VulnWatch VulnWatch
← All articles
Weekly digest · Sep 21, 2026

VulnWatch Weekly: MCP Servers Under Siege, LLM RCE via Pickle

This week's digest highlights a critical wave of vulnerabilities in Model Context Protocol (MCP) servers, featuring unauthenticated RCEs, SSRF chains, and token theft. We also cover severe pickle deserialization flaws in LLM serving stacks like LMDeploy and vLLM.

Prompt Injection Remote Code Execution Auth Bypass SSRF API Abuse Agentic / MCP

Week in Review: The MCP Supply Chain Crisis and the Return of Pickle

The week of September 14–20, 2026, will be remembered as a turning point for the security of the agentic web. The dominant theme is unequivocally the fragility of the Model Context Protocol (MCP) ecosystem. We observed a cascade of critical vulnerabilities across dozens of MCP servers, gateways, and SDKs, ranging from unauthenticated remote code execution (RCE) to severe server-side request forgery (SSRF) and credential exfiltration. The single most urgent item for all CISOs and platform teams is the immediate patching of MCP Context Forge (CVE-2026-53710) and LMDeploy (CVE-2025-66455 / CVE-2025-59953), as these flaws allow trivial, unauthenticated takeover of AI gateways and inference clusters. The narrative of the week is clear: the rush to connect agents to tools has outpaced the implementation of basic transport security, leaving the "agentic supply chain" wide open to exploitation.

Top Items of the Week

The following entries represent the highest-impact vulnerabilities discovered this week. Immediate action is required for all items marked Critical.

  1. CVE-2026-53710 (Critical, CVSS 10.0): MCP Context Forge contains a flaw in python_sandbox_server where raw getattr exposure allows attackers to traverse the Python class hierarchy, reach subprocess.Popen, and execute OS commands. This affects the core gateway logic for MCP, A2A, REST, and gRPC. View Details
  2. CVE-2026-59971 (Critical, CVSS 10.0): MySQL MCP Server defaults to binding on 0.0.0.0 without authentication when using SSE transport. Attackers can execute arbitrary SQL queries or use DNS rebinding to pivot from a victim's browser to the local database. View Details
  3. CVE-2025-66455 / GHSA-2vh9-42vm-xmv2 (Critical, CVSS 9.8): LMDeploy suffers from remote code execution via insecure Pickle deserialization in its PyTorch DistServe control plane. An attacker can force the server to connect to a malicious ZeroMQ endpoint and deserialize arbitrary code. View Details | GitHub Advisory
  4. CVE-2026-61560 / GHSA-cv3r-c5h8-f4g5 (Critical, CVSS 9.8): @zereight/mcp-gitlab exposes all tools without authentication in SSE mode. The upload_markdown tool allows arbitrary file reads (e.g., /proc/self/environ), leading to GitLab PAT theft and full account takeover. View Details | GitHub Advisory
  5. CVE-2026-85885 (Critical, CVSS 9.9): M365 Copilot contains a command injection vulnerability allowing authorized attackers to elevate privileges over the network. View Details
  6. CVE-2026-12944 (Critical, CVSS 9.6): IBM Langflow OSS allows attackers to execute arbitrary Python code with root privileges by submitting components with socket/urllib imports, bypassing the validator and enabling AWS credential theft via SSRF. View Details
  7. CVE-2026-54618 (Critical, CVSS 9.4): Obsidian Web MCP issues authorization codes without login or consent checks, allowing unauthenticated remote callers to read, write, and delete entire Obsidian vaults. View Details
  8. CVE-2026-33625 (High, CVSS 8.8): LMDeploy (again) contains a code injection flaw where quant_dtype in model configs is passed to eval(), allowing RCE via malicious HuggingFace models. View Details
  9. CVE-2026-58197 / GHSA-qg2g-g9w3-m5h8 (High, CVSS 8.8): ToolHive fails to isolate containerized MCP servers, allowing them to reach host.docker.internal and perform lateral movement to the host or other services. View Details | GitHub Advisory
  10. CVE-2026-93993 (High, CVSS 8.6): Mistral Vibe executes git hooks before trust validation during worktree creation, leading to RCE via crafted repositories. View Details

The MCP Meltdown: Agentic Supply Chain Compromise

The most alarming trend this week is the systemic failure of security controls in Model Context Protocol (MCP) implementations. The promise of MCP is to standardize how AI agents interact with external tools, but this week's disclosures reveal that many implementations treat "connectivity" as synonymous with "trust."

The @zereight/mcp-gitlab server (CVE-2026-61560, CVE-2026-61559, CVE-2026-61568) exemplifies this crisis. Multiple flaws allow unauthenticated attackers to read arbitrary files, perform DNS rebinding attacks against local listeners, and hijack API URLs via headers. The combination of an unauthenticated SSE transport and a file-read tool (upload_markdown) creates a trivial path to stealing GITLAB_PERSONAL_ACCESS_TOKEN from environment variables. Similarly, MySQL MCP Server (CVE-2026-59971) binds to all interfaces by default without auth, effectively exposing database engines to the public internet whenever an agent is spun up.

