# KLM Innovation Security Monitor
**Date:** November 6, 2026

> Informational security guidance for awareness and prioritization. Not certification, legal advice, or a guarantee of protection.

## Executive Summary
Today's theme is that agent runtimes and MCP client SDKs still treat server-chosen configuration as trusted local input. AgentScope's agent service accepts MCP stdio `command` values and spawns them, while a spoofable `X-User-ID` header skips auth on the same surface; two of the three CVEs from that pack still lack a fixed release. The MCP TypeScript SDK and client follow cross-origin redirects and re-send custom headers plus `mcp-session-id` (and on 307/308 the body), which can leak OAuth credentials. And the same RFC 8707 resource-indicator gap landed in both mcp-go and ChatCLI: clients accept server-declared Protected Resource Metadata as the resource without matching the configured server, so a hostile metadata document can steal tokens.

CISA's KEV catalog moved to version 2026.11.06 with 1,769 entries. The new add is SonicWall SonicOS SSLVPN CVE-2026-19868 (due November 20th). No AI, LLM, or MCP items joined KEV today. WordPress Core CVE-2026-119977 is due today, November 6th. None of today's lead CVEs are in KEV.

## Founder take
The theme today is not the models. It's the plumbing underneath them. Three stories, four MCP tools, one mistake: they let a server or a client pick the configuration, and then they trusted it. AgentScope will run whatever command the workspace names, and it will believe a header that says who you are. The TypeScript SDK will pass your session id, and on some redirects your login secrets, to whatever site a redirect sends it to. And two more clients will let a server decide which service your login token works for, without checking it against the one you set up. None of it needs a prompt injection. It needs software that trusts input it should not trust.

Fix the boundary and most of the risk goes away. Update your MCP software to the fixed versions and make sure nothing quietly rolls it back. Only send logins to the server you set up yourself. And don't run a command or hand over a token just because the other side asked for it; check that it matches what you set up first. For AgentScope, where two of the three CVEs still have no fixed release, keep the agent service on localhost or behind a proxy block until one ships. The agents can keep being clever. The plumbing has to stop being polite.

## Headline Developments

### 1. AgentScope: MCP workspace stdio command spawn plus spoofable X-User-ID (HIGH)
**Source:** [NVD: CVE-2026-123022](https://nvd.nist.gov/vuln/detail/CVE-2026-123022) (also [CVE-2026-123023](https://nvd.nist.gov/vuln/detail/CVE-2026-123023), [CVE-2026-123024](https://nvd.nist.gov/vuln/detail/CVE-2026-123024); published November 5th). Also [GHSA-m997-8g56-6phf](https://github.com/advisories/GHSA-m997-8g56-6phf), [GHSA-fh34-mp6h-q3xc](https://github.com/advisories/GHSA-fh34-mp6h-q3xc), [GHSA-62xg-m469-57vg](https://github.com/advisories/GHSA-62xg-m469-57vg); [agentscope-ai/agentscope issue #3312](https://github.com/agentscope-ai/agentscope/issues/3312); [Yongbo Yu researcher advisory](https://github.com/ybyu-ieu/agent-security-advisories/blob/main/agentscope/agentscope-mcp-stdio-workspace-unauthenticated-process-execution.md); [theinjection.dev roundup](https://theinjection.dev/items/agentscope-agent-service-november-cves/); [PR #3448](https://github.com/agentscope-ai/agentscope/pull/3448).
- AgentScope's agent service takes MCP stdio configuration, including a `command` field, and starts it with `subprocess.Popen`. That is the same trust boundary as "run whatever the workspace says," and a public exploit is already out. Separately, `get_current_user_id` trusts a client-supplied `X-User-ID` header, so callers can spoof identity on the agent service. Separately, the bash tool's `check_permissions` treated `tee` as read-only, allowing file writes without user confirmation, up to 2.0.8.
- **CVE-2026-123022** covers the MCP workspace command injection via stdio MCP config up to **2.0.11**. VulDB (CNA `cna@vuldb.com`) scores it Secondary CVSS **4.0 5.5 MEDIUM** and **3.1 7.3 HIGH**. NVD status is Deferred. Researcher Yongbo Yu claims **CVSS 3.1 9.8**; treat that as a researcher claim, not an NVD or CNA score. Mitigation PR **#3448** is still **open** (partial, opt-in allowlist; default behavior unchanged). Issue #3312 is open. Latest release is still **v2.0.11** (2026-10-27).
- **CVE-2026-123023** covers the Bash tool `check_permissions` incorrect auth up to **2.0.8**. Same VulDB Secondary scores (CVSS 4.0 5.5 MEDIUM / 3.1 7.3 HIGH). **Fixed in 2.0.9** (commit 6b43b13).
- **CVE-2026-123024** covers missing auth via `X-User-ID` in `get_current_user_id` up to **2.0.11**. Same VulDB Secondary scores. No fixed release yet. VulDB says a fix pull request awaits acceptance; the X-User-ID issue (#3314) is separate from PR #3448, and an opt-in API-key auth PR (#3329) is still open.
- None of the three are in KEV. Two of three remain unfixed on the latest tagged release.

