Audr advisory ledger

MCP server config

PentestAgent through commit cf882dabea3ed91cef016cdd115e5426315665a2 binds its SSE MCP server to every interface by default without authentication.

dependency manifest

Langflow OSS 1.0.0 through 1.11.5 fails to enforce public-flow restrictions and session isolation on publicly shared MCP project endpoints.

dependency manifest

awslabs.postgres-mcp-server before 1.1.7 lets crafted COPY TO PROGRAM SQL escape its default read-only validator and execute operating-system commands on…

dependency manifest

AutoAgent's sandbox TCP server binds to every interface, accepts commands without authentication, and executes received input through a shell.

agent config

OpenAI Codex CLI and Desktop trusted repository-local core.fsmonitor while collecting Git metadata, allowing preserved configs to launch an attacker helper.

plugin/hook config

OpenAI Codex Desktop trusted repository-local core.hooksPath during automated Git operations, allowing preserved configs to launch malicious hooks.

dependency manifest

Google langfun 0.0.1 through 0.1.1 evaluates model-generated Python expressions without a sandbox in the default lf.query Python protocol.

MCP server config

mcp-memory-service before 10.67.1 omits authentication from every HTTP route under /api/documents even when MCP_API_KEY or OAuth is configured.

dependency manifest

Flowise before 3.1.3 lets authenticated Custom MCP editors bypass stdio command validation through environment variables and command arguments.

source code

OpenClaw Dashboard v3.0.0 records attacker-supplied failed-login usernames and renders them unescaped through innerHTML in the administrator notification panel.

source code

SiYuan before 3.7.2 lets anonymous Publish proxy reader credentials into an MCP endpoint that lacks administrator-role and read-only enforcement.

MCP server config

Network-AI before 5.4.5 authorizes every MCP SSE request when NETWORK_AI_MCP_SECRET is unset and allows wildcard browser origins.

dependency manifest

Langflow OSS 1.0.0 through 1.10.0 fails to validate dynamic ToolGuard CodeInput fields even when custom components are disabled.

permissions/trust config

ClawVet self-hosted apps/api before 0.7.5 can use a public fallback JWT secret and expose user IDs through an unauthenticated scan listing endpoint.

dependency manifest

ForgeCode 2.11.1 automatically executes MCP server commands from a repository-root .mcp.json without user confirmation.

dependency manifest

Kiota before 1.32.5 copies unsafe x-ai-* static template paths into generated Copilot and Teams plugin manifests.

dependency manifest

MCP Python SDK before 1.28.1 accepts WebSocket handshakes without validating Host or Origin headers.

dependency manifest

AWS HealthLake MCP Server before 0.0.14 accepts crafted pagination URLs without verifying the expected HealthLake endpoint.

dependency manifest

OpenClaw before 2026.6.6 incompletely filters host exec environment variables, allowing Git ext transport abuse.

dependency manifest

OpenClaw before 2026.6.6 incompletely filters interpreter startup environment variables passed to host exec.

dependency manifest

MCP Server Kubernetes before 3.9.0 accepts leading kubectl flags through structured tool resourceType or name arguments.

dependency manifest

Ruflo before 3.16.3 exposes unauthenticated MCP bridge POST /mcp tool-call endpoints in the default docker-compose deployment.

dependency manifest

@arikusi/deepseek-mcp-server before 1.8.0 can expose self-hosted POST /mcp HTTP transport without authentication.

dependency manifest

@arikusi/deepseek-mcp-server 1.4.2 through 1.6.x accepts caller-supplied process-global session IDs without binding them to an authenticated principal.

dependency manifest

Aerostack MCP mcp-whatsapp upload_media accepts attacker-controlled media_url values without sufficient SSRF protection.

dependency manifest

Cline Hub dashboard before 3.0.30 accepts /browser WebSocket connections without validating Origin and can trust local requests without ROOM_SECRET.

dependency manifest

OpenClaw before 2026.5.28 can let lower-trust workspace dotenv files override provider credential environment values.

dependency manifest

Serena before 1.5.2 exposes an unauthenticated Flask dashboard API on a predictable local port without CSRF or Host header validation.

