py: the validator checks function names on FuncCall AST nodes. A functi...
NVD published CVE-2026-79743 through 79750 between 18:17:19 and 18:17:20 UTC on August 31, all against the same MCP aggregator (NVD). CVE-2026-79748 lets any authenticated non-admin POST to /api/servers with arbitrary command and args, which MCPHub hands straight to child_proc...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.