{"vulnerability": "cve-2026-6743", "sightings": [{"uuid": "2f0b1708-c5e9-4a8e-b165-09454820be32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-67430", "type": "published-proof-of-concept", "source": "https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-52jp-gj8w-j6xh", "content": "", "creation_timestamp": "2026-07-30T16:35:25.518956Z"}, {"uuid": "feade581-b2be-4ef2-8950-fd2a58037a56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-67431", "type": "published-proof-of-concept", "source": "https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-5p9g-j988-pcwv", "content": "", "creation_timestamp": "2026-07-30T16:35:20.729425Z"}, {"uuid": "1e75c43d-f719-499b-b2c3-b748ba67467c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-67432", "type": "published-proof-of-concept", "source": "https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-h669-8m4g-r2hc", "content": "", "creation_timestamp": "2026-07-30T16:35:23.183627Z"}, {"uuid": "54e8d5e9-0bdd-4b9a-8c85-8f983db25211", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-67438", "type": "published-proof-of-concept", "source": "https://github.com/OliveTin/OliveTin/security/advisories/GHSA-xc5w-4v5w-7x65", "content": "", "creation_timestamp": "2026-07-30T16:35:33.264665Z"}, {"uuid": "043656f1-b716-4442-b3db-014ebddf27e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-67437", "type": "published-proof-of-concept", "source": "https://github.com/OliveTin/OliveTin/security/advisories/GHSA-xpxj-f2fm-rqch", "content": "", "creation_timestamp": "2026-07-30T16:35:35.834770Z"}, {"uuid": "b344273a-47ab-4723-a02c-69aa6b59ac79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67431", "type": "seen", "source": "https://gist.github.com/Correctover/36ce05054d457c4fb176b23f08f9962b", "content": "# MCP Protocol Security in 2026: Why Patching Isn't Enough \u2014 And What Runtime Verification Solves\n\n> **Author**: Guigui Wang, Correctover  \n> **Date**: August 4, 2026  \n> **Relevance**: AI Agent infrastructure, MCP security, runtime verification standards\n\n---\n\n## TL;DR\n\nThe Model Context Protocol (MCP) has accumulated **at least 5 confirmed CVEs** in 2026 alone \u2014 DNS rebinding, session hijacking, session poisoning, cross-client data leaks, and Origin header bypass. Every single one follows the same pattern: the protocol trusts its environment without verifying it.\n\nI'm the author of **CCS (Correctover Computing Standard)**, the first IETF submission for AI Agent runtime verification (draft-correctover-ccs-00). This blog post shows how CCS's 7-dimensional runtime verification framework would have caught these vulnerabilities **systemically** \u2014 not as individual patches, but as a class of problems.\n\nIf you're running MCP-based AI agent infrastructure, you need to think about runtime verification, not just patching. Here's why.\n\n---\n\n## The MCP Vulnerability Catalog (2026)\n\n### CVE-2026-11624: DNS Rebinding Attack\n**Severity**: High  \n**Affected**: All MCP server implementations prior to v0.25  \n**Root Cause**: Missing `Origin` header validation\n\nAn attacker-controlled domain uses DNS rebinding to redirect a victim's browser to `127.0.0.1`, where a local MCP server is running. Because the server doesn't validate `Origin` headers, it accepts connections from the browser context \u2014 allowing arbitrary tool execution.\n\n**Impact**: Any website a developer visits while running an MCP server locally could weaponize this. File reads, command execution, database access \u2014 all through the agent's tool interface.\n\n### CVE-2026-67431: Session Poisoning (Ruby SDK)\n**CVSS**: 8.3 (High)  \n**Affected**: `mcp` Ruby gem < v0.23.0  \n**Root Cause**: Transport layer doesn't bind sessions to their owners\n\nThe stateful transport implementation failed to bind established sessions to their original owners or connection contexts. Any actor with access to a session ID can execute arbitrary tool calls.\n\n### CVE-2026-52869: Session Hijacking (Python SDK)\n**CVSS**: 7.1 (High)  \n**Affected**: MCP Python SDK < v1.27.2  \n**Root Cause**: JSON-RPC requests routed purely on user-controlled session IDs without ownership validation\n\nA bearer-token-authenticated attacker can hijack and inject JSON-RPC messages into another client's session by supplying their session ID. The transport layer accepts any valid token and routes to the target session.\n\n### CVE-2026-25536: Cross-Client Data Leak (TypeScript SDK)\n**CVSS**: 7.1 (High)  \n**Affected**: `@modelcontextprotocol/sdk` v1.10.0 through v1.25.3  \n**Root Cause**: Race condition in shared server/transport state\n\nWhen a single server or transport instance serves multiple clients, one client's tool results, notifications, and sampling requests can be delivered to another client. The trigger is ordinary concurrent load, not a crafted attack.