Model Context Protocol

CodeWhale (packages codewhale and codewhale-tui), versions >= 0.8.41 and < 0.8.64, contains a remote code execution flaw in the rlm_eval tool. Its approval_requirement() returns ApprovalRequirement::Auto, so the engine never prompts and runs model-supplied Python in a python3 interpreter without consulting --approval-policy. An attacker can trigger this through prompt injection in untrusted content the agent reads, such as a web page, fetched URL, repository file or MCP tool result, with the companion rlm_open tool able to stage that content. Code runs at the user's privilege level.

The HTTP MCP server-registry backend, `atomic_agents/mcp_registry/http.py` (`make_http_mcp_server_registry_backend_from_url`), accepts both `http` and `https` catalog URLs, affecting all versions through 1.0.0. Catalog `command`/`args` values are type-validated but not content-restricted, and `MCPClientPool` spawns them as local stdio subprocesses. Over a cleartext `http://` catalog, a network man-in-the-middle can rewrite the response to inject arbitrary commands and gain code execution on the agent host without LLM involvement. The `https` path is stated to be sound, and `mcp_allow_fn` defaults to None, so no allowlist applies unless an operator configures one.

The Cortex MCP server (`neuro-cortex-memory`) before version 3.17.1 treats the `CLAUDE_PROJECT_DIR` environment variable, which Claude Code sets to the open project directory, as a trusted Cortex developer checkout. When `open_visualization` runs, `_find_dev_source()` accepts that directory as a source root if `_is_cortex_root()` finds an `mcp_server/` subdirectory and a `ui/unified-viz.html` file. An attacker who places those two marker files in a malicious repository can make Cortex run `mcp_server/server/visualize_bootstrap.py` from it via `subprocess.run`, executing code with the victim's local user privileges.

MCP Atlassian, a Model Context Protocol server for Confluence and Jira, is affected by CVE-2026-73498 in versions prior to 0.22.0. The confluence_upload_attachment tool passes a client-supplied file_path directly to open() without calling validate_safe_path, so an authenticated MCP client can read any file the server process can access and upload it to Confluence as an attachment. If an AI agent is induced through untrusted content to call the tool, the flaw can also expose server environment variables such as CONFLUENCE_API_TOKEN.

The `ado_package_install` MCP tool in `stata-mcp` interpolates its `package` argument into a Stata command string without validation, and `Controller` sends the result to Stata via `pexpect.sendline()`. Embedded newlines let an attacker inject Stata's `shell` command, giving OS command execution under the account running the Stata-MCP server. The tool is enabled in the default `all` profile, and the base CVSS score is 8.4 (High).

CVE-2026-18954 is an incorrect authorization issue in the aggregation pipeline tool of the Amazon DocumentDB MCP Server, an open-source Model Context Protocol server for AI assistants. Write-capable pipeline stages ($out, $merge) bypass the read-only mode enforcement, potentially letting an authenticated MCP client perform write operations on the connected database. Impacted versions are below 1.0.12.

CVE-2026-18953 is an improper limitation of a pathname to a restricted directory in the get_resource tool of awslabs.aws-transform-mcp-server, a locally run MCP server, in versions 0.1.0 through 0.1.4. A context-dependent actor can use the savePath parameter to write arbitrary files outside the intended working directory, which could lead to local code execution.

CVE-2026-9077 affects IBM Langflow OSS versions 1.0.0 through 1.10.3. A remote authenticated attacker can bypass localhost-only restrictions and write arbitrary MCP server configurations to IDE configuration files on the host system. The weakness is classified as CWE-807, Reliance on Untrusted Inputs in a Security Decision.

CVE-2026-8446 is an authentication bypass in IBM Langflow OSS versions 1.0.0 through 1.10.3. The flaw sits in the Model Context Protocol (MCP) composer endpoint when mcp_composer_enabled=true, which is the default, and projects are configured with auth_type=oauth. It is classified as CWE-306, Missing Authentication for Critical Function, and IBM is the listed source. NVD had not yet provided an assessment at the time of the source text.

CVE-2026-17626 affects IBM Langflow OSS versions 1.0.0 through 1.10.3. An authenticated attacker can read, modify, or expose sensitive host files through Docker-based MCP servers, because Langflow incompletely filters dangerous Docker volume-mount and device-mapping arguments. The weakness is classified as CWE-266, Incorrect Privilege Assignment. NVD had not yet provided an assessment when the entry was published on 08/05/2026.

CVE-2026-17623 affects IBM Langflow OSS versions 1.0.0 through 1.10.3. A remote authenticated attacker can execute arbitrary commands because the command field in MCP server configurations is not properly validated, classified as CWE-78 (OS Command Injection). The NVD assessment was not yet provided at publication on 08/05/2026.

The mitigation for CVE-2025-8943 in Flowise 3.1.1 blocks the `-y` and `--yes` flags on `npx`, but its environment-variable check denies only four names by exact match: PATH, LD_LIBRARY_PATH, DYLD_LIBRARY_PATH and NODE_OPTIONS. Because npm reads `npm_config_*` environment variables, setting `npm_config_yes=true` in an MCP server configuration makes `npx` auto-install and execute the named package, bypassing the patch. With `CUSTOM_MCP_SECURITY_CHECK=true`, the source says a default deployment without authentication allows unauthenticated remote code execution.