Model Context Protocol

IBM Langflow OSS versions 1.0.0 through 1.11.5 contain CVE-2026-81941. An authenticated non-administrative user can build a flow with an MCP Tools component set to a local stdio subprocess transport and run arbitrary operating system commands at the privilege level of the application process. This bypasses the LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY and LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS server-side controls. Successful exploitation could expose credentials from the process environment, modify the file system, and reach other services on the server.

The `set_functype_version` MCP tool in `functype-mcp-server` accepts an unvalidated `version` string and interpolates it into `functype@<version>`, which `pnpm add` installs without checks. Because package specifiers accept `file:` and `npm:` alias syntax, a client sending an MCP `tools/call` request can make the server install an arbitrary local or remote package as `functype`. The server then calls `initDocsData(true)`, which dynamically imports `functype/cli` from that package, executing attacker-controlled JavaScript in the MCP server process as remote code execution with the server's privileges (CVSS 7.8 High).

CVE-2026-87912 affects the AWS Security Agent plugin in aws-agents-for-devsecops before version 1.1.0, and CVE-2026-87913 affects the AWS Security Agent MCP server before 0.2.0. Both stem from missing S3 bucket ownership verification, which may let remote attackers obtain the private source archive of a scanned workspace, including credentials and infrastructure state, via a pre-registered storage bucket whose name is derived from a publicly known account identifier. Impacted versions are <=1.0.0 and >=0.1.0 AND <=0.1.5.

CVE-2026-85654 is a code injection flaw in the CDK generator component of Amazon awslabs.dynamodb-mcp-server, an open-source MCP server for DynamoDB. Improper neutralization of special elements in a template engine lets a context-dependent actor run arbitrary code on the host that deploys the generated application, using crafted table, index, or attribute names in a data model file. Impacted versions are >= 2.0.10 AND <= 2.1.5.

The js_execution tool in CodeWhale spawns Node with tokio::process::Command::new without calling env_clear or the child_env scrubber that exec_shell, the Python REPL and the MCP launcher use. Model-provided JavaScript can therefore read process.env, and its output returns to the next model turn, exposing API keys, cloud credentials and forge tokens. With auto_approve enabled (YOLO mode), the JS runs without any prompt, so a prompt injection from a README, web page or MCP output can drain the environment.

OGX (formerly Llama Stack, affected at commit fbe8e0f) has an unauthenticated server-side request forgery flaw in the OpenAI-compatible POST /v1/responses endpoint. The server_url parameter in MCP tool definitions is fetched server-side without the validate_url_not_private() check used for other URL inputs. On the default starter configuration, which runs without authentication, a remote attacker can make the server connect to arbitrary internal addresses, including cloud metadata endpoints such as http://169.254.169.254/, and forward attacker-supplied headers and bearer tokens to them.

CVE-2026-84779 is a Subscriber Broken Access Control flaw in Agentimus – AI SEO, llms.txt &amp; MCP for AI Agents, affecting versions up to and including 1.51.0. The source text provides no further detail on how the flaw is reached or what an attacker gains.

OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS misclassified certain PowerShell commands as safe because their command-safety parser read the stop-parsing token (--%) differently than PowerShell does. If a user opens an attacker-prepared repository and Codex follows its instructions, Codex can run a file-writing Git command without requesting approval. If filesystem protections permit the write, the attacker can modify Codex's configuration so that a later load launches an attacker-controlled MCP server, executing code with the user's privileges.

MCPHub, a hub for managing and orchestrating multiple MCP servers and APIs, performs no role checking on its built-in prompt and resource controllers before version 1.0.32. Any authenticated non-admin user can call the mutating POST/PUT /api/prompts* and POST/PUT /api/resources* routes, creating, overwriting or shadowing global prompt templates and resources that are served to all users. Because these records are consulted before any connected MCP server, the tampering can also lead to prompt injection in other users' LLM sessions.