\n\n### OX Security Findings: STDIO Transport Architecture\nThe MCP STDIO transport spawns a new process for every connection. This architectural choice means:\n- Each connection has its own process boundary (isolation?)\n- But also: each connection can access the full host system\n- No centralized verification of what the spawned process does\n\n---\n\n## The Pattern: Protocol Trust Without Runtime Verification\n\nLook at all five CVEs. They share a fundamental pattern:\n\n> **MCP trusts its environment. It assumes that if you have a valid connection, you're authorized. If you have a session ID, you own it. If you can reach localhost, you're a legitimate client.**\n\nThis is a **design-level assumption**, not a bug. And it's the same assumption that causes every new CVE.\n\nPatching one vulnerability doesn't fix the pattern:\n- Adding Origin validation fixes DNS rebinding but doesn't prevent the next spoofing attack\n- Binding sessions to owners prevents hijacking but doesn't validate what the session does\n- Isolating transport state prevents leaks but doesn't verify tool execution intent\n\nWhat MCP needs is not another patch. It needs **runtime verification** \u2014 continuous, systematic validation of every agent action against its authorization and intent.\n\n---\n\n## How CCS Solves This Systemically\n\nCCS (draft-correctover-ccs-00) is a 7-dimensional runtime verification framework submitted to IETF. Here's how each dimension addresses the MCP vulnerability pattern:\n\n### 1. Structure Verification\n**What it checks**: Is the incoming request structurally valid? Does it conform to the expected schema?\n\n**Catches**: Malformed JSON-RPC, unexpected tool call parameters, requests that don't match the server's capability declaration.\n\n### 2. Schema Verification  \n**What it checks**: Does the request match the declared tool/resource schema?\n\n**Catches**: Cross-client data leaks (responses with wrong schema), session poisoning (requests with wrong parameter types).\n\n### 3. Latency Verification\n**What it checks**: Is the response time within expected bounds?\n\n**Catches**: DNS rebinding attacks (abnormal latency patterns when browser proxies to localhost), replay attacks (timing anomalies).\n\n### 4. Cost Verification\n**What it checks**: Does the operation stay within declared resource bounds?\n\n**Catches**: Resource exhaustion through tool spam, unexpected computational costs from hijacked sessions.\n\n### 5. Identity Verification\n**What it checks**: Is the requesting entity who it claims to be? Is the session bound to the authenticated principal?\n\n**Catches**: Session hijacking (CVE-2026-52869), session poisoning (CVE-2026-67431). CCS binds session identity to the authenticated principal at the transport layer.\n\n### 6. Integrity Verification\n**What it checks**: Has the data been tampered with? Is the response from the expected source?\n\n**Catches**: Cross-client data leaks (CVE-2026-25536), response injection. CCS verifies data integrity at the byte level.\n\n### 7. Security Verification\n**What it checks**: Does the observed behavior match the declared authorization policy?\n\n**Catches**: DNS rebinding (CVE-2026-11624), STDIO process escape. CCS verifies that every tool execution stays within the declared authorization boundary, regardless of the transport mechanism.\n\n### Performance\n- **P50 latency**: ~133\u03bcs (out-of-process) / ~7.5\u03bcs (in-process)\n- **Verification mode**: Continuous, per-action\n- **False positive rate**: 0% across 28 audited projects\n\n---\n\n## The Self-Evolution Problem\n\nHere's what makes this worse: MCP is a **living protocol**. New transports are added. New SDKs are implemented. New tool patterns emerge. Every change introduces new attack surfaces.\n\nStatic patches can't keep up. You need a verification engine that **evolves** with the protocol.\n\nThat's why CCS includes a self-evolving detection engine (MCPFuzz):\n- **Layer 1**: Static analysis of known vulnerability patterns\n- **Layer 2**: Dynamic fuzzing with semantic-aware test generation\n- **Layer 3**: Behavioral analysis that discovers new bypass patterns autonomously\n\nThis isn't a rule engine. It's an agent that continuously learns what \"normal\" MCP behavior looks like and flags deviations. It achieved **0 false positives** across 28 production projects in the agent ecosystem.\n\n---\n\n## What This Means for You\n\n### If you're an MCP server operator:\n- Upgrade to the latest SDK versions (v0.25+ for Python, v0.23.0+ for Ruby, v1.26.0+ for TypeScript)\n- Implement Origin header validation\n- Bind sessions to authenticated principals\n- Isolate transport state per client\n\nBut also: **deploy runtime verification**. The patches fix known CVEs. CCS prevents the next class of vulnerabilities.