Also available as plain text · markdown source

Security Monitor 2026-11-03

Informational security guidance for awareness and prioritization. Not certification, legal advice, or a guarantee of protection.

Executive Summary

Today's theme is that sandbox and tool boundaries keep failing where a second path reaches the host, and that an agent's training data can pick a package that will never be patched. Endor Labs published CVE-2026-103916 in Docker Sandboxes: the sbx cp command follows workspace symlinks, so a malicious or prompt-injected agent can read host secrets or write outside the allowlist when the operator runs a normal copy. Docker fixed it in 0.51.0. Glow Labs documented MCPhantom, where coding agents install deprecated Anthropic reference MCP servers remembered from training data, including a Puppeteer remote code execution bug with no fix coming and no CVEs assigned. And AWS fixed a path traversal in the Serverless MCP Server's deployment status tool, CVE-2026-116635, in 0.2.1.

CISA added WordPress Core CVE-2026-119977 to KEV today with a November 6th due date. It's not AI-specific. Ivanti CVE-2026-118527 is still due November 13th, and Brotli CVE-2026-111497 is due November 10th.

Headline Developments

1. Docker Sandboxes: sbx cp symlink escape lets agents reach host files outside the allowlist HIGH

Source: Endor Labs: Docker Sandboxes vulnerability lets AI agents access sensitive files outside their sandbox (CVE-2026-103916) (November 3rd, Peyton Kennedy). Also NVD: CVE-2026-103916 and CVE.org: CVE-2026-103916.
- What's affected: Docker Sandboxes (sbx CLI) 0.28.0 before 0.51.0. Docker Inc., the CNA, scores it CVSS 4.0 8.4 (HIGH; AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H). NVD has no primary score yet (Awaiting Enrichment). CWE-59.
- Docker Sandboxes runs AI coding agents in a microVM and shares only allowlisted host folders over virtio-fs. sbx cp is a second channel: the CLI process, running as the operator, copies between host and sandbox without consulting the allowlist, and it resolves host-side symlinks.
- A sandbox that can write its workspace can plant a symlink so a later operator-initiated copy reads a host file outside the workspace into the sandbox, or writes sandbox-controlled data to a host path outside the workspace with the operator's permissions. Endor Labs demonstrated both a write that overwrote a canary outside the grant and a read that pulled a host file in. The -L flag only gates the last component of a copy-in source; three of four symlink positions stay open by default.
- Endor Labs notes this is the second sbx cp containment bug in 2026 (CVE-2026-17106 was fixed in v0.38.0 for archive-relative destination escapes). Prompt injection into the agent is a realistic way to plant the symlink; the copy itself is the documented workflow.
- The fix: upgrade to Docker Sandboxes 0.51.0 or later (released November 3rd). Docker's workaround until then: don't use sbx cp with a host-side source or destination inside a workspace writable by untrusted sandbox code; use a host-only path for the copy instead. No exploitation has been reported, and it isn't on KEV. CISA's SSVC marks Exploitation as none.

Why this matters: It's HIGH because the product's security story is the allowlist, and sbx cp quietly breaks it with the operator's own permissions. Cloud credentials, SSH keys and shell startup files sit one routine copy away. Upgrade to 0.51.0, and treat agent-proposed copies into workspace paths as untrusted until you resolve the path yourself.

2. MCPhantom: coding agents install deprecated Anthropic MCP servers from training data, including an unpatched Puppeteer RCE HIGH

Source: Glow Labs: MCPhantom - AI coding agents are installing vulnerable deprecated MCP servers from training data (November 2nd / 3rd). Also Help Net Security: AI coding agents are installing MCP servers that will never be patched (November 3rd).
- Glow Labs reviewed real AI coding session transcripts and found agents installing deprecated local Anthropic reference MCP servers. In 98% of those sessions the agent appears to have filled in the package name from training data when the user asked for a capability such as "a GitHub MCP," instead of the service owner's current server. In 2% the user asked for the old package by name.
- The pattern showed up across Claude Code, Cursor, Codex CLI, Claude Cowork and Claude chat, and across Anthropic, OpenAI and xAI models. The original Anthropic reference repositories are archived and say no security updates or bug fixes will be provided.
- Glow Labs found four high-severity vulnerabilities in those deprecated servers. The most serious is remote code execution in the Puppeteer server: with a prompt injection, an attacker can make the agent start an arbitrary process instead of a browser. Glow Labs reported it; maintainers said the server was archived in May 2025, is unmaintained, and no fix or release will come from that repository. They closed the report as out of scope and said they would look at marking the npm package deprecated (npx still installs deprecated packages).
- Usage hasn't stopped: Glow Labs counted about 17 million npm downloads since July 2025 across the deprecated @modelcontextprotocol reference servers, with five of them in npm's top MCP 100. No CVEs have been assigned for these four bugs, and Glow Labs says it hasn't seen exploitation yet.
- Existing controls stay quiet: the servers often launch via npx with no project manifest, so SCA never sees them, EDR sees a trusted Node install, and inventory never registers an app.

Why this matters: It's HIGH because the install decision comes from the model's memory, not from your approved catalog, and for these packages there is no patch path. Approve one MCP server per service, search developer machines for deprecated @modelcontextprotocol configs, and block or steer agents away from archived reference servers before they install.

