Also available as plain text · markdown source

Security Monitor 2026-11-05

Informational security guidance for awareness and prioritization. Not certification, legal advice, or a guarantee of protection.

Executive Summary

Today's theme is that the tools meant to inspect untrusted MCP servers, and the agent runtimes that call them, still treat server-chosen text as safe. Pillar Security published a full write-up of the Windows and WSL remote code execution chain in the official MCP Inspector, now tracked as CVE-2026-119025 across the open npm package, the Inspector and opencode. Era Security's Greeter campaign is actively abusing unpatched, often unauthenticated Flowise hosts through CVE-2024-58351, hiding host and cloud recon behind repetitive "hello" chat logs. And NVD received CVE-2026-54140 for OpenHuman: MCP tool descriptions flow into the model context without neutralization, so a hostile server can steer the agent on every turn.

CISA's KEV catalog is still version 2026.11.04. WordPress Core CVE-2026-119977 is due tomorrow, November 6th. Brotli CVE-2026-111497 is due November 10th, Ivanti Connect Secure CVE-2026-118527 is due November 13th, and Apple CVE-2024-27834 is due November 18th. No new KEV adds today.

Headline Developments

1. Pillar: the MCP Inspector's OAuth auto-open path runs PowerShell from a remote server HIGH

Source: Pillar Security: Inspecting the Inspector: RCE in MCP's Official Debugging Tool (November 5th). Also GitHub Advisory GHSA-q978-78c7-phqw (October 21st) and VulnCheck: open 7.2.0 before 11.0.0 OS command injection via PowerShell on Windows / NVD: CVE-2026-119025 (October 29th).
- We covered the MCP Inspector advisory pack on October 22nd, including GHSA-q978-78c7-phqw, and noted then that those advisories had no CVE yet. Pillar's November 5th post is the public walkthrough of that same Windows and WSL chain: a remote MCP server answers 401, names an OAuth authorization_endpoint of its choosing, and the client auto-opens that URL through the open package. On Windows and WSL, open before 11.0.0 drops the URL into a PowerShell double-quoted string, so $(...) runs before the browser opens. Auto-open is on by default in an interactive terminal.
- CVE-2026-119025 (VulnCheck CNA) now covers three products in one record: open npm >= 7.2.0, < 11.0.0 (fixed in 11.0.0), @modelcontextprotocol/inspector >= 2.0.0, < 2.12.0 (fixed in 2.12.0), and opencode-ai >= 1.0.137, < 1.18.33 (fixed in 1.18.33). NVD lists VulnCheck scores as Secondary: CVSS 4.0 7.7 HIGH and CVSS 3.1 7.5 HIGH. The Inspector GHSA itself is rated High at CVSS 3.1 8.8 (GitHub). The score gap is the CVSS version and vector difference Pillar calls out, not a second vulnerability.
- The Inspector exists to examine servers you do not trust yet. Amazon documents it for Bedrock AgentCore Gateway testing, Cloudflare recommends it for remote MCP, and Microsoft's Azure DevOps MCP package ships an Inspector launch script. Maintainers accepted the report, shipped 2.12.0 on October 21st, and treated a hostile remote server as in scope. macOS and Linux native openers are not in this PowerShell branch.
- It isn't on KEV. Pillar reports that more than 80% of open's weekly downloads still resolve to an affected version, and a ^10.x range never picks up 11.x without an override.

Why this matters: It's HIGH because the tool you use to vet a hostile MCP server can hand that server a shell on connect, with no model turn and no tool approval. On Windows and WSL, upgrade Inspector to 2.12.0+, opencode to 1.18.33+, and any direct or transitive open to 11.0.0+ with an override so nested copies move too.

