CVE-2026-15583

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-15583 CVE-2026-15583 Grafana MCP Server 0.17.0 - Grafana Labs I am @abraxasnull. Loopback lab. The client is CVE-2026-15583-Abraxas-Labs.py. Confused deputy. Unauthenticated MCP HTTP takes X-Grafana-URL from...

POC-CVE-2026-93680

Description Proof of concept exploit code for CVE-2026-93680 Usage Step 1: Connect to MCP SSE terminal 1 Step 2: Initialize MCP session and list MCP tools terminal 2 Step 3: Bypass auth and exfiltrate data terminal 1, output result of step 2...

ai-kubernetes-helm-chart-security

AI on Kubernetes: Helm chart security defaults evidence This repository holds the data and evidence behind the Sorami technical report "AI on Kubernetes: 10 of 14 Helm charts ship with no API auth" version 1.2. Read the report here: https://sorami.com.au/research/ai-kubernetes-helm-chart-security...

chub-supply-chain-poc

Context Hub Supply Chain PoC Zero-sanitization vulnerability inContext Hub @aisuite/chub v0.1.3 enables silent dependency injection through the MCP documentation pipeline. References: CWE-94 Code Injection | CWE-829 Untrusted Control Sphere | CWE-345 Insufficient Verification of Data Authenticity...

MCP Inspector < 0.14.0 UnauthenticatedRemote Code Execution

The MCP inspector is a developer tool for testing and debugging MCP servers. Versions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio. id...

Flowise - Remote Code Execution

Flowise 3.0.5 contains a remote code execution vulnerability caused by unsafe evaluation of user input in the CustomMCP node's convertToValidJSONString function, letting remote attackers execute arbitrary code with full Node.js privileges, exploit requires user input to be processed by the...

Bifrost < 2.1.0 - Unauthenticated MCP Stdio Command Execution

When dashboard authentication is disabled, Bifrost accepts an unauthenticated stdio MCP client registration and starts its configured command before the MCP handshake completes. This template runs a benign outbound HTTP request from the target and requires an out-of-band callback to confirm comma...

GitLab MCP Server < 2.1.27 - Unauthenticated SSE Transport Access

The @zereight/mcp-gitlab GitLab MCP server exposes its SSE transport endpoints without any authentication when SSE mode is enabled. An unauthenticated attacker with network access can establish an MCP session and invoke every registered tool, including uploadmarkdown, which reads arbitrary files...

MountDev AI MCP Connector <= 1.6.1 - Unauthenticated Admin OAuth Token Exposure

MountDev AI MCP Connector for WordPress mountdev-ai-mcp-connector = 1.6.1 is vulnerable to unauthenticated authorization bypass CWE-862 via its OAuth 2.0 implementation. The plugin exposes a publicly accessible Dynamic Client Registration endpoint /mcp-register at WordPress init-level that allows...

ruflo MCP Bridge - Unauthenticated RCE via terminal_execute

ruflo MCP bridge 3.16.3 in its default docker-compose deployment exposes POST /mcp with no authentication and binds to all interfaces 0.0.0.0:3001. The executeTool function has no server-side deny list for dangerous tools, allowing an unauthenticated attacker to invoke tools/call with...

argocd-mcp 0.8.0 - Unauthenticated MCP Session and Tool Access

argocd-mcp before 0.9.0 binds its MCP HTTP listener to all interfaces without requiring authentication. A remote unauthenticated attacker can initialize an MCP session, complete the handshake, and enumerate or invoke the full Argo CD tool surface using the operator's stored API token. id:...

9Router <= 0.4.36 - Unauthenticated RCE

9Router = 0.4.36 middleware only guards 8 explicitly listed routes, leaving /api/cli-tools/ and /api/mcp/ entirely unauthenticated. An attacker can POST to /api/cli-tools/cowork-settings to register a custom MCP plugin with attacker-controlled command and args stored verbatim into globalThis, the...

Nginx UI - Broken Access Control

Network attackers can fully control nginx service, including config modification and service restart, leading to complete service takeover. id: CVE-2026-33032 info: name: Nginx UI - Broken Access Control author: DhiyaneshDk severity: critical description: | Network attackers can fully control ngi...

mcp-atlassian < 0.17.0 - Server-Side Request Forgery

MCP Atlassian 0.17.0 contains a server-side request forgery caused by improper validation of custom HTTP headers in the HTTP middleware, letting unauthenticated attackers force outbound requests to arbitrary URLs, exploit requires access to the mcp-atlassian HTTP endpoint. id: CVE-2026-27826 info...

LiteLLM 1.18.10 - Command Injection

LiteLLM 1.18.10 contains a remote code execution caused by lack of validation of arbitrary command and args in MCP server creation, letting attackers execute OS commands remotely, exploit requires crafted JSON configuration. id: CVE-2026-30623 info: name: LiteLLM 1.18.10 - Command Injection autho...

litellm-command-injection-security-assessment

CVE-2026-42271 - LiteLLM AI Gateway MCP Command Injection RCE Consultant-Style Cybersecurity Report Professional vulnerability assessment report for LiteLLM command injection risk, including executive summary, technical impact, remediation, and mitigation strategy. 📍 Report Snapshot Field| Detail...

Aegis-releases

Aegis Claude Code's sandbox lets an agent read your SSH keys and AWS credentials by default. Aegis doesn't. Two layers, both verified on real hardware. Kernel sandbox — the agent's own shell cannot reach a denied path: $ ! cat /.ssh/idrsa cat: /Users/you/.ssh/idrsa: Operation not permitted $ ! ca...

wp-secure-mcp

wp-secure-mcp In plain terms: this lets an AI agent read and lightly write to a WordPress site through a real WordPress Application Password — the same credential type wp-admin already issues — and nothing else. There is no sign-up form, no OAuth client registration, no token endpoint of any kind...

mcpjam-cve-2026-23744-validator

MCPJam Inspector Authorized Security Validator A bounded proof-of-concept validator for CVE-2026-23744 affecting vulnerable MCPJam Inspector deployments. This project is an independent, non-destructive validation tool for the previously disclosed CVE-2026-23744. It is not the original vulnerabili...

mcp-attack-detection-sentinel

MCP Attack Detection — Sentinel Research Lab Sentinel detection research for MCP Model Context Protocol attack patterns : unusual identity access after an MCP-related event, tool-definition mutation, cross-resource access, and possible post-exploitation behavior. The rules map to the OWASP Top 10...