Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-03-21 · source-backed
CVE-2026-4496 (CVSS 5.3) affects Git-MCP-Server — the MCP adapter that gives agents git access. In gitUtils.ts, user-supplied parameters pass directly into child_process.exec without sanitization, enabling OS command injection via any agent input that reaches a git operation. Any agent pipeline exposing git operations through this server without input validation is vulnerable. This is the exact exec() → execFile() pattern that Snyk documents as 43% of all MCP CVEs.
Each link below shares sources, entities, or timing with this story.
The agent skills supply chain is under coordinated attack. Snyk's ToxicSkills audit found 36% of ClawHub's 3,984 skills contain prompt injection payloads, 13.4% have critical malware, and submission rates exploded 10x to 500+/day. This week alone: CVE-2026-2256 (CVSS 9.1) is a...
CVE-2026-33010 dropped March 20 with a CVSS 8.1, targeting mcp-memory-service — the open-source memory backend that a large number of multi-agent deployments use for persistent agent recall. The vulnerability is straightforward and devastating: when HTTP mode is enabled with a...
Thirty CVEs in sixty days. That's the MCP ecosystem's security track record for 2026 so far, and the severity is climbing. Three disclosures dropped this week that should make anyone running agent infrastructure pause. First, PraisonAI, a popular multi-agent orchestration fram...
Full 10.0. Network vector, low complexity, no authentication, no user interaction, high impact on confidentiality, integrity and availability. CVE-2026-79696, published September 9, is a code injection flaw in adk web affecting Google's Agent Development Kit for Python 2.0.0 t...
Ten days from spec to shipped client. That's fast even for this ecosystem. The MCP 2026-07-28 revision replaced the bidirectional stateful protocol with request/response. Every request now independently carries protocol version, client identity and capabilities. Cloudflare's t...
OX Security disclosed a systemic vulnerability on June 16 in core Model Context Protocol implementations that enables arbitrary command execution, exposing API keys, internal databases, and chat histories on any vulnerable MCP host. This isn't one bad server. It's a protocol-l...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.