\n\n### If you're building on MCP:\n- Don't assume the protocol is secure. It's a living standard with fundamental trust assumptions.\n- Add CCS verification to your agent pipeline. 133\u03bcs overhead is negligible compared to the risk.\n- Audit your tool execution policies. What is your agent authorized to do? CCS enforces that at runtime.\n\n### If you're an enterprise deploying AI agents:\n- MCP is the connective tissue between your LLM and your enterprise tools (databases, APIs, file systems).\n- A vulnerability in MCP is a vulnerability in your entire agent infrastructure.\n- Runtime verification is not optional. It's the difference between \"we patched the known CVEs\" and \"we systematically prevent the class of problems.\"\n\n---\n\n## The Standard Matters\n\nCCS is not just my project. It's submitted to IETF (draft-correctover-ccs-00, Submission #167254). This means:\n- It's a community standard, not a vendor lock-in\n- It's transparent, auditable, and open\n- It's designed to be adopted across the ecosystem\n\nThe DOI (10.5281/zenodo.21783723) provides timestamped proof of priority. The ccs-verifier SDK is on PyPI (v0.4.1). The code is open source.\n\nI'm not selling anything. I'm establishing a standard and proving it works. The question is whether the ecosystem adopts it before or after the next major MCP vulnerability makes headlines.\n\n---\n\n## Resources\n\n- **CCS IETF Draft**: https://datatracker.ietf.org/submit/status/167254/\n- **CCS DOI**: https://doi.org/10.5281/zenodo.21783723\n- **ccs-verifier SDK**: https://pypi.org/project/ccs-verifier/\n- **GitHub**: https://github.com/Correctover/ccs-verifier\n- **MCP CVE-2026-11624**: https://cvereports.com/reports/CVE-2026-11624\n- **MCP CVE-2026-52869**: https://cvereports.com/reports/CVE-2026-52869\n\n---\n\n*Guigui Wang is the author of CCS and founder of Correctover. Correctover's mission is to make AI Agent runtime verification a standard practice, not an afterthought.*\n", "creation_timestamp": "2026-08-04T06:51:03.379559Z"}, {"uuid": "3a3029a5-22b8-482a-a349-869f28b822b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67435", "type": "seen", "source": "https://gist.github.com/alon710/d1939c63ece21d1bd9e89d2add282b5b", "content": "# CVE-2026-67435: CVE-2026-67435: Custom Authentication Header Leakage via Cross-Origin Redirects in linuxfabrik-lib\n\n> **CVSS Score:** 6.0\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67435\n\n## Summary\nCVE-2026-67435 is a security vulnerability in the linuxfabrik-lib Python library prior to version 6.0.0. When performing HTTP requests with follow_redirects enabled, custom authentication headers (such as X-Auth-Token or X-Api-Key) are forwarded during cross-origin redirects. A malicious or compromised server can leverage this behavior to capture sensitive monitoring and administrative credentials, leading to potential unauthorized access and Server-Side Request Forgery (SSRF).\n\n## TL;DR\nA vulnerability in linuxfabrik-lib prior to 6.0.0 forwards custom authentication headers (such as X-Auth-Token or X-Api-Key) during cross-origin redirects, allowing remote attackers to exfiltrate administrative credentials.\n\n## Technical Details\n\n- **CWE ID**: CWE-200, CWE-918\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 6.0\n- **EPSS Score**: 0.00286 (Percentile: 20.87%)\n- **Impact**: Credential Exposure\n- **Exploit Status**: None\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- linuxfabrik-lib\n- Linuxfabrik Monitoring Plugins\n- **linuxfabrik-lib**: < 6.0.0 (Fixed in: `6.0.0`)\n\n## Mitigation\n\n- Upgrade linuxfabrik-lib to version 6.0.0 or higher.\n- Disable redirect handling by passing follow_redirects=False inside client calls.\n- Restrict network-level egress traffic for monitoring servers to prevent connection handshakes with external untrusted destinations.\n\n**Remediation Steps:**\n1. Identify all deployment instances of linuxfabrik monitoring scripts within local cronjobs, configuration modules, or service orchestrators.\n2. Update dependencies in requirements.txt or dependency lock files to specify linuxfabrik-lib>=6.0.0.\n3. Deploy the updated library package across all monitoring nodes and verify correct processing of monitoring endpoints.\n4. Apply strict firewall configurations restricting HTTP/HTTPS egress traffic from administrative monitoring subnets to verified destination systems.