# KLM Innovation Security Monitor
**Date:** October 15, 2026

> Informational security guidance for awareness and prioritization. Not certification, legal advice, or a guarantee of protection.

## Executive Summary
CISA added Atlassian CVE-2026-21589 to its KEV catalog on October 15th with an October 18th deadline. The unauthenticated file read across eight self-hosted Data Center products was patched October 5th, and attackers started probing it within hours of public technical details. Patch it or pull it off the internet this week. On the agent side, attackers are exploiting a Langflow flaw that turns an ordinary user account into code execution through an MCP server setting, using weak passwords to get in. Two new disclosures land on the same seam: JetBrains Junie CLI ran code from a project's own MCP config, and IntentKit let public callers run owner-only tools, including a wallet transfer. Research on TypeSafe's Jev shows why a model shouldn't be the permission check: text planted in the content it judges cut its injection detection from about 83% to under 4%. Unit 42 also found AI-written scripts in a long-running espionage campaign against government Linux servers, and Burger King's Japan operator reported 11.18 million app member records exposed.

## Headline Developments

### 1. Atlassian CVE-2026-21589 is now on KEV: unauthenticated file read across eight Data Center products (HIGH)
**Source:** [CISA: CISA Adds One Known Exploited Vulnerability to Catalog](https://www.cisa.gov/news-events/alerts/2026/10/15/cisa-adds-one-known-exploited-vulnerability-catalog) (October 15th)
- CISA added CVE-2026-21589 to KEV on October 15th, due October 18th, and marks it as requiring forensic triage. It affects Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo and Crowd Data Center, plus Crucible and Fisheye.
- An unauthenticated attacker who knows a file's exact name and path can read it from the web application root. It can't list directories. Atlassian rates it Critical (CVSS 4.0 9.3) and says Cloud is already patched ([Atlassian: CVE-2026-21589 - Arbitrary File Access Vulnerability impacts Multiple Products](https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html), October 5th).
- Fixed versions include Bitbucket 9.4.26, 10.2.8 and 10.5.1, Confluence 9.2.26 and 10.2.19, Jira Software 9.12.40, 10.3.26 and 11.3.12, and Crucible and Fisheye 4.9.15. Atlassian also publishes WAF and Tomcat rewrite rules as a stopgap, plus a log regex to check for past attempts.
- Attempts began within about two hours of public technical details on October 7th. Most observed activity was fingerprinting and reconnaissance ([watchTowr: CVE-2026-21589: Atlassian Data Center and Server Products Vulnerability](https://watchtowr.com/intelligence/atlassian-jira-confluence-arbitrary-file-read-cve-2026-21589/), updated October 15th). Treat that timing detail as secondary coverage ([Daily Security Review: Atlassian CVE-2026-21589 Exploited Within Two Hours of PoC Details](https://dailysecurityreview.com/resources/atlassian-cve-2026-21589-exploited-within-two-hours-of-poc-details/)).

**Why this matters:** It's HIGH because it's unauthenticated, exploited and on KEV, but it reads known files rather than running code, so it sits below CRITICAL. The real risk is whatever sits in the web root on your instance, such as config files that hold credentials. Patch, then search access logs with Atlassian's regex.

**Pattern callout:** Covered October 7th as patched with no exploitation. New today: confirmed exploitation and the KEV listing with a three-day clock.

### 2. Langflow CVE-2026-105740 exploited: any logged-in user can run commands through an MCP server setting (HIGH)
**Source:** [The Hacker News: Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts](https://thehackernews.com/2026/10/langflows-critical-authenticated-rce.html) (October 15th)
- Before 1.9.0, any authenticated Langflow user, including non-admins, could add an MCP server with the stdio transport. The command field went straight into `bash -c` with no allowlist, and it ran whenever the server list loaded. The config persists and isn't visible in normal flow review ([GitHub: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the server](https://github.com/langflow-ai/langflow/security/advisories/GHSA-7w94-79vh-5mr2)). CVSS 9.9.
- Previdian's honeypots had logged 1,677 attempts from 28 IP addresses by October 16th (UTC), with a jump starting October 11th ([Previdian: CVE-2026-105740 Exploitation Observed](https://previdian.com/CVE-2026-105740)). In one observed sequence, attackers tried auto-login, then got in with a common username and password. Payloads went after `LANGFLOW_SECRET_KEY`, the superuser password and the host filesystem.
- A related flaw, CVE-2026-105697 (CVSS 9.9), let the same MCP stdio path run commands through flow configs. It's fully fixed in Langflow 1.10.3, and with the default `LANGFLOW_AUTO_LOGIN=true` it's reachable without an account ([GitLab Advisory Database: Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration](https://advisories.gitlab.com/pypi/lfx/CVE-2026-105697/)).
- Neither CVE is on CISA's KEV list as of October 15th. The exploitation evidence comes from a single honeypot vendor.