3. AWS Serverless MCP Server: project name path traversal in deployment status MEDIUM

Source: AWS Security Bulletin 2026-164-AWS (November 2nd). Also NVD: CVE-2026-116635, GitHub: GHSA-r6mm-377j-qg8m and al-ice.ai analysis (November 3rd).
- CVE-2026-116635 affects awslabs.aws-serverless-mcp-server before 0.2.1. Amazon, the CNA, scores it CVSS 3.1 6.1 (MEDIUM; AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) and CVSS 4.0 6.9 (MEDIUM). CWE-23 / CWE-36.
- The deployment status component built file paths from the project name without keeping them inside the intended directory. An actor who can influence the MCP agent can supply directory traversal sequences or an absolute path and read JSON files outside that directory; where write access has been enabled, the same input can create or overwrite JSON files outside it.
- The fix: upgrade to 0.2.1 (current on PyPI). AWS lists no workarounds and credits Syed Anas Mohiuddin. No exploitation has been reported, and it isn't on KEV.

Why this matters: It's MEDIUM because it needs influence over the agent and often an approval for a routine status check, but the delivery path is the same MCP path bug we keep seeing. Upgrade to 0.2.1, keep write access off unless deployment writes are required, and treat any prompt-injectable path into the project name as the delivery route.

Continuity Footnotes

  • KEV today: CISA added WordPress Core CVE-2026-119977 (TOCTOU race / RCE via predictable staging paths during full-package upgrades; 4.7 through 7.1.3) on November 3rd, due November 6th. Not AI-specific. Catalog version 2026.11.03.
  • KEV deadlines still open: Ivanti Connect Secure CVE-2026-118527 is due November 13th (covered October 28th to November 2nd). Brotli CVE-2026-111497 is due November 10th. Siemens Software Center CVE-2026-110936 is due today, November 3rd (covered October 20th).
  • fickling: 0.1.13 is on PyPI as of November 3rd and includes the CVE-2026-118938 fix (PR #343).
  • Still open from last week: DeepInfer pull request #242, LMDeploy pull request #4964 and Agno issue #8699 are still open.
  • Langflow: IBM's four Langflow CVEs and the public Metasploit MCP module were the November 2nd lead; no material new primary today.

Pattern Analysis

  1. Second paths past the sandbox (November 1st to 3rd): Prefab UI and Beta9 on November 1st, and Docker Sandboxes sbx cp today (Story 1). The isolation primitive can work while a helper command the operator runs still reaches the host.
  2. Training data as a package manager (November 3rd): MCPhantom (Story 2) shows agents reinstalling archived MCP servers because the model remembers the old name. Deprecation notices and registry search gaps don't stop npx.
  3. MCP filename-into-path habits (late October to November 3rd): AWS Serverless MCP deployment status (Story 3) joins earlier AWS MCP sandbox and audience bugs: inputs that look like names become filesystem paths the agent can steer.

Immediate (today):
1. Docker Sandboxes: upgrade sbx to 0.51.0 or later. Until then, don't copy between host and sandbox using paths inside a workspace the agent can write; prefer host-only paths and resolve them yourself first.
2. Deprecated MCP servers: search developer machines and MCP configs for archived @modelcontextprotocol reference servers (GitHub, Postgres, Slack, Puppeteer and the rest of that set) and replace them with the service owner's current server.
3. AWS Serverless MCP: upgrade awslabs.aws-serverless-mcp-server to 0.2.1 or later.
4. KEV deadline: finish Siemens Software Center CVE-2026-110936 today if you still run it.

This week:
5. MCP allowlists: approve one MCP server per service, and add npm deprecation status to the approval check.
6. Agent-proposed copies: require operators to confirm resolved host paths before any sandbox copy-out or copy-in that touches a writable workspace.
7. WordPress KEV: if you run WordPress Core, plan the CVE-2026-119977 fix before November 6th.

Ongoing:
8. Treat training-data package choices as untrusted until an allowlist or registry policy confirms the current package.
9. Gate write access on MCP status and artifact tools unless the workflow truly needs it.

Relevant Risk Summary

Risk Severity Recommended Actions
Docker Sandboxes CVE-2026-103916 (sbx cp symlink escape); Docker CNA CVSS 4.0 8.4 HIGH Upgrade to 0.51.0; avoid workspace-path copies until then
MCPhantom: deprecated Anthropic reference MCP servers (Puppeteer RCE and three other high-sev bugs; no CVEs; no fix) HIGH Find and replace deprecated servers; approve one server per service
AWS Serverless MCP CVE-2026-116635 (Amazon 3.1 6.1 / 4.0 6.9) MEDIUM Upgrade to 0.2.1; disable write access unless required
WordPress Core CVE-2026-119977 (KEV, due Nov 6); Siemens CVE-2026-110936 (KEV, due Nov 3); Ivanti CVE-2026-118527 (KEV, due Nov 13); Brotli CVE-2026-111497 (KEV, due Nov 10) HIGH (KEV) Meet the federal deadlines

Sources

Informational security guidance. Not certification.