\n\n## References\n\n- [GitHub Security Advisory GHSA-4jc5-g844-4x33](https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-4jc5-g844-4x33)\n- [Fix Commit: Strip custom headers on cross-origin redirects](https://github.com/Linuxfabrik/lib/commit/6573ff9347e541200305d278d2663d2e54e052ff)\n- [linuxfabrik-lib Release v6.0.0](https://github.com/Linuxfabrik/lib/releases/tag/v6.0.0)\n- [NVD Record for CVE-2026-67435](https://nvd.nist.gov/vuln/detail/CVE-2026-67435)\n- [CVE.org Record for CVE-2026-67435](https://www.cve.org/CVERecord?id=CVE-2026-67435)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67435) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-31T01:31:12.240111Z"}, {"uuid": "1e681153-7a81-4e69-b8e0-2b0870cfa1b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67431", "type": "seen", "source": "https://gist.github.com/alon710/eb7bbb63a594430d7d6ab18e1b915ebd", "content": "# CVE-2026-67431: CVE-2026-67431: Session Poisoning via Improper Access Control in Model Context Protocol Ruby SDK\n\n> **CVSS Score:** 8.3\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67431\n\n## Summary\nAn Improper Access Control vulnerability exists in the Model Context Protocol (MCP) Ruby SDK prior to version 0.23.0. The stateful transport implementation failed to bind established sessions to their original owners or connection contexts, enabling unauthorized actors with access to active session IDs to execute arbitrary tools or alter session state.\n\n## TL;DR\nA lack of session binding in the MCP Ruby SDK allows remote attackers possessing a valid session ID to execute arbitrary tool calls and manipulate session states.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-284\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 8.3\n- **EPSS Score**: 0.00276\n- **Exploit Status**: POC (in official repository tests)\n- **KEV Status**: Not Listed\n- **Impact**: High Integrity, Low Availability\n\n## Affected Systems\n\n- mcp (RubyGems)\n- Model Context Protocol Ruby SDK\n- **mcp**: < 0.23.0 (Fixed in: `0.23.0`)\n\n## Mitigation\n\n- Upgrade the mcp gem to version 0.23.0 or higher.\n- Implement the session_request_validator hook to validate incoming requests against active user authentication states.\n- Limit session idle timeouts and maximum concurrent sessions to reduce exposure.\n\n**Remediation Steps:**\n1. Identify all deployments using the mcp Ruby gem.\n2. Update the Gemfile to require version 0.23.0 or higher: gem 'mcp', '>= 0.23.0'.\n3. Execute bundle update mcp to install the patched version.\n4. Locate instantiate configurations of MCP::Server::Transports::StreamableHTTPTransport and define a custom session_request_validator callback.\n5. Ensure the callback validates that the user environment (cookies, tokens) matches the active session ownership context.\n\n## References\n\n- [https://www.cve.org/CVERecord?id=CVE-2026-67431](https://www.cve.org/CVERecord?id=CVE-2026-67431)\n- [https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-5p9g-j988-pcwv](https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-5p9g-j988-pcwv)\n- [https://github.com/modelcontextprotocol/ruby-sdk/commit/35466605319a34e4c7808712ae9bb1ca1afb2356](https://github.com/modelcontextprotocol/ruby-sdk/commit/35466605319a34e4c7808712ae9bb1ca1afb2356)\n- [https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0](https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0)\n- [https://nvd.nist.gov/vuln/detail/CVE-2026-67431](https://nvd.nist.gov/vuln/detail/CVE-2026-67431)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67431) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-31T02:31:09.791759Z"}, {"uuid": "759f23b0-771d-4bde-936d-1d00d7b13c82", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67432", "type": "seen", "source": "https://gist.github.com/alon710/0adfedd2017833afe3a395108d8a9b0f", "content": "# CVE-2026-67432: CVE-2026-67432: High Severity Denial of Service in Model Context Protocol (MCP) Ruby SDK\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67432\n\n## Summary\nAn uncontrolled memory allocation vulnerability (CWE-770) exists in the Model Context Protocol (MCP) Ruby SDK (the `mcp` gem) prior to version 0.23.0. The SDK's StreamableHTTPTransport and StdioTransport layers fail to impose bounds on incoming payloads. An unauthenticated attacker can exploit these issues by transmitting massive, nested payloads to exhaust worker memory, leading to process termination.\n\n## TL;DR\nThe `mcp` Ruby gem prior to 0.23.0 is vulnerable to unauthenticated, remote denial of service (OOM crash) due to unbounded HTTP body reading, unsafe JSON parsing depth, and unlimited standard input buffering.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-770\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 7.5 (High)\n- **EPSS Score**: 0.00436 (35.87%)\n- **Impact**: Denial of Service (OOM Crash)\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Model Context Protocol Ruby SDK (mcp gem)\n- **mcp**: < 0.23.0 (Fixed in: `0.23.0`)\n\n## Mitigation\n\n- Upgrade the mcp gem to 0.23.0 or higher.\n- Configure application firewalls to drop payload sizes over a safe limit (e.g. 4MB).\n- Configure limits programmatically when initializing HTTP and Stdio transports.