**Why this matters:** It's HIGH because exploitation is observed and the fix has been out since September, but it needs a login. Weak or default credentials close that gap, and Langflow instances usually hold model provider keys. Go straight to 1.10.3 or later, since 1.9.0 alone doesn't close the related flaw.

**Pattern callout:** It's the same seam as the Copilot and Claude Desktop config bugs (October 14th): a setting that names a program is a way to run that program.

### 3. Two agent tools trusted their own config and tool lists: Junie CLI and IntentKit (MEDIUM)
**Source:** [GitHub: GHSA-44gv-r4c4-w64m (CVE-2026-111091)](https://github.com/advisories/GHSA-44gv-r4c4-w64m) (October 15th)
- CVE-2026-111091: JetBrains Junie CLI before 26.8.3 could run code from an untrusted project's MCP server configuration. JetBrains scores it 7.8 (local, one user action) and lists 26.8.3 as the fix, with no workaround ([The Injection: Junie CLI: an untrusted project's MCP config could run code](https://theinjection.dev/items/jetbrains-junie-cli-mcp-config-rce/), October 15th).
- CVE-2026-76066: IntentKit through 2.6.3 checked tool calls against its full tool registry instead of the narrower list it advertised for each request. A public caller in web, API, X or Telegram contexts could name a hidden owner-only tool, such as a wallet transfer, posting or a memory write, through indirect prompt injection or by replaying thread history. None of those tools had an approval step ([VulnCheck: IntentKit 2.6.3 Executor Tool Authorization Bypass via ToolNode](https://www.vulncheck.com/advisories/intentkit-executor-tool-authorization-bypass-via-toolnode), October 15th). CVSS 4.0 8.7. No fixed version is listed.
- Neither has reported exploitation, and neither is on KEV.

**Why this matters:** It's MEDIUM because there's no exploitation, but both are the same mistake: hiding a tool from the model isn't the same as denying it. Authorization has to happen where the tool runs, and any repo you clone can carry config that your agent will treat as instructions.

**Pattern callout:** Extends the October 14th agent control plane thread (NullHub, Portkey) and the coding-agent config thread (Copilot in Visual Studio, Claude Desktop).

### 4. A model as the permission check: planted "policy" text cuts Jev's injection detection to under 4% (MEDIUM)
**Source:** [Datadog Security Labs: Jev as a judge: How counterfeit policy steers Jev](https://securitylabs.datadoghq.com/articles/jev-as-a-judge-how-counterfeit-policy-steers-jev/) (October 15th)
- Datadog researchers tested TypeSafe's Jev decision model as a prompt injection classifier across 12,295 samples. On plain attacks it caught 82.90% with 99.66% precision.
- When they placed a fake policy inside the content Jev was judging (supplying the desired answers and redefining every attack category), detection fell to 3.88%. Plain "ignore your instructions" injections didn't work. Rewriting the criteria did.
- Against LangChain's tool-risk gating, which blocks a call at a risk score of 0.5, a counterfeit policy in a user-editable profile field dropped the mean score for an unauthorized edit from 0.893 to 0.290 over 40 runs, so the call would have gone through.
- Separately, HiddenLayer reported that a planted "Confirm Price" ad steered a Jev-based shopping agent into clicking it, and that TokenBreak-style edits slipped toxic prompts past Jev ([The Register: Jev and other decision models can still be tricked with prompt injection](https://www.theregister.com/ai-and-ml/2026/10/15/jev-and-other-decision-models-can-still-be-tricked-with-prompt-injection/5303184), October 15th). TypeSafe's own docs say injected text can influence Jev's answers.

**Why this matters:** It's MEDIUM because it's research, not a product flaw with a patch. A fast, cheap classifier is a fine triage layer, but if its verdict is the only thing between untrusted text and a tool call, the attacker gets to grade their own exam. Keep the permission check in code.

**Pattern callout:** Same lesson as Story 3 from the other direction. One hides tools from the model, the other asks a model to enforce permissions, and both put the check in the wrong place.