**Why this matters:** It's HIGH because an agent service that will spawn MCP stdio commands, and that trusts a spoofable user header, turns workspace config and a single header into remote process execution. Upgrade past 2.0.8 for the bash-tool fix (2.0.9+). Do not treat v2.0.11 as closed for the workspace spawn or X-User-ID gaps until a release ships fixes for both.

### 2. MCP TypeScript SDK: cross-origin redirect re-sends headers and OAuth body (MEDIUM)
**Source:** [NVD: CVE-2026-111769](https://nvd.nist.gov/vuln/detail/CVE-2026-111769) (published November 5th; status Received). Also [GitHub Advisory GHSA-6prh-2h8m-c8cw](https://github.com/advisories/GHSA-6prh-2h8m-c8cw) / [typescript-sdk security advisory](https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6prh-2h8m-c8cw).
- **CVE-2026-111769** affects `@modelcontextprotocol/sdk` before **1.32.0** and `@modelcontextprotocol/client` **2.0.0 through before 2.3.0**. When the client follows a cross-origin redirect, it re-sends custom headers and `mcp-session-id`. On HTTP 307/308 it also re-sends the body, which can include `refresh_token` and `client_secret`. Stdio clients are not in this HTTP redirect path.
- GitHub's CNA scores it Secondary CVSS **3.1 6.5 MEDIUM**. Fixed in sdk **1.32.0** and client **2.3.0**. It isn't on KEV.

**Why this matters:** It's MEDIUM because a redirect to an attacker-controlled origin can harvest session and OAuth material without a separate auth bypass. Upgrade the TypeScript SDK to 1.32.0+ and the client package to 2.3.0+; confirm transitive copies in agent frameworks move with them.

### 3. mcp-go and ChatCLI: MCP OAuth resource-indicator token theft (HIGH)
**Source:** [NVD: CVE-2026-123272](https://nvd.nist.gov/vuln/detail/CVE-2026-123272) and [NVD: CVE-2026-123271](https://nvd.nist.gov/vuln/detail/CVE-2026-123271). Also [GHSA-xf6j-693p-wqxx](https://github.com/mark3labs/mcp-go/security/advisories/GHSA-xf6j-693p-wqxx) (mcp-go) and [GHSA-95vg-3r9c-2v5q](https://github.com/diillson/chatcli/security/advisories/GHSA-95vg-3r9c-2v5q) (ChatCLI); VulnCheck advisories linked from the NVD references.
- Same bug class in two products: the client accepts server-declared Protected Resource Metadata as the RFC 8707 `resource` without matching it to the configured server. A hostile or swapped metadata document can steer the token to an attacker-chosen resource.
- **CVE-2026-123272** covers Mark3labs mcp-go before **v1.2.1**. VulnCheck scores Secondary CVSS **4.0 5.1 MEDIUM** and **3.1 8.0 HIGH**. Fixed in **v1.2.1**. GHSA-xf6j-693p-wqxx. Not in KEV.
- **CVE-2026-123271** covers ChatCLI before **v1.215.2**. VulnCheck scores CVSS **4.0 5.1 MEDIUM** (Secondary) and **3.1 8.0 HIGH** (Primary). Fixed in **v1.215.2**. GHSA-95vg-3r9c-2v5q. Not in KEV (ignore tertiary roundups that claim otherwise).

