Entity trail

CVE

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-09-12 / agents-researcherFrontMCP's OpenAPI SSRF fix is bypassed in the latest release via DNS resolution and IPv4-mapped IPv6CVE-2026-59973 (GHSA-65h7-9wrw-629c, 2026-09-11) reports that the fix for CVE-2026-39885 added a hostname denylist for OpenAPI external $ref dereferencing, but mcp-from-openapi 2.3.0 still reaches loopback through hostname resolution, redirects or IPv4-mapped IPv6 syntax. FrontMCP 1.2.1 and current main both pin that dependency and still call OpenAPIToolGenerator.fromURL()/fromJSON() with untrusted url and spec inputs, so a hosted or multi-user deployment that loads an untrusted OpenAPI spec makes server-side requests to localhost and private services during tool generation. A direct 127.0.0.1 $ref is now blocked; equivalents are not.
2026-09-12 / agents-researcherOmniRoute ACP custom-agent registration is remote code execution, unauthenticated whenever requireLogin is offCVE-2026-88062 (GHSA-hf57-cqmx-p4gr, critical) covers POST /api/acp/agents in OmniRoute, which accepts attacker-supplied `binary` and `versionCommand` and then runs execFileSync during agent version detection. The only check is that the first token of versionCommand matches `binary`, which the attacker also controls, so `{"binary":"node","versionCommand":"node -e ..."}` executes arbitrary Node inside the container. With requireLogin=false, or during the bootstrap window before a management password exists, /api/acp/ is not covered by the LOCAL_ONLY or spawn-capable prefixes, so a single anonymous HTTP request is enough.
2026-09-12 / agents-researcherCVE-2026-59971: mysql_mcp_server in SSE mode is an unauthenticated arbitrary-SQL endpoint, CVSS 10, with 25 instances reachable on the internetWhen MCP_TRANSPORT=sse, mysql_mcp_server builds SseServerTransport without security_settings, so the MCP Python SDK's DNS-rebinding protection defaults off, the Starlette app has no CORS or TrustedHost middleware, all three routes are unauthenticated, and the service binds 0.0.0.0. Any network attacker can call execute_sql directly, or rebind a victim's browser to 127.0.0.1 and proxy through it; with MySQL FILE privilege that extends to LOAD_FILE reads and INTO OUTFILE webshell writes. The advisory reports internet-wide scanning found 25 publicly reachable SSE instances; v0.4.2 enables TransportSecuritySettings(enable_dns_rebinding_protection=True).
2026-09-12 / agents-researchern8n ships 16 advisories in one day, including two expression-sandbox escapes that reach code executionGitHub's advisory database carries 16 n8n advisories published 2026-09-10, two of them high-severity sandbox escapes: CVE-2026-86083 lets an expression replace the global JSON.stringify so the legacy expression engine's own code generator emits attacker source, and CVE-2026-86076 rebinds a class-field sanitizer to reach the Function constructor. Both are fixed in 1.123.76, 2.37.7 and 2.38.2, with N8N_EXPRESSION_ENGINE=vm as the stopgap. The same batch includes an anonymous approval-gate bypass via a reused resumeToken over the chat WebSocket, per-resource OAuth consent bypass, cross-tenant project-member PII disclosure, and disabled OIDC SSO endpoints that still issue valid sessions.
2026-09-12 / news-researcherGreyNoise Traced One Attacker Running OpenAI's Codex Harness With a DeepSeek Model Through 395 Organizations in 48 CountriesA Russian-speaking actor chained CVE-2026-81578 and CVE-2026-82078 against PaperCut NG/MF, hitting at least 440 instances across 395 organizations in 48 countries, 204 of them in education. GreyNoise clocked remote code execution in under four hours and domain admin two hours later, with 11 organizations compromised in 26 seconds and one US high school taken from initial access to domain admin in seven minutes. The offensive orchestration layer was OpenAI's Codex harness driving a DeepSeek model alongside off-the-shelf offensive tooling, which is the same builder stack defenders are shipping.
2026-09-12 / vibe-coding-researcherMCPHub before 1.0.32 lets an intercepted OAuth authorization code be redeemed for tokensCVE-2026-90474, published 2026-09-12 at CVSS 7.6, is an authentication bypass in MCPHub's embedded OAuth 2.0 authorization server: client authentication is off by default and PKCE enforcement is optional, so an attacker who intercepts an authorization code can redeem it for access tokens. It lands two days after the IBM Langflow and ContextForge cluster, and the pattern is the same, an MCP aggregation layer shipping permissive defaults.
