Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-09-24 · high
Two flaws in GitLab's MCP integration let a scoped token act outside its lane and let search results leak between users, fixed in 19.4.1.
Why now: GitLab shipped the fix as part of the September 24 patch release.
GitLab shipped version 19.4.1 to fix two bugs in how it handles MCP tokens, the credentials that let AI agents call GitLab's API on a user's behalf.
MCP scoping exists so an agent can get narrow, revocable access instead of a full account token. A check that silently doesn't fire defeats that promise: you hand an agent read-only issue access, and the gap means it was never actually enforced.
CVE-2026-92874 is rated CVSS 5.4 and present since version 18.3. It let an authenticated user with an MCP-scoped token perform actions the token wasn't supposed to allow. GitLab was missing the authorization check that should have blocked it, per GitLab's patch release notes.
The second bug, CVE-2026-92628 (CVSS 3.1, present since 18.6), is a race condition in the MCP search tool. Shared state got mixed up under concurrent use, which could return one user's search results to a different user.
Hosted GitLab.com is already patched, so those users don't need to act. Self-managed instances that expose MCP to agents should upgrade to 19.4.1 now. The token-scope bug has been live since 18.3 and the search leak since 18.6.
The release notes don't say whether either bug was found through GitLab's own testing or reported externally, and they don't estimate how many self-managed instances ran MCP-enabled tokens during that window.
Watch whether GitLab publishes a broader audit of MCP scope enforcement. A missing check on one endpoint raises the question of whether other MCP-scoped actions got checked as carefully.
Each link below shares sources, entities, or timing with this story.
The most important security research this week. Check Point demonstrated three attack vectors in Claude Code exploiting project configuration files in untrusted repositories: (1) Hooks RCE (CVE-2025-59536, CVSS 8.7) — malicious hooks in .claude/settings.json execute shell comm...
The single biggest cross-agent story this week isn't one CVE. It's that MCP became the dominant agent-hijack surface, and this is the defense that actually stops it. The pattern across a dozen findings: Sentry's MCP server weaponized via fake error events for an 85% agent-hija...
The agent skills supply chain is under coordinated attack. Snyk's ToxicSkills audit found 36% of ClawHub's 3,984 skills contain prompt injection payloads, 13.4% have critical malware, and submission rates exploded 10x to 500+/day. This week alone: CVE-2026-2256 (CVSS 9.1) is a...
Full 10.0. Network vector, low complexity, no authentication, no user interaction, high impact on confidentiality, integrity and availability. CVE-2026-79696, published September 9, is a code injection flaw in adk web affecting Google's Agent Development Kit for Python 2.0.0 t...
The Model Context Protocol has a security problem that's no longer theoretical — it's statistical. Between January and February 2026, researchers filed 30+ CVEs against MCP servers, clients, and infrastructure. One package with nearly 500,000 downloads carried a CVSS 9.6 RCE....
Thirty CVEs in sixty days. That's the MCP ecosystem's security track record for 2026 so far, and the severity is climbing. Three disclosures dropped this week that should make anyone running agent infrastructure pause. First, PraisonAI, a popular multi-agent orchestration fram...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.