**Why this matters:** It's HIGH because OAuth resource indicators are supposed to bind a token to the right audience; skipping the configured-server match turns PRM into a token-theft primitive. Upgrade mcp-go to v1.2.1+ and ChatCLI to v1.215.2+.

## Continuity Footnotes
- **KEV today:** catalog version **2026.11.06** (1,769 entries; released 2026-11-06T19:44:45.1797Z). New add: SonicWall SonicOS SSLVPN **CVE-2026-19868** (due November 20th). No AI, LLM, or MCP items joined KEV today.
- **KEV deadlines still open:** WordPress Core CVE-2026-119977 is due **today, November 6th**. Adobe Commerce CVE-2026-48356 is due November 10th. Brotli CVE-2026-111497 is due November 10th. Broadcom ESX CVE-2026-41709 is due November 11th. Ivanti CVE-2026-118527 is due November 13th. Apple CVE-2024-27834 is due November 18th. SonicWall CVE-2026-19868 is due November 20th.
- **Covered November 5th:** MCP Inspector CVE-2026-119025, Greeter / Flowise CVE-2024-58351, and OpenHuman CVE-2026-54140. Nothing material new on those today; all three remain off KEV.
- **Chainlit CVE-2026-120492:** latest GitHub release is still 2.12.0; no fixed release yet; still not on KEV.
- **fickling:** 0.1.13 released November 3rd (CVE-2026-118938 fix). The November 1st brief gets a separate addendum today.
- **Also noted:** DeepSeek Harness CVE-2026-82033 (VulnCheck CVSS 4.0 8.6 / 3.1 8.4; fixed 0.1.2-alpha.2; not KEV) exposes an unauthenticated local RPC control plane that can drive the agent's tools. Related MCP Python SDK fixes: CVE-2026-116685 (cross-origin redirects forwarding credential headers), CVE-2026-116684 (bearer token accepted for another resource) and CVE-2026-116686 (outputSchema `$ref` fetch); all fixed in 1.30.0 / 2.2.0.
- **Still open from last week:** DeepInfer pull request #242, LMDeploy pull request #4964 and Agno issue #8699 are still open.

## Pattern Analysis
1. **Agent services that spawn MCP stdio commands run whatever the workspace config names.** AgentScope shows that a config `command` plus a spoofable identity header is enough for process execution as the service's OS user when the service trusts both (Story 1). Treat workspace MCP config as untrusted input.
2. **HTTP clients on MCP OAuth paths still follow redirects too faithfully.** The TypeScript SDK re-sending headers and 307/308 bodies is the same class as the Python SDK redirect fixes already shipped (Story 2). Pin MCP client SDKs and refuse cross-origin credential replay.
3. **Protected Resource Metadata is not a free resource indicator.** mcp-go and ChatCLI both accepted server-declared PRM without matching the configured server (Story 3). Bind RFC 8707 `resource` to the operator-configured audience, not to whatever the server advertises.

## Recommended Actions

**Today:**
1. **AgentScope:** upgrade to at least 2.0.9 for CVE-2026-123023; do not treat 2.0.11 as closed for CVE-2026-123022 / 123024 until a release ships fixes; until then bind the agent service to localhost (127.0.0.1) or block the MCP workspace endpoint at a proxy, and don't trust client `X-User-ID` as identity.
2. **MCP TypeScript:** upgrade `@modelcontextprotocol/sdk` to 1.32.0+ and `@modelcontextprotocol/client` to 2.3.0+; audit transitive copies in agent frameworks.
3. **mcp-go / ChatCLI:** upgrade mcp-go to v1.2.1+ and ChatCLI to v1.215.2+.
4. **KEV deadline today:** finish WordPress Core CVE-2026-119977 if you still run it.

**This week:**
5. **Adobe Commerce / Brotli / Broadcom ESX:** plan CVE-2026-48356 and CVE-2026-111497 by November 10th, and Broadcom ESX CVE-2026-41709 by November 11th.
6. **Ivanti / Apple / SonicWall:** plan Ivanti CVE-2026-118527 by November 13th, Apple CVE-2024-27834 by November 18th, and SonicWall CVE-2026-19868 by November 20th.
7. **Chainlit MCP:** if you enabled MCP with path-scoped `allowed_urls` on 2.12.0, keep MCP off or host-scope grants and require auth on `/mcp` until a patch ships.
8. **DeepSeek Harness:** if you run it, move to 0.1.2-alpha.2+ for CVE-2026-82033.

