{"data":{"id":"71437032-941c-4c13-8f12-d858b2a654b6","title":"GHSA-8pqq-224h-x875: ogham-mcp had credentials embedded in published PyPI sdists -- Neon postgres URLs and Voyage API key","summary":"Between 2026-02 and 2026-04-24, 22 public PyPI sdists of `ogham-mcp` shipped development credentials in source files: three Neon postgres URLs with passwords in the top-level `Makefile`, and a Voyage AI API key in the test fixture `tests/test_hooks.py::test_mask_secrets_key_value`. The maintainer rotated all affected credentials, and the advisory reports no known exploitation.","solution":"Upgrade to v0.11.1 (`pip install --upgrade \"ogham-mcp>=0.11.1\"`). Users do not need to rotate anything, since the credentials belonged to the project maintainer.","labels":["security","industry"],"sourceUrl":"https://github.com/advisories/GHSA-8pqq-224h-x875","publishedAt":"2026-05-05T00:03:48.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":["ogham-mcp@>= 0.6.3, < 0.11.1 (fixed: 0.11.1)"],"affectedPackageNames":["ogham-mcp"],"affectedPackageRefs":["pypi:ogham-mcp"],"affectedVendors":[],"affectedVendorsRaw":["ogham-mcp","Neon","Voyage AI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-8pqq-224h-x875"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-05-05T00:03:48.000Z","fixReleasedAt":"2026-04-24T11:16:12.275Z","daysToFix":-11,"fixCheckedAt":"2026-10-29T21:36:58.676Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":["AML.T0010"],"fixes":[{"ecosystem":"pypi","name":"ogham-mcp","fixedVersion":"0.11.1","matchedVersion":"0.11.1","fixReleasedAt":"2026-04-24T11:16:12.275Z","daysToFix":-11,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:36:58.529Z"}]}}