Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-09-25 · source-backed
CVE-2026-61742 affects DBHub before 0.22.5 in its documented HTTP transport mode. The server compared the Origin hostname against the Host hostname and then reflected Origin back, so after a DNS rebind any malicious web page can call execute_sql from the victim's browser. No prompt injection needed at all. The companion bug, CVE-2026-61788 (7.4, fixed in 0.22.6), is that readonly = true on execute_sql didn't make the underlying connection read-only. (GHSA-fm8p-53ww-hf6w) Both published September 24. Running DBHub over HTTP against a real Postgres or MySQL means upgrading and, separately, connecting with a database user that only holds read grants. A flag that claims read-only is a comment; a grant is a control.
Each link below shares sources, entities, or timing with this story.
NVD posted nine advisories on August 25, clustering into one shape: a local server assuming a browser can't reach it. PraisonAI validated MCP origins with request_origin.startswith(allowed) against a localhost allowlist, so an attacker-registered localhost.attacker.com passes...
Between September 14 and September 15, NVD published seven entries hitting MCP infrastructure. I read all of them expecting to find something clever. There's nothing clever in any of them. CVE-2026-57124, 9.8, published September 14. PraisonAI's default UI exposes POST /api/mc...
Your read-only flag is a claim, not a guarantee. Two independent Postgres MCP servers proved it on September 4. Postgres MCP Pro got CVE-2026-85620 at CVSS 9.2. The bug is one line of reasoning in safe_sql.py: the validator checks function names on FuncCall AST nodes. A functi...
Full 10.0. Network vector, low complexity, no authentication, no user interaction, high impact on confidentiality, integrity and availability. CVE-2026-79696, published September 9, is a code injection flaw in adk web affecting Google's Agent Development Kit for Python 2.0.0 t...
A single Rust binary running MCP and HTTP servers over a local data directory, at 7,975 stars with about 217 added September 22. Agents write observations through lifecycle hooks that consolidate into ordinary markdown you can grep, edit in Obsidian and diff as commits, with r...
The trick is one line in a file you never read. Manifold Security published eight findings across seven coding agents (Claude Code, Codex, Cursor, Grok Build, Qwen Code, goose, Hermes Agent) that all reduce to the same mechanism. A repository's own .git/config sets core.fsmoni...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.