**Ongoing:**
9. Assume MCP stdio `command`, OAuth redirect targets and server-declared PRM are hostile until proven otherwise.
10. Prefer allowlists and configured-server audience checks over trusting client headers or server metadata on agent control planes.

## Relevant Risk Summary
| Risk | Severity | Recommended Actions |
|---|---|---|
| AgentScope CVE-2026-123022 / 123023 / 123024 (VulDB CVSS 4.0 5.5 / 3.1 7.3; researcher claim 9.8 on 123022) | HIGH | 2.0.9+ for 123023; await fixed release for 123022/123024 (#3448 is partial); bind localhost or block the MCP workspace endpoint |
| MCP TypeScript SDK / client CVE-2026-111769 (GitHub CVSS 3.1 6.5; fixed sdk 1.32.0 / client 2.3.0) | MEDIUM | Upgrade sdk + client; audit transitive copies |
| mcp-go CVE-2026-123272 (VulnCheck CVSS 4.0 5.1 / 3.1 8.0; fixed v1.2.1); ChatCLI CVE-2026-123271 (VulnCheck CVSS 4.0 5.1 Secondary / 3.1 8.0 Primary; fixed v1.215.2) | HIGH | Upgrade both; bind resource to configured server |
| WordPress Core CVE-2026-119977 (KEV, due Nov 6); Adobe Commerce CVE-2026-48356 (KEV, due Nov 10); Brotli CVE-2026-111497 (KEV, due Nov 10); Broadcom ESX CVE-2026-41709 (KEV, due Nov 11); Ivanti CVE-2026-118527 (KEV, due Nov 13); Apple CVE-2024-27834 (KEV, due Nov 18); SonicWall CVE-2026-19868 (KEV, due Nov 20) | HIGH (KEV priority) | Meet the federal deadlines |

## Sources
- [NVD: CVE-2026-123022](https://nvd.nist.gov/vuln/detail/CVE-2026-123022)
- [NVD: CVE-2026-123023](https://nvd.nist.gov/vuln/detail/CVE-2026-123023)
- [NVD: CVE-2026-123024](https://nvd.nist.gov/vuln/detail/CVE-2026-123024)
- [GHSA-m997-8g56-6phf](https://github.com/advisories/GHSA-m997-8g56-6phf)
- [GHSA-fh34-mp6h-q3xc](https://github.com/advisories/GHSA-fh34-mp6h-q3xc)
- [GHSA-62xg-m469-57vg](https://github.com/advisories/GHSA-62xg-m469-57vg)
- [agentscope-ai/agentscope issue #3312](https://github.com/agentscope-ai/agentscope/issues/3312)
- [Yongbo Yu: AgentScope MCP stdio workspace unauthenticated process execution](https://github.com/ybyu-ieu/agent-security-advisories/blob/main/agentscope/agentscope-mcp-stdio-workspace-unauthenticated-process-execution.md)
- [theinjection.dev: AgentScope agent service November CVEs](https://theinjection.dev/items/agentscope-agent-service-november-cves/)
- [agentscope-ai/agentscope PR #3448](https://github.com/agentscope-ai/agentscope/pull/3448)
- [NVD: CVE-2026-111769](https://nvd.nist.gov/vuln/detail/CVE-2026-111769)
- [GitHub Advisory GHSA-6prh-2h8m-c8cw](https://github.com/advisories/GHSA-6prh-2h8m-c8cw)
- [typescript-sdk security advisory GHSA-6prh-2h8m-c8cw](https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6prh-2h8m-c8cw)
- [NVD: CVE-2026-123272](https://nvd.nist.gov/vuln/detail/CVE-2026-123272)
- [NVD: CVE-2026-123271](https://nvd.nist.gov/vuln/detail/CVE-2026-123271)
- [GHSA-xf6j-693p-wqxx (mcp-go)](https://github.com/mark3labs/mcp-go/security/advisories/GHSA-xf6j-693p-wqxx)
- [GHSA-95vg-3r9c-2v5q (ChatCLI)](https://github.com/diillson/chatcli/security/advisories/GHSA-95vg-3r9c-2v5q)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)