\n\n**Remediation Steps:**\n1. In Gemfile, replace existing gem declaration with: gem 'mcp', '>= 0.23.0'\n2. Run 'bundle update mcp' to apply the patch.\n3. Validate application starts successfully and transport initializations are supplied with explicit size configurations if custom thresholds are needed.\n\n## References\n\n- [GitHub Advisory GHSA-h669-8m4g-r2hc](https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-h669-8m4g-r2hc)\n- [Security Fix Commit](https://github.com/modelcontextprotocol/ruby-sdk/commit/772e0cb1f9db69312006926eee59a7287ad50166)\n- [v0.23.0 Release Notes](https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0)\n- [CVE Record on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-67432)\n- [NVD Vulnerability Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-67432)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67432) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-31T03:34:09.041044Z"}, {"uuid": "73b5608c-a2de-465e-9a16-cfba84519c11", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67430", "type": "seen", "source": "https://gist.github.com/alon710/2fc91b89bbac8024e4e2b03ecca2ce62", "content": "# CVE-2026-67430: CVE-2026-67430: Denial of Service via Unbounded Session Retention in Model Context Protocol Ruby SDK\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67430\n\n## Summary\nCVE-2026-67430 is a medium-severity Denial of Service (DoS) vulnerability in the Model Context Protocol (MCP) Ruby SDK (packaged as the mcp gem) versions prior to 0.23.0. In stateful deployments using the StreamableHTTPTransport class, client session states are retained in an in-memory hash map. Because the transport implements a nil idle timeout by default, the background scavenger process is suppressed. Remote, unauthenticated attackers can flood the endpoint with initialize requests, rapidly consuming system memory and triggering an Out-of-Memory (OOM) crash.\n\n## TL;DR\nUnauthenticated remote attackers can crash stateful MCP Ruby SDK servers by repeatedly triggering new initialize requests. Because the SDK lacks default session limits and idle timeouts, every connection allocates a persistent context in RAM, leading to memory exhaustion and service crashes.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-770\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 5.3\n- **EPSS Score**: 0.00291\n- **EPSS Percentile**: 21.41%\n- **Impact**: Denial of Service (DoS) via memory exhaustion (OOM)\n- **Exploit Status**: PoC Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Model Context Protocol Ruby SDK (mcp gem) running stateful transports\n- **mcp (Ruby SDK)**: >= 0.6.0, < 0.23.0 (Fixed in: `0.23.0`)\n\n## Mitigation\n\n- Upgrade the mcp gem to version 0.23.0 or later.\n- Configure tight session_idle_timeout and max_sessions values on StreamableHTTPTransport initialization.\n- Utilize stateless: true if stateful session management is not required.\n- Deploy a reverse proxy (e.g., Nginx, HAProxy) in front of the application to enforce request and connection rate-limiting.\n\n**Remediation Steps:**\n1. Update your Gemfile to reference mcp version 0.23.0 or later.\n2. Run bundle update mcp to retrieve and apply the security patch.\n3. Optionally, explicitly set session_idle_timeout and max_sessions parameters in your StreamableHTTPTransport.new initializer block.\n4. Restart the Ruby application server to apply the code changes.\n\n## References\n\n- [GHSA-52jp-gj8w-j6xh: Model Context Protocol Ruby SDK Unbounded Session Retention DoS](https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-52jp-gj8w-j6xh)\n- [Core Session Hardening Commit](https://github.com/modelcontextprotocol/ruby-sdk/commit/afb968c468c178c4d3294b423fcce250621692f4)\n- [Release Version 0.23.0 Tag](https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0)\n- [CVE-2026-67430 Record](https://www.cve.org/CVERecord?id=CVE-2026-67430)\n- [NVD Entry for CVE-2026-67430](https://nvd.nist.gov/vuln/detail/CVE-2026-67430)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67430) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-31T04:31:56.372398Z"}, {"uuid": "a5e5918c-b100-48a0-89aa-e4dfcacd70fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67438", "type": "seen", "source": "https://gist.github.com/alon710/006ebdb624799640fa8e05feb88f3b11", "content": "# CVE-2026-67438: CVE-2026-67438: OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check in OliveTin\n\n> **CVSS Score:** 6.6\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67438\n\n## Summary\nAn OS command injection vulnerability exists in OliveTin versions >= 3000.2.0 and < 3000.17.0. The flaw stems from a validation bypass in the shell safety engine, which fails to recognize custom regular expression arguments as unsafe for actions run in shell execution mode. Furthermore, because these custom regex checks evaluate partial string matches, attackers can append arbitrary shell metacharacters to valid inputs. This allows unauthenticated or low-privilege users who are authorized to run configured actions to inject shell commands and achieve arbitrary remote code execution on the host system.