### 5. Unit 42: AI-written scripts in a long-running espionage campaign against government Linux servers (MEDIUM)
**Source:** [Unit 42: AI-Powered Espionage Campaign Targets Government Linux Infrastructure](https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/) (October 15th)
- Unit 42 tracks the activity as CL-UNK-1211. It targeted government entities and state-affiliated infrastructure from October 2025 to April 2026, and Unit 42 hasn't tied it to a nation-state or a criminal group.
- Attackers' PHP and shell scripts carried conversational, step-by-step reasoning comments, which suggests they were generated by an LLM or run by an AI agent. Unit 42 also points to section headers in command output, heavy Base64 use and fast switching between PHP, JavaScript, Bash and Python.
- The tradecraft is familiar: web shells persisted through PHP `auto_prepend_file`, a `sudo` alias in `.bashrc` that captured passwords, a custom Go RAT (SysGoRAT), mailbox searches for social media account emails, database dumps, and log wiping. One AI-written exfiltration script had syntax errors and would have failed.

**Why this matters:** It's MEDIUM because it's a threat report, not a patchable flaw. AI made the attacker faster, not novel. Every technique here is something existing Linux monitoring can catch, so the defense is coverage on servers that often don't have it.

**Pattern callout:** A field example of AI speeding up known attacks rather than inventing new ones.

### 6. Burger King's Japan operator reports 11.18 million app member records exposed (MEDIUM)
**Source:** [Kyodo News: Burger King's Japan operator says 11.18 mil. customer records exposed](https://english.kyodonews.net/articles/-/88323) (October 15th)
- The company says unauthorized access ran from October 2nd to 7th and it confirmed the leak on October 13th. The exposed data came from a system managing the official smartphone app and includes names, dates of birth, email addresses, phone numbers and gender.
- The company says it doesn't store card numbers, so they weren't compromised, and it hasn't confirmed any fraudulent use. The investigation is ongoing ([BK Japan: notice of unauthorized access to official app member information (Japanese)](https://www.burgerking.co.jp/images/notice/2026/10/15/d4d114ca-ebd7-4f3d-94ef-c4ea7a84a139.pdf), October 15th).
- It's the latest in a run of Japanese corporate breach disclosures, after the Arcadia municipal alert platform (October 14th).

**Why this matters:** It's MEDIUM because it's a confirmed, large exposure but there's no CVE, patch or published root cause. Names, birth dates and phone numbers together make convincing phishing and account recovery lures.

**Pattern callout:** Follows the Japanese records exposures covered October 11th and 14th. App back ends that hold the whole member base keep turning one intrusion into millions of notifications.

## Continuity Footnotes
- Ivanti Connect Secure CVE-2026-104935 and Windows Shell CVE-2026-96951: covered October 13th. Their KEV deadline is tomorrow, October 16th.
- Cisco Secure Email Gateway CVE-2026-76519, PAN-OS CVE-2026-0322 and AhsayCBS CVE-2026-105133 and CVE-2026-105134: covered October 14th. KEV deadline October 17th. New today: Huntress says it independently verified that the AhsayCBS 10.3.4.45 hotfix closes the initial entry point ([The Hacker News: AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches](https://thehackernews.com/2026/10/ahsaycbs-flaws-exploited-to-deploy-web.html)).

## Pattern Analysis
1. **Config that names a program is code (October 13th to 15th):** Langflow's MCP stdio command (Story 2), Junie CLI's project MCP config (Story 3), and the Copilot and Claude Desktop config bugs (October 14th). If an agent or user can edit it, treat it as a list of programs that will run.
2. **Authorization in the wrong layer (October 14th to 15th):** IntentKit hid tools instead of denying them (Story 3), a model was asked to enforce permissions and was talked out of it (Story 4), and NullHub shipped with no auth at all (October 14th). The check has to happen where the action runs, in code.
3. **Exploitation within hours, deadlines within days (October 13th to 15th):** Atlassian probing started about two hours after technical details went public (Story 1). That's seven KEV entries in three days, all due by October 18th.
4. **AI speeds up known attacks (October 15th):** Unit 42's AI-written scripts (Story 5) used old techniques. Detection that covers the basics on Linux servers still works.

## Recommended Actions
**Immediate (this week):**
1. **Atlassian Data Center (CVE-2026-21589, KEV due October 18th):** upgrade to the fixed version for each product, or take the instance off the internet and apply Atlassian's WAF or Tomcat rewrite rule. Then search access logs with Atlassian's regex and rotate any secrets stored in files under the web root.
2. **Langflow (CVE-2026-105740 and CVE-2026-105697):** upgrade to 1.10.3 or later, set `LANGFLOW_AUTO_LOGIN=false`, enforce strong unique passwords, review `/api/v2/mcp/servers` requests and stored MCP server configs, and rotate `LANGFLOW_SECRET_KEY` and any provider keys if the instance was exposed.
3. **KEV deadlines:** Ivanti Connect Secure and Windows Shell are due October 16th. Cisco Secure Email Gateway, PAN-OS and AhsayCBS are due October 17th.

