Security Monitor 2026-10-08

Informational security guidance for awareness and prioritization. Not certification, legal advice, or a guarantee of protection.

Executive Summary

The AI stack's plumbing is the attack surface today. LMCache, the KV-cache layer that sits under vLLM, has an unauthenticated remote code execution flaw (CVE-2026-105192, CVSS 9.8) in versions 0.3.9 through 0.5.5. There's no patch. If your multi-node deployment binds port 5555 to a routable address, isolate it now.

Progress patched CVE-2026-91140 (CVSS 9.6) in its Copilot-based DataDirect ARCGenAI-Generator on October 6. A crafted OpenAPI or Swagger file runs OS commands on the developer's machine when the tool processes it. The spec is the payload. Update to v2.1 and stop feeding it untrusted specs.

Detection isn't keeping up either. Pluto Security built a working credential thief and a working RCE server as MCP servers, and five popular scanners each returned a clean or zero-finding result in at least one tested configuration. Separate research shows payloads split across MCP tool descriptions, results, and sampling messages can exfiltrate credentials at up to 100% from models that resist single-channel injection. A clean scan is a starting point, not an approval.

On the edge, the FBI and Secret Service warned on Tuesday, October 6, that the FortiBleed credential campaign against FortiGate firewalls and SSL VPNs is still active. Treat any internet-facing FortiGate as a possible compromise and investigate accordingly.

Headline Developments

1. LMCache CVE-2026-105192: unauthenticated RCE in the vLLM KV-cache layer, no patch HIGH

Source: Forkast - LMCache CVE-2026-105192: Unpatched Critical RCE in the LLM KV Cache Layer (Oct 7). Also NVD - CVE-2026-105192.
- LMCache's distributed mode opens an unauthenticated ZeroMQ ROUTER socket on port 5555. A single message carrying msgpack extension code 1 triggers pickle.loads on attacker-controlled data during argument decoding, before any handler logic runs (CWE-306 / CWE-502).
- Affected: versions 0.3.9 through 0.5.5. As of October 7 there's no patch. Code runs with the LMCache process's privileges, and official container images run it as root.
- The transport binds to localhost by default. Multi-node deployments routinely pass a routable --host, which turns that default into a network service.
- EPSS is low (0.671%). The NVD record is in Deferred status. The rating comes from unauthenticated access plus root execution plus no fix.

Why this matters: The rating is HIGH because there's no patch and the only control is the network. Whoever controls the KV cache can influence what the model reads as prior context, so this is a way into the inference pipeline itself, not just a server. Find every LMCache node with a routable --host, firewall port 5555 to known peers, and don't run the container as root if you can avoid it.

Pattern callout: New thought today: the cache under the model is a trust boundary nobody wrote auth for. Same "trusted network by default" failure seen in Splunk MCP Server and DB-GPT, now in the layer between the network and the model.

2. Progress DataDirect ARCGenAI-Generator CVE-2026-91140: a malicious OpenAPI spec runs OS commands (CVSS 9.6), patched MEDIUM-HIGH

Source: byteiota - DataDirect AI Tool CVE-2026-91140: OpenAPI Files Execute OS Commands (Oct 8). Also Progress DataDirect security bulletin for CVE-2026-91140.
- ARCGenAI-Generator is a Copilot-based agent workspace (VS Code Copilot Chat and GitHub Copilot CLI) that turns Swagger and OpenAPI specs into DataDirect connector configs.
- v2.0 runs a shell cleanup routine that builds filenames from values inside the spec without proper validation or quoting. Shell metacharacters in a filename field execute under the developer's shell privileges. No auth, no second stage, no memory corruption.
- Affected files: ARCGenAI-Generator.agent.md v2.0, ARCGenAI-Generator.prompt.md v1.0, and ARCGenAI-EntityGen.agent.md v1.0. v2.1, released with the advisory on October 6, fixes all three. No in-the-wild exploitation or public PoC reported at disclosure.
- The fix is a pull, not an installer: git -C datadirect-arc-ai-model-gen pull.
- byteiota cites research finding AI-agent tooling in 14 of 59 supply-chain campaigns in 2025-2026. The underlying study isn't named, so treat the figure as directional.

