Security Monitor 2026-11-06

Informational security guidance for awareness and prioritization. Not certification, legal advice, or a guarantee of protection.

Executive Summary

Today's theme is that agent runtimes and MCP client SDKs still treat server-chosen configuration as trusted local input. AgentScope's agent service accepts MCP stdio command values and spawns them, while a spoofable X-User-ID header skips auth on the same surface; two of the three CVEs from that pack still lack a fixed release. The MCP TypeScript SDK and client follow cross-origin redirects and re-send custom headers plus mcp-session-id (and on 307/308 the body), which can leak OAuth credentials. And the same RFC 8707 resource-indicator gap landed in both mcp-go and ChatCLI: clients accept server-declared Protected Resource Metadata as the resource without matching the configured server, so a hostile metadata document can steal tokens.

CISA's KEV catalog moved to version 2026.11.06 with 1,769 entries. The new add is SonicWall SonicOS SSLVPN CVE-2026-19868 (due November 20th). No AI, LLM, or MCP items joined KEV today. WordPress Core CVE-2026-119977 is due today, November 6th. None of today's lead CVEs are in KEV.

Founder take

The theme today is not the models. It's the plumbing underneath them. Three stories, four MCP tools, one mistake: they let a server or a client pick the configuration, and then they trusted it. AgentScope will run whatever command the workspace names, and it will believe a header that says who you are. The TypeScript SDK will pass your session id, and on some redirects your login secrets, to whatever site a redirect sends it to. And two more clients will let a server decide which service your login token works for, without checking it against the one you set up. None of it needs a prompt injection. It needs software that trusts input it should not trust.

Fix the boundary and most of the risk goes away. Update your MCP software to the fixed versions and make sure nothing quietly rolls it back. Only send logins to the server you set up yourself. And don't run a command or hand over a token just because the other side asked for it; check that it matches what you set up first. For AgentScope, where two of the three CVEs still have no fixed release, keep the agent service on localhost or behind a proxy block until one ships. The agents can keep being clever. The plumbing has to stop being polite.

Headline Developments

1. AgentScope: MCP workspace stdio command spawn plus spoofable X-User-ID HIGH

Source: NVD: CVE-2026-123022 (also CVE-2026-123023, CVE-2026-123024; published November 5th). Also GHSA-m997-8g56-6phf, GHSA-fh34-mp6h-q3xc, GHSA-62xg-m469-57vg; agentscope-ai/agentscope issue #3312; Yongbo Yu researcher advisory; theinjection.dev roundup; PR #3448.
- AgentScope's agent service takes MCP stdio configuration, including a command field, and starts it with subprocess.Popen. That is the same trust boundary as "run whatever the workspace says," and a public exploit is already out. Separately, get_current_user_id trusts a client-supplied X-User-ID header, so callers can spoof identity on the agent service. Separately, the bash tool's check_permissions treated tee as read-only, allowing file writes without user confirmation, up to 2.0.8.
- CVE-2026-123022 covers the MCP workspace command injection via stdio MCP config up to 2.0.11. VulDB (CNA [email protected]) scores it Secondary CVSS 4.0 5.5 MEDIUM and 3.1 7.3 HIGH. NVD status is Deferred. Researcher Yongbo Yu claims CVSS 3.1 9.8; treat that as a researcher claim, not an NVD or CNA score. Mitigation PR #3448 is still open (partial, opt-in allowlist; default behavior unchanged). Issue #3312 is open. Latest release is still v2.0.11 (2026-10-27).
- CVE-2026-123023 covers the Bash tool check_permissions incorrect auth up to 2.0.8. Same VulDB Secondary scores (CVSS 4.0 5.5 MEDIUM / 3.1 7.3 HIGH). Fixed in 2.0.9 (commit 6b43b13).
- CVE-2026-123024 covers missing auth via X-User-ID in get_current_user_id up to 2.0.11. Same VulDB Secondary scores. No fixed release yet. VulDB says a fix pull request awaits acceptance; the X-User-ID issue (#3314) is separate from PR #3448, and an opt-in API-key auth PR (#3329) is still open.
- None of the three are in KEV. Two of three remain unfixed on the latest tagged release.