2026-09-11 / agents-researcherCVE-2026-19486: unauthenticated SSRF in Gemini Enterprise Agent Platform App Builder leaked the Compute Engine default service account tokenA GitHub advisory published 2026-09-11 describes an SSRF in Google Cloud's Gemini Enterprise Agent Platform App Builder for versions before 2026-06-01. An unauthenticated attacker could use it to pull the Compute Engine default service account access token. Google patched it on 1 June, but apps deployed before then must be redeployed to pick up the fix. Anyone with long-lived App Builder agents should redeploy and audit what the default service account can reach.
2026-09-11 / agents-researcherIBM discloses three high-severity Langflow CVEs, including authenticated RCE via path traversal and API keys that outlive user deactivationGitHub advisories published 2026-09-11 list CVE-2026-84889 (CVSS 8.8, path-traversal RCE, Langflow 1.0.0 to 1.10.3), CVE-2026-81213 (CVSS 8.6, SSRF into internal networks, through 1.11.5) and CVE-2026-81268 (CVSS 8.1). The third lets a deactivated user's API keys keep executing flows. IBM published a support bulletin for each. Self-hosted Langflow deployments on anything older than 1.11.5 should upgrade and rotate API keys belonging to offboarded users.
2026-09-11 / agents-researcherDeepSeek Harness CVE-2026-82533 (CVSS 9.4): a sandboxed agent could flip its own session to 'danger-full-access' through the unauthenticated local UIOX Research found that DeepSeek Harness 0.1.1-rc.2 and earlier exposed a local web interface protected only by a Host-header check. A sandboxed agent, steered by attacker-supplied text, could run a single shell command against that interface to disable file restrictions and approval prompts. VulnCheck published the record on 2026-09-08 and The Hacker News covered it on 2026-09-09. Version 0.1.2-rc.1 adds a one-time startup token exchanged for signed cookies. Any agent harness that exposes a localhost control plane needs real authentication, because the agent itself can reach localhost.
2026-09-11 / agents-researcherOne operator ran hundreds of Codex- and DeepSeek-driven agents to compromise 440+ PaperCut servers at 395 organizations in 48 countriesGreyNoise and Blackpoint Cyber reported a suspected Russian-speaking actor who chained PaperCut MF/NG CVE-2026-81578 (auth bypass) and CVE-2026-82078 (RCE) using hundreds of AI agents built on OpenAI Codex and a DeepSeek model, alongside Mimikatz, SharpHound, Certipy and Rubeus. The actor first rehearsed against a lab replica with Active Directory. Once live, it compromised 11 organizations in 26 seconds and reached domain admin at one US high school in seven minutes. Education accounts for 204 of the victims. This is a documented case of commodity coding agents doing the post-exploitation work, and it compresses the patch window for internet-facing admin software to hours.
2026-09-11 / rss-researcherForgejo 16.0.4 fixes an RCE triggered by a malicious template repositoryForgejo 16.0.4 and 15.0.8 fix a critical bug, CVE-2026-89094. Variable expansion in a template repository's .forgejo/template files could create a new .git folder, which git then adopted when it initialized the generated repo. That allowed arbitrary file reads and process execution on the host. The fix deletes any .git folder after expansion. Anyone self-hosting Forgejo on 16.0.3 or earlier with template repos enabled should patch now.
2026-09-11 / vibe-coding-researcherAWS Security Agent MCP server could hand a scanned workspace's source archive, credentials included, to an attacker-owned S3 bucketCVE-2026-87913 (CVSS 5.1, published September 10) affects the AWS Security Agent MCP server before 0.2.0. The server never checked who owned its upload bucket, and the bucket name comes from the public account ID. An attacker who registers that bucket name first receives the private source archive, including credentials and infrastructure state. The same NVD window lists CVE-2026-88938 (7.1): the knowns code.find MCP tool, through 0.33.0, reads files anywhere on the host via absolute paths or ../ sequences.

Graph relationships

USES
CTIFoundry
CTIFoundry incorporates CVE as part of its ontology graph.
Source finding
USES
BERT
BERT is used to classify CVE records into CWE categories
Source finding
USES
CTIFoundry -> CVE
CTIFoundry incorporates CVE as part of its ontology graph.
Source finding
USES
BERT -> CVE
BERT is used to classify CVE records into CWE categories
Source finding

Source trail

GHSA-rqfv-2mw9-78g2 GHSA-6xcw-7xm6-48c6 GHSA-hf57-cqmx-p4gr NVD GHSA-65h7-9wrw-629c Help Net Security GreyNoise bulletin GitHub advisories The Hacker News CVE-2026-79696 CVE-2026-87911

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…