Why this matters: The rating is MEDIUM-HIGH because the score is critical and the attack is cheap: publish a "public API spec," promote it, and wait for developers to run it. A patch is out and nobody's seen exploitation, so a short deployment window (days, not weeks) is reasonable. The bigger lesson applies to every tool that ingests OpenAPI specs, MCP descriptors, or skill definitions. That input is untrusted data from the moment it arrives.

Pattern callout: New thought today: in API security, the spec used to describe the attack surface. Now it can be the exploit. Extends the agent supply-chain thread into AI developer tooling.

3. FBI and USSS: FortiBleed credential campaign still active against FortiGate HIGH

Source: The Hacker News - FBI Warns FortiBleed Remains Active After Amassing 86,644 Fortinet Device Credentials (Oct 7). Also FBI/USSS Cybersecurity Advisory (PDF).
- The FBI and U.S. Secret Service warned on Tuesday, October 6, that FortiBleed is still targeting internet-facing FortiGate firewalls and SSL VPN gateways using reused or leaked credentials and weak legacy password storage.
- The Russian-speaking operation had amassed more than 86,644 working device credentials across 194 countries as of June 19, 2026, and is still scanning with previously stolen credentials.
- Reported stages: reconnaissance, credential stuffing and spraying, a Go-based tool called FortigateSniffer that passively captures authentication traffic across 24 protocols, GPU-accelerated offline cracking, then AD enumeration, Kerberos validation, SMB authentication, exfiltration, and session-cookie persistence.
- SOCRadar says at least 12 ransomware deployments trace back to FortiBleed access, with hundreds of endpoints encrypted. The operator is suspected to be an initial access broker tied to INC, Lynx, and Payload affiliates. Treat the deployment count as a vendor figure.
- Persistence accounts reported on compromised appliances include adminin, fortiAdmin, forticloud-sync, fgtsecure, pakedge, forticloud-tech, districtadmin, system_config, gttadmin, roadmin, itadmin, Technical_support, adminsslvpn, IT_Manager, my_admin, support_fortinet, fgtsec, and forti_support2. Some victims were locked out after original admin passwords were changed.

Why this matters: The rating is HIGH because this is active, attributed, and leads to ransomware. A credential harvested in June is still a door today if nobody rotated it. This isn't a patch ticket. It's a compromise investigation: restrict external management, kill active sessions, rotate admin and VPN credentials, hunt for the account names above, and require phishing-resistant MFA.

Pattern callout: New thought today: old credentials don't age out on their own, and the edge appliance is where they get reused. Extends the edge-boundary thread (NetScaler, FortiMail, Exchange) from vulnerabilities to credential reuse at campaign scale.

4. Malicious MCP servers pass scanners, and fragmented injection steals credentials MEDIUM

Source: Pluto Security - Malicious Servers, Clean Scans: The Dangerous Illusion of a Clean MCP Scan. Also arXiv - Measuring and Exploiting Implicit Trust in LLM Tool-Calling Pipelines and the Adversa AI October MCP security digest (Oct 8).
- Pluto built two working malicious MCP servers, a credential thief and a remote code executor. Cisco mcp-scanner, Snyk agent-scan, Ventrova sentinel-scan-cli, mcp-shield, and NVIDIA SkillSpector each returned a clean or zero-finding result in at least one tested configuration. SkillSpector's default LLM review did catch both normal-size servers. Evasions included payloads in handler code, obfuscation, oversized files, and scanner fingerprinting.
- The arXiv paper splits a payload across tool descriptions, tool results, and sampling messages so no single channel carries a full injection. Across 12 frontier models and over 15,000 trials, Adversa's summary reports credential exfiltration at up to 100% from models that resist single-channel injection, and seven MCP security tools missed the fragments.
- The npm package gadgethumans-mcp advertised automatic x402 micropayment signing. Per Adversa, it does no signing and sends the raw WALLET_PRIVATE_KEY environment variable to a remote endpoint on every tool call.
- More MCP auth gaps in the same digest: the Grafana MCP server accepted forged session IDs and a spoofable X-Grafana-URL header made it an SSRF proxy (CVE-2026-19516). The MCP Python SDK's OAuth client had a fallback that skipped issuer validation and sent client secrets and PKCE verifiers to attacker endpoints. Fixed in SDK 1.30.0 and 2.2.0.