dependency manifest

AIAnytime Awesome-MCP-Server mcp-wiki wiki-summary can let attacker-controlled URL arguments trigger server-side requests.

dependency manifest

Kong Konnect MCP before 1.0.0 can return untrusted analytics/configuration content to agents and construct unintended Konnect API paths.

dependency manifest

HTTP bearer-token validation before 0.19.1 can traverse into the default legacy Telegram session file.

dependency manifest

Server/Docker deployments before 0.8.8-beta can leave the bundled /mcp endpoint outside the session auth gate.

dependency manifest

DeepTutor before 1.4.10 can treat omitted MCP tool grants as unrestricted access for low-privilege users.

dependency manifest

Claude Code before 2.1.163 could confuse Git worktree boundaries and run Git helper configuration outside the sandbox.

dependency manifest

pnpm before 10.34.0 / 11.4.0 can skip tarball integrity verification when pnpm-lock.yaml resolution entries omit integrity.

dependency manifest

pnpm before 10.34.0 / 11.4.0 can forward user-level unscoped npm credentials to a repository-selected registry.

dependency manifest

Flowise before 3.1.3 can accept case-variant NODE_OPTIONS in Custom MCP stdio environments on Windows.

workspace filesystem

HTTP backend versions before 2026.6.1 can use raw absolute version/bin_path values when creating install symlinks.

dependency manifest

HTTP lockdown mode from 0.22.0 before 1.1.2 reused a process-global repo access cache across authenticated users.

dependency manifest

MCP OAuth resource metadata can redirect access tokens to a malicious server before 0.8.5.

workspace filesystem

Cursor before 3.0 can fall back after path canonicalization failure and write through an in-workspace symlink outside the workspace boundary.

dependency manifest

Cursor before 3.0 lets an agent-controlled working directory expand the terminal sandbox's writable scope outside the intended workspace.

dependency manifest

Custom MCP node-load handling before 3.0.6 can execute OS commands when Flowise is left without built-in auth.

source code

vLLM before 0.22.1 could install flashinfer-jit-cache from PyPI during Docker builds because unsafe-best-match was paired with a FlashInfer extra index.

dependency manifest

versions from 0.24.0 before 1.1.0 validate MCP workspace roots through path.resolve() instead of canonical symlink-aware paths.

workspace filesystem

versions from 0.20.0 before 1.1.0 can follow symlinks while writing daemon.pid in a deterministic /tmp runtime path.

dependency manifest

version 1.0.0 passes OpenClaw exec tool input into a shell-backed execSync template without shell-safe escaping.

dependency manifest

permission splitter before 0.42.2 can miss shell execution boundaries and return allow for hidden commands.

dependency manifest

VS Code extension versions before 21.2.4 render hover Markdown with trusted command URIs.

dependency manifest

Streamable HTTP mode before 1.1.2 binds the MCP endpoint on 0.0.0.0 without MCP-layer authentication.

dependency manifest

mcp-pinot 3.0.1 and earlier default to an unauthenticated HTTP MCP server on 0.0.0.0:8080.

dependency manifest

legacy MCP protocol handlers before 1.4.0 skip per-tool scopesRequired checks.

dependency manifest

HTTP modes before 0.7.5 exposed the MCP control plane without authentication while allowing wildcard CORS.

dependency manifest

Network-AI 5.7.1 and earlier keep the MCP SSE server authorized when its secret is empty/default.

plugin/hook config

workspace-defined Claude hook commands could run without dedicated approval before 3.0.0.

dependency manifest

wildcard Origin and Host defaults allow DNS rebinding against local Toolbox MCP servers before hardened startup flags are used.

dependency manifest

retry endpoint checks before 2026.5.7 use hostname-prefix matching instead of exact hostname validation.

dependency manifest

node pairing reconnection can confuse approval scope decisions before 2026.5.27.

dependency manifest

PowerShell encoded-command alias handling can bypass exec allowlist checks before 2026.5.12.

dependency manifest

QQBot pre-dispatch slash commands can skip allowFrom policy checks before 2026.4.27.

dependency manifest

QQBot streaming commands before 2026.4.29 can mutate configuration without explicit allowFrom restrictions.