Why this matters: It's HIGH because an agent service that will spawn MCP stdio commands, and that trusts a spoofable user header, turns workspace config and a single header into remote process execution. Upgrade past 2.0.8 for the bash-tool fix (2.0.9+). Do not treat v2.0.11 as closed for the workspace spawn or X-User-ID gaps until a release ships fixes for both.

2. MCP TypeScript SDK: cross-origin redirect re-sends headers and OAuth body MEDIUM

Source: NVD: CVE-2026-111769 (published November 5th; status Received). Also GitHub Advisory GHSA-6prh-2h8m-c8cw / typescript-sdk security advisory.
- CVE-2026-111769 affects @modelcontextprotocol/sdk before 1.32.0 and @modelcontextprotocol/client 2.0.0 through before 2.3.0. When the client follows a cross-origin redirect, it re-sends custom headers and mcp-session-id. On HTTP 307/308 it also re-sends the body, which can include refresh_token and client_secret. Stdio clients are not in this HTTP redirect path.
- GitHub's CNA scores it Secondary CVSS 3.1 6.5 MEDIUM. Fixed in sdk 1.32.0 and client 2.3.0. It isn't on KEV.

Why this matters: It's MEDIUM because a redirect to an attacker-controlled origin can harvest session and OAuth material without a separate auth bypass. Upgrade the TypeScript SDK to 1.32.0+ and the client package to 2.3.0+; confirm transitive copies in agent frameworks move with them.

3. mcp-go and ChatCLI: MCP OAuth resource-indicator token theft HIGH

Source: NVD: CVE-2026-123272 and NVD: CVE-2026-123271. Also GHSA-xf6j-693p-wqxx (mcp-go) and GHSA-95vg-3r9c-2v5q (ChatCLI); VulnCheck advisories linked from the NVD references.
- Same bug class in two products: the client accepts server-declared Protected Resource Metadata as the RFC 8707 resource without matching it to the configured server. A hostile or swapped metadata document can steer the token to an attacker-chosen resource.
- CVE-2026-123272 covers Mark3labs mcp-go before v1.2.1. VulnCheck scores Secondary CVSS 4.0 5.1 MEDIUM and 3.1 8.0 HIGH. Fixed in v1.2.1. GHSA-xf6j-693p-wqxx. Not in KEV.
- CVE-2026-123271 covers ChatCLI before v1.215.2. VulnCheck scores CVSS 4.0 5.1 MEDIUM (Secondary) and 3.1 8.0 HIGH (Primary). Fixed in v1.215.2. GHSA-95vg-3r9c-2v5q. Not in KEV (ignore tertiary roundups that claim otherwise).

Why this matters: It's HIGH because OAuth resource indicators are supposed to bind a token to the right audience; skipping the configured-server match turns PRM into a token-theft primitive. Upgrade mcp-go to v1.2.1+ and ChatCLI to v1.215.2+.

Continuity Footnotes

KEV today: catalog version 2026.11.06 (1,769 entries; released 2026-11-06T19:44:45.1797Z). New add: SonicWall SonicOS SSLVPN CVE-2026-19868 (due November 20th). No AI, LLM, or MCP items joined KEV today.
KEV deadlines still open: WordPress Core CVE-2026-119977 is due today, November 6th. Adobe Commerce CVE-2026-48356 is due November 10th. Brotli CVE-2026-111497 is due November 10th. Broadcom ESX CVE-2026-41709 is due November 11th. Ivanti CVE-2026-118527 is due November 13th. Apple CVE-2024-27834 is due November 18th. SonicWall CVE-2026-19868 is due November 20th.
Covered November 5th: MCP Inspector CVE-2026-119025, Greeter / Flowise CVE-2024-58351, and OpenHuman CVE-2026-54140. Nothing material new on those today; all three remain off KEV.
Chainlit CVE-2026-120492: latest GitHub release is still 2.12.0; no fixed release yet; still not on KEV.
fickling: 0.1.13 released November 3rd (CVE-2026-118938 fix). The November 1st brief gets a separate addendum today.
Also noted: DeepSeek Harness CVE-2026-82033 (VulnCheck CVSS 4.0 8.6 / 3.1 8.4; fixed 0.1.2-alpha.2; not KEV) exposes an unauthenticated local RPC control plane that can drive the agent's tools. Related MCP Python SDK fixes: CVE-2026-116685 (cross-origin redirects forwarding credential headers), CVE-2026-116684 (bearer token accepted for another resource) and CVE-2026-116686 (outputSchema $ref fetch); all fixed in 1.30.0 / 2.2.0.
Still open from last week: DeepInfer pull request #242, LMDeploy pull request #4964 and Agno issue #8699 are still open.