2. Greeter: ephemeral Flowise injections hide cloud recon behind "hello" logs HIGH

Source: TechTarget: Greeter exploit framework hides cloud theft on AI servers (November 5th). Also NVD: CVE-2024-58351.
- Era Security is tracking Greeter, a Chinese-language exploit framework aimed at exposed Flowise deployments. The chain uses CVE-2024-58351: before Flowise 2.1.4, callers can supply overrideConfig.javascriptFunction and replace Custom JavaScript Function node code per request. Stored chatflows stay clean; honeypot chat logs showed 4,972 user messages that only said "hello" while the server returned environment profiles, process listings and credentials.
- VulnCheck, the CNA on NVD, scores CVE-2024-58351 CVSS 3.1 9.8 CRITICAL and CVSS 4.0 9.3 CRITICAL (both Secondary). The bug enables RCE and sandbox escape when the default override path and vm2 sandboxing are in play. It isn't on KEV.
- Flowise reached end-of-life on August 31st, 2026 after Workday's acquisition path ended; Workday told TechTarget that enterprise customers were migrated and the remaining users are self-hosted. TechTarget cites Shodan figures of 4,372 internet-visible Flowise instances, 703 with no authentication, and 46 matching the unauthenticated vulnerable shape Era recreated. Era did not claim successful cross-account cloud takeover in its honeypots; it did see IMDS probing consistent with stealing the instance role's existing permissions.
- Sysdig's Crystal Morin, quoted by TechTarget, says application-layer "hello" noise is a distraction and defenders should watch runtime signals (shell spawns, egress to metadata IPs) and block them.

Why this matters: It's HIGH because the audit trail looks like a chatty bot while the host and cloud identity are the real target, and EOL self-hosted forks will not get a vendor push. If you still run Flowise, move off unauthenticated internet exposure, apply the 2.1.4-class fix or equivalent fork patch, and alert on metadata-service egress from those hosts.

3. OpenHuman: MCP tool descriptions enter the model context unsanitized HIGH

Source: GitHub Advisory GHSA-g6j9-89xv-v752 / CVE-2026-54140. Also NVD: CVE-2026-54140 (received November 5th) and ZeroDay Observer: Update OpenHuman to 0.57.13 (November 5th).
- CVE-2026-54140 affects OpenHuman (desktop app and Rust library) before 0.57.13. Names, descriptions, titles and parameter definitions from configured external MCP servers are placed into the agent model context without neutralizing instructions or bounding those fields. Tool-name filters and a prompt-injection detector that screens user messages do not cover MCP definition text, so poisoned descriptions can steer tool use and data disclosure on every turn after list_tools.
- GitHub's CNA scores it CVSS 3.1 8.3 HIGH (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). NVD lists that score as Secondary from [email protected] (NVD status Received as of November 5th). If a roundup says "NVD rates it," that's the GitHub CNA score, not an independent NVD call. Fixed in 0.57.13. It isn't on KEV.
- Exploitation needs an attacker-controlled or compromised MCP server in the user's configuration. That is the same trust boundary the Inspector story assumes will be hostile.

Why this matters: It's HIGH because the malicious text never looks like a user prompt; it rides in the tool catalog the agent reloads every turn. Upgrade OpenHuman to 0.57.13 and keep MCP server allowlists to origins you would trust with the agent's tools.