\n\n## TL;DR\nOliveTin versions before 3000.17.0 are vulnerable to OS command injection because the shell argument validator excludes 'regex:' argument types from its safety blocklist. Concurrently, unanchored regex validations allow attackers to bypass checks by placing a valid match at the beginning of their input followed by malicious shell commands.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-78 (OS Command Injection)\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 6.6 (Medium)\n- **EPSS Score**: 0.00995\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- OliveTin (Server Deployments)\n- OliveTin Docker Containers\n- OliveTin Systemd Services\n- **OliveTin**: >= 3000.2.0, < 3000.17.0 (Fixed in: `3000.17.0`)\n\n## Mitigation\n\n- Upgrade OliveTin to version 3000.17.0 or later to apply the validation enforcement fixes.\n- Convert existing shell-mode actions to exec-mode actions inside config.yaml to eliminate the shell parsing vector.\n- Ensure all custom regular expressions are strictly bounded with start and end anchors (^ and $) if used in other validated contexts.\n\n**Remediation Steps:**\n1. Review the current OliveTin configuration files (config.yaml) for combinations of 'shell:' and 'type: regex:'.\n2. Replace 'shell:' keys with structured 'exec:' arrays to ensure arguments are handled through secure processes.\n3. Update Docker compose files, Helm charts, or system service binaries to pull OliveTin image/binary version 3000.17.0 or greater.\n4. Restart the OliveTin service and verify configuration logs to ensure no initialization errors occur during loading.\n\n## References\n\n- [GitHub Security Advisory GHSA-xc5w-4v5w-7x65](https://github.com/OliveTin/OliveTin/security/advisories/GHSA-xc5w-4v5w-7x65)\n- [OliveTin Fix Commit 995ff79736f2bccc364448a3ece84087b550b232](https://github.com/OliveTin/OliveTin/commit/995ff79736f2bccc364448a3ece84087b550b232)\n- [NVD CVE-2026-67438 Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-67438)\n- [CVE.org CVE-2026-67438 Record](https://www.cve.org/CVERecord?id=CVE-2026-67438)\n- [OliveTin Shell vs Exec Execution Reference](https://docs.olivetin.app/action_execution/shellvsexec.html)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67438) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-31T08:32:20.883397Z"}, {"uuid": "7202750f-8639-472b-adb2-545325765359", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67439", "type": "seen", "source": "https://gist.github.com/alon710/4da77a0fb37a106d6065c5dabb250f4c", "content": "# CVE-2026-67439: CVE-2026-67439: Incorrect Authorization Leading to Log Leak in OliveTin\n\n> **CVSS Score:** 4.3\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67439\n\n## Summary\nAn incorrect authorization vulnerability (CWE-863) exists in OliveTin prior to version 3000.17.0. The flaw allows authenticated users who are authorized to execute commands but restricted from viewing logs to bypass this restriction. By utilizing synchronous endpoints, attackers can directly access execution outputs containing sensitive system data, credentials, and environmental configurations.\n\n## TL;DR\nOliveTin failed to validate log-viewing permissions on synchronous execution endpoints, leaking sensitive shell outputs to restricted users.\n\n## Technical Details\n\n- **CWE ID**: CWE-863 (Incorrect Authorization)\n- **Attack Vector**: Network (AV:N)\n- **Privileges Required**: Low (PR:L)\n- **CVSS v3.1 Score**: 4.3 (Medium)\n- **EPSS Score**: 0.00252 (Percentile: 16.75%)\n- **Exploit Status**: None (No public PoC)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- OliveTin Core Server\n- **OliveTin**: >= 3000.7.0, < 3000.17.0 (Fixed in: `3000.17.0`)\n\n## Mitigation\n\n- Restrict 'exec' permissions to only fully trusted administrators.\n- Audit command outputs to verify no sensitive data is written to standard output or standard error.\n- Monitor application log endpoints for anomalous synchronous API calls.\n\n**Remediation Steps:**\n1. Upgrade the OliveTin installation to version 3000.17.0 or higher.\n2. Validate the configurations in /etc/OliveTin/config.yaml for data exposure.\n3. Restart the OliveTin service to apply configuration and binary upgrades.