**This month:**
4. **Junie CLI (CVE-2026-111091):** update to 26.8.3 or later, and don't run it in repositories you don't control until you have.
5. **IntentKit (CVE-2026-76066):** with no fix listed, turn off state-changing tools (wallet transfer, posting, memory writes, agent calls) on any agent reachable by the public, or put a human approval in front of them.
6. **Model-based guardrails:** list every place a classifier verdict gates a tool call, and trace which user-editable fields reach that classifier. Back each gate with a deterministic permission check.
7. **Phishing watch:** warn customers and staff about lures that reference the Burger King Japan exposure.

**Ongoing:**
8. Treat MCP and agent config shipped inside a project as untrusted input. Review it before an agent loads it.
9. Monitor Linux servers for `auto_prepend_file` changes, `.bashrc` aliases on `sudo`, new SUID binaries and log deletion.
10. Track KEV daily. This week every deadline lands three days after the listing.

## Relevant Risk Summary
| Risk | Severity | Recommended Actions |
|---|---|---|
| Atlassian CVE-2026-21589, exploited, KEV (due October 18th) | HIGH | Fixed versions or off the internet; log regex; rotate web-root secrets |
| Langflow CVE-2026-105740 exploited (CVE-2026-105697 related) | HIGH | 1.10.3+; auto-login off; strong passwords; rotate keys |
| Junie CLI CVE-2026-111091; IntentKit CVE-2026-76066 (no fix listed) | MEDIUM | Junie 26.8.3+; disable or gate IntentKit state-changing tools |
| Counterfeit policy steering of Jev as a security classifier | MEDIUM | Deterministic permission checks behind any model verdict |
| CL-UNK-1211 AI-assisted espionage against government Linux servers | MEDIUM | Linux server monitoring for persistence, credential capture and log wiping |
| Burger King Japan 11.18M app member records exposed | MEDIUM | Phishing awareness |

## Sources
- [CISA: CISA Adds One Known Exploited Vulnerability to Catalog](https://www.cisa.gov/news-events/alerts/2026/10/15/cisa-adds-one-known-exploited-vulnerability-catalog)
- [Atlassian: CVE-2026-21589 - Arbitrary File Access Vulnerability impacts Multiple Products](https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html)
- [watchTowr: CVE-2026-21589: Atlassian Data Center and Server Products Vulnerability](https://watchtowr.com/intelligence/atlassian-jira-confluence-arbitrary-file-read-cve-2026-21589/)
- [Daily Security Review: Atlassian CVE-2026-21589 Exploited Within Two Hours of PoC Details](https://dailysecurityreview.com/resources/atlassian-cve-2026-21589-exploited-within-two-hours-of-poc-details/)
- [The Hacker News: Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts](https://thehackernews.com/2026/10/langflows-critical-authenticated-rce.html)
- [GitHub: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the server](https://github.com/langflow-ai/langflow/security/advisories/GHSA-7w94-79vh-5mr2)
- [Previdian: CVE-2026-105740 Exploitation Observed](https://previdian.com/CVE-2026-105740)
- [GitLab Advisory Database: Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration](https://advisories.gitlab.com/pypi/lfx/CVE-2026-105697/)
- [GitHub: GHSA-44gv-r4c4-w64m (CVE-2026-111091)](https://github.com/advisories/GHSA-44gv-r4c4-w64m)
- [The Injection: Junie CLI: an untrusted project's MCP config could run code](https://theinjection.dev/items/jetbrains-junie-cli-mcp-config-rce/)
- [VulnCheck: IntentKit 2.6.3 Executor Tool Authorization Bypass via ToolNode](https://www.vulncheck.com/advisories/intentkit-executor-tool-authorization-bypass-via-toolnode)
- [Datadog Security Labs: Jev as a judge: How counterfeit policy steers Jev](https://securitylabs.datadoghq.com/articles/jev-as-a-judge-how-counterfeit-policy-steers-jev/)
- [The Register: Jev and other decision models can still be tricked with prompt injection](https://www.theregister.com/ai-and-ml/2026/10/15/jev-and-other-decision-models-can-still-be-tricked-with-prompt-injection/5303184)
- [Unit 42: AI-Powered Espionage Campaign Targets Government Linux Infrastructure](https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/)
- [Kyodo News: Burger King's Japan operator says 11.18 mil. customer records exposed](https://english.kyodonews.net/articles/-/88323)
- [BK Japan: notice of unauthorized access to official app member information (Japanese)](https://www.burgerking.co.jp/images/notice/2026/10/15/d4d114ca-ebd7-4f3d-94ef-c4ea7a84a139.pdf)
- [The Hacker News: AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches](https://thehackernews.com/2026/10/ahsaycbs-flaws-exploited-to-deploy-web.html)

*Informational security guidance. Not certification.*