Continuity Footnotes

  • KEV today: catalog version 2026.11.04 (1,768 entries; released 2026-11-04T20:00:05.774Z). No new adds on November 5th.
  • KEV deadlines still open: WordPress Core CVE-2026-119977 is due November 6th. Brotli CVE-2026-111497 is due November 10th. Ivanti Connect Secure CVE-2026-118527 is due November 13th. Apple CVE-2024-27834 is due November 18th.
  • Covered November 4th: Haiou prompt adware, GTIG LLMJacking / Mixers, and Chainlit CVE-2026-120492. Chainlit's latest GitHub release is still 2.12.0 (no fixed release yet); CVE-2026-120492 remains off KEV. Nothing material new on those today.
  • MCP Inspector: covered October 22nd as a nine-advisory pack with no CVE yet. Today's lead is the CVE assignment (CVE-2026-119025, published October 29th) plus Pillar's November 5th public write-up. An addendum lands on the October 22nd published brief for the CVE.
  • fickling: 0.1.13 remains the current PyPI release and still includes the CVE-2026-118938 fix.
  • Still open from last week: DeepInfer pull request #242, LMDeploy pull request #4964 and Agno issue #8699 are still open.
  • Also noted: SurrealDB MCP identifier statement injection (GHSA-cr79-9p8r-p5wx, fixed in 4.0.0, no CVE in the advisory) and Instatic MCP object-level auth gap CVE-2026-121458 (fixed in 0.0.21; VulnCheck CVSS 4.0 7.1 / 3.1 6.5). Both fit the same "MCP path skipped the HTTP checks" pattern.

Pattern Analysis

  1. Inspection tools inherit the client's trust mistakes. The Inspector's job is to face hostile servers, yet OAuth discovery still handed a server-chosen URL to a shell on Windows (Story 1). Treat every remote MCP OAuth field as untrusted input.
  2. Ephemeral agent overrides beat stored audits. Greeter never rewrites the saved chatflow; defenders who only diff workflow JSON miss the live payload (Story 2). Watch runtime and metadata egress, not just app logs.
  3. Tool catalogs are prompts. OpenHuman shows that MCP descriptions are model context, not inert metadata (Story 3). Sanitize or bound every server-supplied string before it reaches the LLM.

Today:
1. Windows / WSL MCP clients: upgrade MCP Inspector to 2.12.0+, opencode to 1.18.33+, and pin open to 11.0.0+ with an npm override for transitive copies.
2. Flowise: inventory internet-facing instances; disable unauthenticated access; patch to 2.1.4+ or an equivalent forked fix; alert on IMDS and unusual shell spawns from those hosts.
3. OpenHuman: upgrade to 0.57.13; remove MCP servers you would not trust with the agent's tool set.
4. KEV deadline: finish WordPress Core CVE-2026-119977 before November 6th if you still run it.

This week:
5. Chainlit MCP: if you enabled MCP with path-scoped allowed_urls on 2.12.0, keep MCP off or host-scope grants and require auth on /mcp until a patch ships.
6. Brotli / Ivanti / Apple: plan CVE-2026-111497 by November 10th, Ivanti CVE-2026-118527 by November 13th, and Apple CVE-2024-27834 by November 18th.
7. SurrealDB / Instatic: if you expose those MCP surfaces, move to SurrealDB 4.0.0+ and Instatic 0.0.21+.

Ongoing:
8. Assume remote MCP servers are hostile during connect, discovery and list_tools, not only during tool execution.
9. Prefer runtime controls (egress to metadata IPs, unexpected child processes) over chat-log keyword hunts for agent-host compromise.

Relevant Risk Summary

Risk Severity Recommended Actions
MCP Inspector / open / opencode CVE-2026-119025 (VulnCheck CVSS 4.0 7.7 / 3.1 7.5; GHSA CVSS 3.1 8.8) HIGH Inspector 2.12.0+; opencode 1.18.33+; open 11.0.0+ with overrides
Greeter / Flowise CVE-2024-58351 (VulnCheck CVSS 3.1 9.8 / 4.0 9.3; active campaign) HIGH Patch or retire exposed Flowise; block unauth + IMDS egress
OpenHuman CVE-2026-54140 (GitHub CVSS 3.1 8.3; fixed 0.57.13) HIGH Upgrade; restrict MCP server allowlists
WordPress Core CVE-2026-119977 (KEV, due Nov 6); Brotli CVE-2026-111497 (KEV, due Nov 10); Ivanti CVE-2026-118527 (KEV, due Nov 13); Apple CVE-2024-27834 (KEV, due Nov 18) HIGH (KEV priority; Apple CVSS 5.5) Meet the federal deadlines

Sources