\n\n## References\n\n- [GitHub Security Advisory GHSA-jm28-2wcr-qf3h](https://github.com/OliveTin/OliveTin/security/advisories/GHSA-jm28-2wcr-qf3h)\n- [NVD CVE-2026-67439 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-67439)\n- [CVE.org CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-67439)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67439) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-31T09:31:22.270843Z"}, {"uuid": "6d46f657-479b-436e-a609-06f193140da1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67437", "type": "seen", "source": "https://gist.github.com/alon710/ebcd683ed5c708ce9306a8ed3912a91a", "content": "# CVE-2026-67437: CVE-2026-67437: Unauthenticated Denial of Service via OAuth2 State Memory Exhaustion in OliveTin\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67437\n\n## Summary\nAn uncontrolled resource consumption vulnerability (CWE-400) in OliveTin allows unauthenticated remote attackers to exhaust server memory and trigger a denial of service (DoS). By repeatedly initiating the OAuth2 login flow without completing it, attackers can force the server to allocate state variables in an unbounded in-memory map. This heap-based resource exhaustion eventually causes the host operating system to terminate the OliveTin process via the Out-Of-Memory (OOM) killer.\n\n## TL;DR\nUnauthenticated remote attackers can exhaust OliveTin server memory and crash the application by flooding the OAuth2 login endpoint, forcing unbounded allocation of state variables in memory.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network\n- **CVSS v3.1**: 7.5\n- **EPSS Score**: 0.00354\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: PoC (Proof-of-Concept)\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- OliveTin\n- **OliveTin**: >= 3000.0.0, < 3000.17.0 (Fixed in: `3000.17.0`)\n\n## Mitigation\n\n- Upgrade to OliveTin 3000.17.0 or later\n- Implement rate-limiting on the /oauth/login route via a reverse proxy (e.g., Nginx)\n- Restrict access to the OliveTin interface using firewall rules or VPNs\n\n**Remediation Steps:**\n1. Identify running versions of OliveTin using asset management or container manifests.\n2. Deploy the 3000.17.0 update across affected environments.\n3. Configure reverse proxies to limit HTTP requests to /oauth/login to prevent resource exhaustion or service unavailability.\n\n## References\n\n- [GHSA-xpxj-f2fm-rqch: OliveTin OAuth2 state memory exhaustion advisory](https://github.com/OliveTin/OliveTin/security/advisories/GHSA-xpxj-f2fm-rqch)\n- [NVD Entry for CVE-2026-67437](https://nvd.nist.gov/vuln/detail/CVE-2026-67437)\n- [CVE.org Record for CVE-2026-67437](https://www.cve.org/CVERecord?id=CVE-2026-67437)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67437) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-31T10:32:17.501159Z"}, {"uuid": "3b9d311b-1849-42c6-bf72-2e5a90c93bc0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67434", "type": "seen", "source": "https://gist.github.com/FR-Flo/a87a156132d4ce3d4d952e21a796220a", "content": "## \ud83d\udd17 Companion release\n\nNo open **Marketplace-client (frontend)** release PR found yet \u2014 it will be linked automatically once it exists.\n\n- https://github.com/Wishibam/Marketplace-client/pulls?q=is%3Apr+is%3Aopen+base%3Amaster+head%3Adevelop\n\n- **Misc**\n    - *:arrow\\_up: deps: bump php\\_codesniffer to 4.0.4 (CVE-2026-67434)* [\\#7817](https://github.com/Wishibam/Marketplace-api/pull/7817)", "creation_timestamp": "2026-08-06T14:00:28.557002Z"}, {"uuid": "dcf5ec43-cd89-48fd-8652-f370ff704b88", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67434", "type": "seen", "source": "https://gist.github.com/FR-Flo/ce0e6938e2c8aa7a093b16e80373dccf", "content": "## \ud83d\udd17 Companion release\n\nNo open **Marketplace-client (frontend)** release PR found yet \u2014 it will be linked automatically once it exists.\n\n- https://github.com/Wishibam/Marketplace-client/pulls?q=is%3Apr+is%3Aopen+base%3Amaster+head%3Adevelop\n\n- **Misc**\n    - *:sparkles: feat: resync a single retailer in the live merchandising indices* [\\#7808](https://github.com/Wishibam/Marketplace-api/pull/7808)\n    - *:arrow\\_up: deps: bump php\\_codesniffer to 4.0.4 (CVE-2026-67434)* [\\#7817](https://github.com/Wishibam/Marketplace-api/pull/7817)\n    - *:bug: fix: resync-retailer scroll rejected by ES8 (size param)* [\\#7820](https://github.com/Wishibam/Marketplace-api/pull/7820)", "creation_timestamp": "2026-08-06T14:59:38.220856Z"}, {"uuid": "e40705c2-14ae-4c30-ae1f-6af35e0b7e54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67434", "type": "seen", "source": "https://gist.github.com/alon710/a294e95161c29ae2353666d3ed774930", "content": "# CVE-2026-67434: CVE-2026-67434: OS Command Injection via Malicious Filenames in PHP_CodeSniffer Blame Reports\n\n> **CVSS Score:** 7.3\n> **Published:** 2026-08-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67434\n\n## Summary\nA critical OS command injection vulnerability exists in PHP_CodeSniffer's VCS blame report modules (Gitblame, Hgblame, Svnblame). Due to inadequate escaping of filenames passed to shell execution wrappers like popen(), an attacker who commits a file with a maliciously crafted name can execute arbitrary commands when the victim generates a blame report.