We also saw critical issues in Obsidian Web MCP (CVE-2026-54618), where the OAuth flow was completely broken, issuing tokens without user consent. This allows an attacker to fully compromise a user's knowledge base remotely. MCPVault (CVE-2026-57441, CVE-2026-57442) failed to properly restrict path traversal on case-insensitive filesystems, allowing agents to read .git directories and other sensitive metadata despite allow-lists.

The root cause across these entries is a lack of defense-in-depth at the transport layer. Many servers assume that because they are "local" or "internal," they do not need authentication or strict input validation. In an agentic world where browsers and LLMs can initiate requests, this assumption is fatal.

Model Serving & Inference: The Return of Pickle and Eval

While MCP struggles with transport security, the underlying inference stacks are grappling with legacy Python pitfalls. LMDeploy had a particularly rough week, with two distinct critical RCE vectors. The first (CVE-2025-66455) involves recv_pyobj() over ZeroMQ, which uses Python's pickle module. As security engineers know, unpickling data from an untrusted source is equivalent to executing arbitrary code. An attacker can simply point the LMDeploy control plane to a malicious ZeroMQ socket to gain execution.

The second LMDeploy flaw (CVE-2026-33625) is equally egregious: the use of eval() on quant_dtype strings loaded from HuggingFace model configurations. This turns the model registry into an execution vector; any user loading a malicious model from a public registry inadvertently executes the attacker's code. IBM Langflow OSS (CVE-2026-12944) suffered a similar fate, where its component validator failed to catch socket or urllib imports, allowing attackers to deploy components that exfiltrate AWS credentials via SSRF or execute code with root privileges.

vLLM also faced significant stability and security challenges. Multiple vulnerabilities (CVE-2026-93592, CVE-2026-93436, CVE-2026-93838) allow unauthenticated attackers to crash inference engines via negative token IDs, unbounded memory allocation in disaggregated modes, or metadata exhaustion. While some of these present primarily as Denial of Service (DoS), the ability to corrupt GPU context or trigger out-of-memory conditions in shared multi-tenant environments poses a severe availability risk.

Data Leakage and Path Traversal in Agent Tools

Beyond RCE, a significant number of vulnerabilities focused on data exfiltration through path traversal and improper file handling. PraisonAI (CVE-2026-57145, CVE-2026-57130) allowed LLM-controlled agents to read arbitrary files and inject IMAP commands, bypassing workspace boundaries. Flowise (CVE-2026-91932, CVE-2026-91935) failed to validate cwd parameters and base URLs, allowing authenticated users to escape sandboxes and redirect LLM traffic to internal metadata services to steal API keys.

SQLBot (CVE-2026-53557, CVE-2026-53554, CVE-2026-53556) demonstrated the dangers of dynamic SQL generation in AI systems. Flaws in its Excel parsing and datasource configuration allowed for second-order SQL injection, enabling attackers to execute OS commands via COPY TO PROGRAM or read arbitrary files via pg_read_file. These incidents underscore that AI applications handling user-uploaded content or dynamic configurations must treat all inputs as hostile, regardless of whether they originate from a human or an agent.

Known Exploited and Active Threats

Fortunately, as of this writing, no entries from this week's digest have been flagged as is_exploited=true. However, the simplicity of the exploits—particularly the unauthenticated endpoints in MySQL MCP Server and the pickle deserialization in LMDeploy—suggests that weaponization is imminent. The "low hanging fruit" nature of these bugs means that automated scanners and opportunistic attackers will likely begin probing for these specific versions within days.

What to Do This Week

  1. Patch MCP Servers Immediately: If you are running any MCP servers (GitLab, MySQL, Obsidian, Context Forge), apply patches immediately. If patches are unavailable, disable external network access to these services and enforce strict authentication at the proxy level.
  2. Audit LMDeploy and Langflow Deployments: Check your inference stacks for usage of pickle deserialization or eval() on model configurations. Upgrade LMDeploy to v0.16.0+ and Langflow to the latest patched version. Consider blocking outbound traffic from model loading processes to prevent SSRF.
  3. Network Segmentation: Isolate agent runtimes and MCP servers in dedicated network segments. Prevent them from accessing host.docker.internal, cloud metadata endpoints (169.254.169.254), and internal databases unless explicitly required and proxied.
  4. Validate Model Sources: Restrict model loading to trusted, private registries. Do not allow agents or users to load models directly from public HuggingFace repositories without a rigorous scanning pipeline that checks for malicious config parameters.
  5. Review OAuth Flows: For any AI tool integrating with SaaS platforms (GitLab, Obsidian, Microsoft 365), manually verify that OAuth flows require explicit user consent and that tokens are not issued to unauthenticated redirect URIs.

What to Watch Next Week

Next week, we anticipate a surge in advisories related to RAG (Retrieval-Augmented Generation) poisoning. As organizations rush to secure their agents, attackers will likely shift focus to the data layer, attempting to inject malicious contexts into vector databases (like the Chroma issues seen this week) to manipulate agent behavior. Additionally, expect deeper analysis of cross-tenant isolation in multi-tenant LLM serving platforms, as the vLLM and SGLang vulnerabilities hint at significant risks in shared GPU environments. Keep a close eye on the RMCP (Rust MCP) ecosystem as well; while Rust offers memory safety, the logic errors in session management and header forwarding seen this week prove that type safety does not equal security.

Covered entries (120)