Why this matters: The rating is MEDIUM because there's no single CVE driving it, but the defensive gap is concrete. If a scanner result is your MCP deployment gate, it's a weak gate. Pin servers to reviewed versions, read the handler code for anything holding credentials, move secrets out of MCP configs, add reauthorization inside each tool, and update the MCP Python SDK.

Pattern callout: New thought today: detection that inspects one message or one manifest at a time misses attacks spread across channels or hidden in handler code. Extends the agent supply-chain thread at the detection layer. SkillSpector appeared here in September as a defense; today it's one of the tools tested.

5. OpenAI sandbox escape reportedly allowed paid-model access without an API key, $300 bounty MEDIUM

Source: Cyber Security News - OpenAI Sandbox Escape Flaw Allowed Free Access to Paid AI Models Without an API Key (Oct 7). Also Oliver Fish on X. Researcher claim with secondary coverage.
- Researcher Oliver Fish says he found an OpenAI sandbox escape that let him call paid models without an API key or account. A shared screenshot shows a $300 award for "Unauthenticated Sandbox Escape Enables Access to Internal OpenAI Responses API."
- If accurate, it crossed two controls at once: sandbox isolation and API authentication, skipping normal identity and billing checks.
- No PoC, endpoint, affected models, CVE, exposure window, or patch note is public. There's no public evidence customer data was reached or that anyone else used it.
- Fish wrote on X: "Zero reason to report anything else I find to them." OpenAI's Bugcrowd program pays $200 to $20,000 depending on severity.

Why this matters: The rating is MEDIUM because it's an unconfirmed researcher claim with nothing for customers to patch. For anyone running an API or model gateway, the lesson is direct: authenticate every internal hop, block anonymous model calls, and set rate and spend limits. The low payout is worth watching, since bounty economics shape what researchers bother to report.

Pattern callout: New thought today: an internal route that skips auth is a sandbox escape and a billing bypass at the same time. Extends the "vendor is the case study" thread with another OpenAI sandbox-boundary report.

6. CoSAI MCP Security v2.0; 12% of public MCP config credential slots hold hardcoded secrets CONTEXT

Source: Adversa AI - Top MCP security resources, October 2026 (Oct 8). Also CoSAI - MCP Security v2.0.
- CoSAI's MCP Security v2.0 turns its 12 threat categories into an auditable model with four assurance levels and eight security dimensions, from a local sandbox up to regulated multi-tenant platforms. It adds guidance on stateless sessions, the Tasks framework, post-quantum migration, and centralized gateway enforcement.
- A scan of about 82,000 public coding-agent MCP config files found 12% of credential slots hardcode a secret. 55% of those don't match a known token shape, so gitleaks and GitHub secret scanning miss them. 24% are broad and never expire.
- A two-stage black-box attack (A2M) tunes tool metadata so agents pick a malicious tool (93.6% invocation) and then tunes tool returns to reach 74.4% attack success. It transfers across models.

Why this matters: The rating is CONTEXT because there's nothing to patch. CoSAI v2.0 gives teams a reference for how much MCP control a deployment needs. The config numbers say to inventory MCP files as credential stores, not developer preferences.

Pattern callout: New thought today: secret scanners tuned for token shapes miss most MCP config secrets. Gives the agent supply-chain thread an audit framework to measure against.