\n\n## TL;DR\nUnauthenticated OS command injection in PHP_CodeSniffer VCS reports due to unescaped filename concatenation in popen() calls.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-78\n- **Attack Vector**: Local\n- **CVSS Score**: 7.3\n- **EPSS Score**: Not established\n- **Impact**: Arbitrary Code Execution\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- PHP_CodeSniffer\n- **PHP_CodeSniffer**: < 3.13.6 (Fixed in: `3.13.6`)\n- **PHP_CodeSniffer**: >= 4.0.0, < 4.0.2 (Fixed in: `4.0.2`)\n\n## Mitigation\n\n- Upgrade to PHP_CodeSniffer 3.13.6 or 4.0.2 to safely escape arguments.\n- Avoid executing PHP_CodeSniffer with blame reports enabled (--report=Gitblame, --report=Hgblame, --report=Svnblame) on untrusted repositories.\n- Implement pre-commit or pre-scan sanitization checks in CI pipelines to validate filenames against command metacharacters.\n\n**Remediation Steps:**\n1. Run 'composer update squizlabs/php_codesniffer' in your dependency manifest.\n2. Ensure version constraint resolutions point to 3.13.6+ or 4.0.2+.\n3. Audit CI build definitions and remove VCS blame reporting flags until software is patched.\n4. Configure pipeline scanners to block filenames containing characters like '$', '`', ';', and '|'.\n\n## References\n\n- [CVE-2026-67434 Record](https://www.cve.org/CVERecord?id=CVE-2026-67434)\n- [GitHub Security Advisory GHSA-hmqg-cxww-wqhq](https://github.com/PHPCSStandards/PHP_CodeSniffer/security/advisories/GHSA-hmqg-cxww-wqhq)\n- [GitHub Pull Request #1473](https://github.com/PHPCSStandards/PHP_CodeSniffer/pull/1473)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67434) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-07T04:31:19.319540Z"}, {"uuid": "cd52882b-6d39-4b4a-8357-eb20d4f5d862", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67430", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mrssmrex5o2o", "content": "CVE-2026-67430 - MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood\nCVE ID : CVE-2026-67430\n \n Published : July 29, 2026, 8:17 p.m. | 26\u00a0minutes ago\n \n Description : MCP Ruby SDK is the official Ruby SDK for Model...", "creation_timestamp": "2026-07-29T20:53:24.809615Z"}, {"uuid": "6dc00b17-3154-431f-85e8-4bc507db6fa0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67432", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mrsstprxqw2i", "content": "CVE-2026-67432 - MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport\nCVE ID : CVE-2026-67432\n \n Published : July 29, 2026, 8:17 p.m. | 26\u00a0minutes ago\n \n Description : MCP Ruby SDK is the official Ruby SDK for Model Con...", "creation_timestamp": "2026-07-29T20:57:17.805537Z"}, {"uuid": "c60987b8-8c52-479d-848c-f47e04a61477", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67432", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrsszcbcnl22", "content": "\ud83d\udfe0 CVE-2026-67432 - High (7.5)\n\nMCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0....\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-67432/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-29T21:00:25.446900Z"}, {"uuid": "68aa17b4-a49e-4a17-9cc1-71d022a61c0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67435", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mrstx5hkw522", "content": "CVE-2026-67435 - linuxfabrik-lib: fetch() forwards credential headers across a cross-origin redirect\nCVE ID : CVE-2026-67435\n \n Published : July 29, 2026, 8:17 p.m. | 26\u00a0minutes ago\n \n Description : linuxfabrik-lib provides Python modules for database access, caching, shell ex...", "creation_timestamp": "2026-07-29T21:17:06.620102Z"}, {"uuid": "706fbabc-bd15-4add-9819-b116f1bc6170", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67431", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mrsu6t2mfx2q", "content": "CVE-2026-67431 - MCP Ruby SDK: Ruby SSE Session Poisoning\nCVE ID : CVE-2026-67431\n \n Published : July 29, 2026, 8:17 p.m. | 26\u00a0minutes ago\n \n Description : MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Trans...", "creation_timestamp": "2026-07-29T21:21:23.968372Z"}, {"uuid": "6aa958df-0233-4912-8039-67241f96ea29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67437", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrswdykg4k2w", "content": "\ud83d\udfe0 CVE-2026-67437 - High (7.5)\n\nOliveTin gives access to predefined shell commands from a web interface. From 3000.0.0 until 3000...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-67437/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-29T22:00:05.117140Z"}]}