dependency manifest

before 2026.5.18, trusted-proxy identity headers can be forged by same-host callers reaching the proxy-facing Gateway port.

dependency manifest

system.run safe-bin allowlist validation before 2026.5.18 lets POSIX shell expansion alter approved command interpretation.

dependency manifest

approval prompt rendering before 2026.5.18 can truncate command suffixes or privileged action details.

dependency manifest

native command handling before 2026.5.6 could skip owner-only command policy enforcement.

dependency manifest

Slack allowFrom checks before 2026.5.3 trusted mutable display-name metadata.

dependency manifest

Shell wrapper arguments can be rebuilt after allowlist approval before 2026.5.18.

dependency manifest

WebSocket client-declared operator scopes can be accepted before server-approved pairing or trusted-proxy authorization before 2026.5.18.

dependency manifest

workspace .env files can override Homebrew executable selection during skill install before 2026.5.27.

dependency manifest

Control UI pairing can trust spoofed locality information before 2026.5.22.

dependency manifest

paired or compromised nodes can forge exec lifecycle events before 2026.5.18.

dependency manifest

hook-triggered agent runs can incorrectly receive owner-scoped MCP loopback access before 2026.5.20.

dependency manifest

memory-core artifact root resolution can traverse to unintended local package roots before 2026.4.25.

dependency manifest

browser-control redirects can bypass private-network navigation blocks before 2026.5.18.

dependency manifest

Matrix allowFrom policy can match mutable display-name metadata before 2026.5.7.

dependency manifest

marketplace runtime extension metadata can redirect loading toward unscanned package payloads before 2026.5.18.

dependency manifest

Telegram interactive callbacks can skip commands.allowFrom validation before 2026.5.6.

dependency manifest

combined POSIX shell flags can bypass exec revalidation before 2026.5.12.

dependency manifest

kubectl_generic passed user-supplied flags to kubectl before 3.7.0.

dependency manifest

tool allowlist environment variables were enforced only during tools/list before 3.6.0.

dependency manifest

VIEW users can receive decrypted admin-managed MCP secrets through 0.8.3.

dependency manifest

MCP URL placeholders resolve server environment secrets through 0.8.3.

dependency manifest

API key updates can target another user through request body userId fields before 0.8.3.

dependency manifest

serverBaseUrl handling can allow SSRF in mcpilot client 0.1.0.

dependency manifest

Gateway chat.send scope checks allow privileged command paths before 2026.5.18.

dependency manifest

browser debug/export routes can reuse blocked tabs before 2026.4.29.

dependency manifest

QQBot native approval buttons miss approver identity checks before 2026.5.18.

dependency manifest

QQBot admin commands can skip DM-only and allowFrom policy before 2026.4.29.

dependency manifest

Slack plugin approvals use the wrong approval gate before 2026.5.12.

dependency manifest

device-pair plugin can issue bootstrap codes from non-owner chats before 2026.5.4.

workspace filesystem

filesystem search passes prompt-controlled terms to ripgrep as options before 1.13.0.

dependency manifest

empty API_TOKEN disables bearer-token auth before 2.4.1.

MCP server config

HTTP/SSE transport exposes GitLab token-backed MCP tools without authentication before 0.6.0.

dependency manifest

MCP server args are forwarded to code-capable allowlisted binaries before 0.9.7.

dependency manifest

initialize projectPath handling can write outside the intended memory-bank directory.

source code

Skills Guard multi-word prompt pattern hardening is missing before 0.15.0.

dependency manifest

Assistant ajax-api origin validation lets hostile pages reconfigure local agents.

dependency manifest

COMSPEC is trusted during Windows version checks through 0.0.12.

dependency manifest

OSC 8 hyperlinks use raw cwd and branch URL values through 0.0.12.

dependency manifest

SymPy expression tool input reaches Python eval before 0.1.1.

dependency manifest

plugin.json component paths can escape the plugin directory before 0.8.12.

plugin/hook config

nested bare Git repositories can execute configured helpers during agent git operations before 1.0.43.

dependency manifest

HTTP transport exposes the run-code MCP tool without authentication on port 3088.

permissions/trust config

Issue-triggered Claude Code workflows embed untrusted issue title/body content.