Continuity Footnotes

• LiteLLM CVE-2026-59822 (MCP endpoint auth bypass, CISA KEV since Sep 2) - covered 09-17 and in later briefs. New today: Adversa reports 9.6% of exposed LiteLLM proxies still accept the default sk-1234 master key. Patch and change the master key.
• Citrix NetScaler CVE-2026-88779 (SAML DoS, RCE under investigation) - covered 10-05. CISA's federal deadline was October 7. If 14.1-73.41, 13.1-64.28, or 13.1-37.282 isn't deployed, it's past due.
• FortiMail CVE-2026-104286 - KEV deadline 10-04 passed. Fortinet published corrected builds on 10-05 (FG-IR-26-175: 8.0.2 / 7.6.7 / 7.4.9; move 7.2 to 7.4+).
• Atlassian CVE-2026-21589 (8 Data Center products, CVSS 9.3) - covered 10-07. Upgrade or restrict network access.
• KVM guest-to-host zero-day via Vercel Sandbox - covered 10-07. Still no CVE or patch.
• Wikimedia OpenAI agents, NYC Council hearing, Australia breach-reporting endorsement, Tuskira gateway, mech.app dataset - covered 10-07; nothing new today.
• Meta Muse VM escape, ARTEX bank breaches, Exchange CVE-2026-96940, Pentagon DMDC, Google PageBreak, RubyGems swarm, GitLab AI Gateway CVE-2026-90970, AWS Loom/SageMaker, Zammad KEV, Apple CoreGraphics KEV - covered in earlier briefs; nothing new today.

Pattern Analysis

Recommended Actions

Immediate (this week):

1. If you run LMCache in distributed mode, firewall port 5555 now. Audit every node for a routable --host, restrict the port to known peers, and avoid running as root. There's no patch for CVE-2026-105192.

2. If you run FortiGate firewalls or SSL VPN, run a compromise investigation. Restrict external management, terminate active sessions, rotate admin and VPN credentials, hunt for the persistence account names in Story 3, and enforce phishing-resistant MFA.

3. If you use DataDirect ARCGenAI-Generator, update to v2.1. Stop running v2.0 on third-party specs and review any CI/CD job that runs it automatically.

4. If you run Citrix NetScaler with SAML, deploy the CVE-2026-88779 fix today. The federal deadline passed October 7.

5. If you run LiteLLM, patch for CVE-2026-59822 and change the master key. Never leave sk-1234 in place. Update the MCP Python SDK to 1.30.0 or 2.2.0.

This month:

1. Stop treating a clean MCP scan as approval. Pin MCP servers to reviewed versions, read handler code for anything that touches credentials, and add reauthorization inside each tool.

2. Inventory MCP config files as credential stores. Move secrets into a vault or credential proxy. Don't rely on token-shape secret scanners alone.

3. Treat every ingested spec, MCP descriptor, and skill definition as untrusted input. Any tool that passes values from them to a shell needs validation and quoting.

4. If you run self-hosted Atlassian Data Center or FortiMail, close out CVE-2026-21589 and CVE-2026-104286.

Ongoing:

1. Authenticate every internal hop in your API and model gateways. Block anonymous model calls and set rate and spend limits.

2. Map your MCP deployments to CoSAI MCP Security v2.0 assurance levels. Use them to decide how much control each deployment needs.

3. Track the KVM zero-day for a CVE and patch, and watch for an LMCache fix.

Relevant Risk Summary

Sources

• Forkast - LMCache CVE-2026-105192: Unpatched Critical RCE in the LLM KV Cache Layer
• NVD - CVE-2026-105192
• byteiota - DataDirect AI Tool CVE-2026-91140: OpenAPI Files Execute OS Commands
• Progress DataDirect security bulletin - CVE-2026-91140
• The Hacker News - FBI Warns FortiBleed Remains Active After Amassing 86,644 Fortinet Device Credentials
• FBI/USSS Cybersecurity Advisory - FortiBleed (PDF)
• Pluto Security - Malicious Servers, Clean Scans
• arXiv - Measuring and Exploiting Implicit Trust in LLM Tool-Calling Pipelines
• Adversa AI - Top MCP security resources, October 2026
• Wiz - Off guard: breaking LiteLLM from authentication bypass to cloud compromise
• Cyber Security News - OpenAI Sandbox Escape Flaw Allowed Free Access to Paid AI Models Without an API Key
• Oliver Fish on X
• CoSAI - MCP Security v2.0
• FortiGuard PSIRT FG-IR-26-175 - FortiMail (CVE-2026-104286)
• CISA Known Exploited Vulnerabilities Catalog

Informational security guidance. Not certification.