Pattern Analysis

Agent services that spawn MCP stdio commands run whatever the workspace config names. AgentScope shows that a config command plus a spoofable identity header is enough for process execution as the service's OS user when the service trusts both (Story 1). Treat workspace MCP config as untrusted input.
HTTP clients on MCP OAuth paths still follow redirects too faithfully. The TypeScript SDK re-sending headers and 307/308 bodies is the same class as the Python SDK redirect fixes already shipped (Story 2). Pin MCP client SDKs and refuse cross-origin credential replay.
Protected Resource Metadata is not a free resource indicator. mcp-go and ChatCLI both accepted server-declared PRM without matching the configured server (Story 3). Bind RFC 8707 resource to the operator-configured audience, not to whatever the server advertises.

Recommended Actions

Today:
1. AgentScope: upgrade to at least 2.0.9 for CVE-2026-123023; do not treat 2.0.11 as closed for CVE-2026-123022 / 123024 until a release ships fixes; until then bind the agent service to localhost (127.0.0.1) or block the MCP workspace endpoint at a proxy, and don't trust client X-User-ID as identity.
2. MCP TypeScript: upgrade @modelcontextprotocol/sdk to 1.32.0+ and @modelcontextprotocol/client to 2.3.0+; audit transitive copies in agent frameworks.
3. mcp-go / ChatCLI: upgrade mcp-go to v1.2.1+ and ChatCLI to v1.215.2+.
4. KEV deadline today: finish WordPress Core CVE-2026-119977 if you still run it.

This week:
5. Adobe Commerce / Brotli / Broadcom ESX: plan CVE-2026-48356 and CVE-2026-111497 by November 10th, and Broadcom ESX CVE-2026-41709 by November 11th.
6. Ivanti / Apple / SonicWall: plan Ivanti CVE-2026-118527 by November 13th, Apple CVE-2024-27834 by November 18th, and SonicWall CVE-2026-19868 by November 20th.
7. Chainlit MCP: if you enabled MCP with path-scoped allowed_urls on 2.12.0, keep MCP off or host-scope grants and require auth on /mcp until a patch ships.
8. DeepSeek Harness: if you run it, move to 0.1.2-alpha.2+ for CVE-2026-82033.

Ongoing:
9. Assume MCP stdio command, OAuth redirect targets and server-declared PRM are hostile until proven otherwise.
10. Prefer allowlists and configured-server audience checks over trusting client headers or server metadata on agent control planes.

Relevant Risk Summary

Risk	Severity	Recommended Actions
AgentScope CVE-2026-123022 / 123023 / 123024 (VulDB CVSS 4.0 5.5 / 3.1 7.3; researcher claim 9.8 on 123022)	HIGH	2.0.9+ for 123023; await fixed release for 123022/123024 (#3448 is partial); bind localhost or block the MCP workspace endpoint
MCP TypeScript SDK / client CVE-2026-111769 (GitHub CVSS 3.1 6.5; fixed sdk 1.32.0 / client 2.3.0)	MEDIUM	Upgrade sdk + client; audit transitive copies
mcp-go CVE-2026-123272 (VulnCheck CVSS 4.0 5.1 / 3.1 8.0; fixed v1.2.1); ChatCLI CVE-2026-123271 (VulnCheck CVSS 4.0 5.1 Secondary / 3.1 8.0 Primary; fixed v1.215.2)	HIGH	Upgrade both; bind resource to configured server
WordPress Core CVE-2026-119977 (KEV, due Nov 6); Adobe Commerce CVE-2026-48356 (KEV, due Nov 10); Brotli CVE-2026-111497 (KEV, due Nov 10); Broadcom ESX CVE-2026-41709 (KEV, due Nov 11); Ivanti CVE-2026-118527 (KEV, due Nov 13); Apple CVE-2024-27834 (KEV, due Nov 18); SonicWall CVE-2026-19868 (KEV, due Nov 20)	HIGH (KEV priority)	Meet the federal deadlines