dependency manifest

raw command blocklist checks can be bypassed in plugin-shell 0.1.0.

dependency manifest

agent commands are wrapped in sh -c or cmd /C in plugin-shell 0.1.0.

dependency manifest

BlueBubbles webhook handling is authorization-bypass prone before 2026.2.12.

dependency manifest

export_objects accepts attacker-controlled destination directories when no allowlist is configured.

dependency manifest

Matrix room control commands trust DM pairing-store entries before 2026.4.15.

dependency manifest

Feishu webhook validation fails open when auth material is blank.

dependency manifest

Bearer SecretRefs are cached through token rotation.

dependency manifest

Sandbox CDP relay binds Chrome DevTools to all interfaces.

dependency manifest

Async exec completions bypass heartbeat owner downgrade checks.

dependency manifest

Sandbox noVNC helper route exposes browser session credentials.

dependency manifest

Heartbeat owner downgrade weakens channel ownership boundaries.

dependency manifest

External hook metadata is queued as trusted system events.

dependency manifest

fileUrl validation can allow SSRF in directus-mcp 1.0.0.

dependency manifest

ACP attachment paths can traverse outside the workspace before 2026.3.31.

dependency manifest

jq safe-bin expressions can disclose process environment before 2026.3.28.

dependency manifest

local media roots can be self-whitelisted before 2026.3.31.

dependency manifest

MCP media_paths handling can be steered into SSRF in 0.8.11.

dependency manifest

openUrl can be abused for SSRF before CloudBase-MCP 2.17.1.

dependency manifest

working_dir and editable_files handling can allow command injection in vulnerable GitHub source installs.

dependency manifest

node.pair.approve accepts broad operator.write instead of pairing scope.

dependency manifest

device.token.rotate can mint roles that were not approved for the device.

plugin/hook config

MS Teams webhook bodies are parsed before JWT validation.

dependency manifest

Trusted-proxy scope clearing lets non-Control-UI clients self-declare operator scopes.

dependency manifest

WebSocket upgrades consume socket and worker capacity before auth.

dependency manifest

Workspace .env overrides the bundled plugin trust root.

plugin/hook config

plugin-auth routes receive operator runtime write scopes without auth.

dependency manifest

Bootstrap setup codes are not role-bound during first-use pairing.

dependency manifest

node.event requests can reach unrestricted gateway tools.

dependency manifest

URL validation can be bypassed for SSRF in 0.1.0.

dependency manifest

editable file path handling can lead to command injection in 0.1.0.

dependency manifest

model API base_url handling can allow SSRF through 1.5.0.

dependency manifest

web-scraper URL handling can be abused for SSRF in 1.0.0.

dependency manifest

config.patch can silently disable execution approval.

plugin/hook config

Workspace .env overrides the bundled hooks trust root.

plugin/hook config

Settings hooks execute arbitrary shell on PreToolUse / Stop events.

MCP server config

MCP credentials stored plaintext in user-readable config.

permissions/trust config

Symlink in workspace allows sandbox escape on read.

source code

Serena before 1.0.0 listens on 0.0.0.0 by default when its MCP server uses HTTP mode. The supplier changed the default to 127.0.0.1 and warns about…

dependency manifest

MCPHub before 1.0.32 does not consistently authenticate confidential OAuth clients and allows public clients to obtain authorization codes without mandatory…

dependency manifest

knowns through 0.33.0 fails to confine the path argument of the code.find MCP tool to the project root, allowing AI agent sessions to read source files…

dependency manifest

knowns through 0.33.0 fails to properly validate template destination paths in the code generation template engine, allowing attackers to read and write…

dependency manifest

career-ops is an open-source AI-assisted job search and application management tool. Prior to 0.8.0, the career-ops local web dashboard web/ exposed…

dependency manifest

A missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 version might allow remote attackers to obtain the private…

dependency manifest

A missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for-devsecops before 1.1.0 might allow remote attackers to…

dependency manifest

IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative user could execute arbitrary operating system commands on the server at the…

dependency manifest

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special…

dependency manifest

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary Python code due to improper authorization of custom…

dependency manifest

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary code due to code injection during graph construction.

dependency manifest

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an incomplete environment variable blocklist.