Agent stack advisories

Function-name validation never runs on RangeFunction nodes, so a blocked SELECT pg_read_file(…) succeeds when rewritten as SELECT * FROM pg_read_file(…), returning any file the database process can read. The fix was still an open pull request at publication. Run the server under a role without pg_read_server_files in the meantime.

The flaw executes attacker-supplied Python as root through the validate endpoint. VulnCheck logged over 50 hits within hours on August 30 and 360 by Monday; the requests read cached secret-key files and query environment variables holding OpenAI and AWS credentials. Network isolation and authentication in front of the endpoint are the mitigations on offer.

Intruders had been inside since August 8 via the critical TeamCity flaw JetBrains had disclosed in July and told everyone to patch; Cadence orchestrates on TeamCity and was missed. A full 2024 server backup left with them, along with AWS IAM credentials belonging to customers and staff. Rotate anything a Cadence run ever touched.

A Keeper Security write-up catalogues the exposure patterns: config files storing tokens in plaintext that get copied between machines or committed by accident, dev-time permissions shipping to production, and prompt injection from any document the agent reads. It cites CVE-2025-6514 in mcp-remote, with 400,000-plus downloads, as the supply-chain case.

OX Security disclosed a design flaw in the MCP STDIO transport affecting all official SDKs and roughly 7,000 public servers. Anthropic confirmed the behaviour is intentional and declined to modify the protocol, placing sanitization responsibility on developers — so this is a standing property of the transport, not a bug awaiting a patch.

Air Security found that the agents check out a plugin’s pinned commit SHA but never verify that the working tree matches it, so whoever controls the plugin repository can make the checkout resolve to different code while the pin still reads as honoured. Claude Code and Codex update installed plugins by default, which made it zero-click; both were fixed in June, before public disclosure. Google deprecated Gemini CLI instead of patching it, and as of September 27, 2026 GitHub had published neither a fix nor a deprecation for Copilot plugins installed from hosts other than GitHub.

Manifold Security disclosed eight flaws across seven CLI coding agents where a repository’s own .git/config runs attacker code before the agent contacts a model. Nearly every agent runs git status or git diff at startup, and git executes core.fsmonitor from the repo it just entered. GitHub’s advisory names fifteen-plus further keys and fixes it with safe.bareRepository=explicit. Four issues were still open at publication. Codex, Cursor and Claude Code shipped fixes within the week; Qwen Code and Grok Build still had none ten days after disclosure.

Work presented at Black Hat showed several agent harnesses can be driven to execute tools with no model turn happening at all, by reaching the dispatch path directly. Everything but the Strands Python SDK is patched. Resumed conversation history and structured tool-use blocks are untrusted input.

A logged-in user with Duo Agent Platform access could escape the AI Gateway’s prompt-template sandbox through a crafted custom flow configuration and execute arbitrary commands on the gateway host. Only self-hosted gateways are exposed; GitLab-hosted gateways were patched before disclosure. Upgrade a self-hosted gateway to 19.2.4, 19.3.2 or 19.4.1 or later.

Loom deployments with no identity provider configured gave any network client full administrative control of the agent control plane, fixed in 1.6.1. Two further flaws, fixed in 1.7.0, let authenticated users send OAuth2 secrets and access tokens to outside endpoints or reach internal network locations. Upgrade to 1.7.0, rotate OAuth2 client secrets, reissue tokens from the exposed period, and review CloudTrail for misuse of the agent IAM roles.

A crafted reference value passed to the server’s diff scan was interpreted as a command-line option, letting an attacker create, overwrite or truncate files outside the workspace directory. Upgrade to 0.2.0 from PyPI, including in any fork; until then, scan only trusted repositories and run the server as a low-privilege user in an isolated environment.

A malicious MCP server can steer the client’s OAuth flow to an authorization server it controls and collect the client secret, authorization code and PKCE verifier. Disclosed by Cycode as GHSA-qx49-fqc8-xw99, rated 7.5 for the machine-to-machine providers and 6.5 for the interactive one. Upgrading is not enough on its own: pass issuer= to ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider, clear stored registrations, and rotate secrets for any client that may have reached an untrusted server.

Bifrost’s management API has authentication off by default, and registering a stdio-type MCP client through it with a single POST runs arbitrary commands on the gateway host. A gateway fronting many providers holds all of their API keys, so treat an exposed management port as a credential leak too. Reported by JFrog Security Research; upgrade to transports v2.1.0 or later.

Heapjack shares one memory heap between trusted and untrusted JavaScript in Codex Desktop’s node_repl, so asking Codex about a malicious repository gives its author unsandboxed execution even in read-only mode. Overpatch walks the CLI’s apply_patch tool out of workspace-write through a symlink and can rewrite shell startup files such as .zshrc. Accomplish AI reported both in August 2026 and OpenAI fixed them before disclosure; update to the versions above or later.

Wiz scanned internet-facing LiteLLM gateways and found 294 of 3,074 still accepting sk-1234, the master key printed in the setup docs. Alongside it sits an MCP authentication bypass that CISA added to its Known Exploited Vulnerabilities catalogue on September 2, plus authenticated command execution through MCP test endpoints and a guardrail sandbox escape. Rotating the master key needs no upgrade at all.

The tool’s local web interface authenticated on the Host header alone, so an agent that read attacker-supplied text could flip itself to danger-full-access and write anywhere on disk. OX Research reported it on August 24 and DeepSeek patched three days later with one-time token auth.

One account filed 23 pull requests across several projects in 74 minutes. The server behaves until the third tool call, then rewrites the metadata it returns into instructions to collect SSH keys, AWS credentials, shell history and kube configs. Three server CVEs land beside it, including path traversal in Atlassian MCP and a cleartext cluster token in ArcadeDB MCP.

A caller could set an X-Grafana-URL header on the grafana_api_request tool and steer the server’s outbound request — method, path and body — at loopback, link-local and cloud metadata endpoints. An earlier fix stopped credential leakage but never enforced the destination. 1.1.0 also adds optional bearer- token protection.

Bound to 0.0.0.0 as the project’s own remote deployment model suggests, ports 8020 and 8021 let any reachable client screenshot, tap, swipe, type and launch apps on an ADB-connected Android device. Version 3.0.8 makes a bearer token mandatory.

A notebook can carry an MCP server command in its own configuration, and opening the file in edit mode runs it as a local subprocess before any cell executes. Patched in July; the write-up landed in August. The fix treats notebook metadata as hostile and allow-lists which config sections a file may set.

In stateless HTTP mode the library assigned no session id, so one user’s Terraform token was reused for later users’ requests whatever token they supplied — the stateless migration’s first real casualty. The fix ships alongside a stateful-mode credential-caching bug and an SSRF. Single-user stdio setups are untouched.

Three flaws disclosed by Zafran Labs defeat trust_remote_code on DiffusionPipeline.from_pretrained with custom pipelines. The check runs once in the first phase; a crafted config or pipeline file swaps in different code before it executes.

The shipped Docker configuration binds the MCP bridge to 0.0.0.0:3001 with nothing in front of it, so anything that can reach the port can POST to 233 tools including terminal_execute. From there an attacker reads LLM provider keys out of the container environment, harvests stored conversations, and writes patterns into the AgentDB learning store that steer later responses.

A malicious Actor carrying a crafted webServerMcpPath can make the MCP client resolve to an attacker-controlled host. Because the client attaches its Authorization header to every outbound connection, the victim’s Apify API token is exfiltrated.