VulnWatch VulnWatch
← All articles
Weekly digest · Sep 28, 2026

VulnWatch Weekly: The MCP Authentication Crisis & Decepticon's Role Forgery

This week's digest highlights a catastrophic wave of authentication bypasses in Model Context Protocol (MCP) servers, led by critical flaws in mcp-atlassian. We also analyze 'Decepticon,' a new prompt injection vector enabling role-boundary forgery via ChatML literals.

Prompt Injection Supply Chain Remote Code Execution Auth Bypass SSRF Agentic / MCP

Week in Review: The MCP Authentication Crisis & Decepticon's Role Forgery

Week of September 21–27, 2026

The dominant theme of this week is the systemic collapse of authentication boundaries within the burgeoning Model Context Protocol (MCP) ecosystem. A staggering cluster of critical vulnerabilities, primarily affecting mcp-atlassian and related agent orchestration platforms, reveals a pattern where network-exposed MCP servers default to trusting unauthenticated requests or falling back to overly privileged operator credentials. Simultaneously, the emergence of "Decepticon" introduces a sophisticated prompt injection technique that exploits ChatML special-token literals to forge role boundaries in autonomous agents. While no known active exploitation (is_exploited=true) has been confirmed for these specific CVEs yet, the sheer volume of CVSS 10.0 ratings and the ease of remote exploitation in default configurations demand immediate remediation. The single most urgent item is the suite of authentication bypasses in mcp-atlassian (CVE-2026-77244, CVE-2026-77254), which allows unauthenticated network actors to execute arbitrary tools using high-privilege Atlassian credentials.

Top Items of the Week

The following entries represent the highest-impact vulnerabilities identified this week, ranked by severity and potential for widespread compromise.

  1. CVE-2026-61732 / GHSA-g5f9-3xfg-p9mf: Decepticon Role-Boundary Forgery

    • Severity: Critical (CVSS 10.0)
    • Affected Component: Decepticon (Autonomous Hacking Agent), vLLM, SGLang, Ollama, LM Studio
    • Impact: Attackers can inject ChatML special-token literals into web crawl outputs, causing the LLM to misinterpret user content as system instructions. This enables role-boundary forgery, potentially leading to Remote Code Execution (RCE) or severe data leakage in BYOK (Bring Your Own Key) deployments.
    • Recommended Action: Upgrade Decepticon to v1.1.17+. Implement strict input sanitization to neutralize ChatML special tokens (e.g., <|im_start|>, <|im_end|>) in all user-generated or external content before it enters the LLM context window. Configure model providers to reject or escape special token literals in user messages.
    • Source: GitHub Advisory | NVD

  2. CVE-2026-77244 / CVE-2026-77254: MCP Atlassian Authentication Bypass

    • Severity: Critical (CVSS 10.0 / 9.1)
    • Affected Component: mcp-atlassian (MCP Server) < v0.22.0
    • Impact: The HTTP transport mechanism accepts requests without verified user identities, falling back to globally configured operator credentials. This allows any network-reachable attacker to invoke Atlassian tools (read/write/delete) with full administrative privileges.
    • Recommended Action: Immediately upgrade to mcp-atlassian v0.22.0. If upgrading is not immediately possible, restrict network access to the MCP server endpoint to trusted IPs only and disable the HTTP transport mode in favor of local stdio transport where feasible.
    • Source: NVD CVE-2026-77244 | NVD CVE-2026-77254

  3. CVE-2026-93088: SGLang Unauthenticated RCE via Pickle Deserialization

    • Severity: Critical (CVSS 9.8)
    • Affected Component: SGLang Multimodal Generation Runtime
    • Impact: The disaggregated-diffusion orchestrator binds an unauthenticated ZeroMQ socket to a network interface and passes received data directly to pickle.loads(). This allows unauthenticated remote attackers to execute arbitrary code on the host.
    • Recommended Action: Upgrade SGLang immediately. Ensure ZeroMQ sockets are bound only to localhost or protected by firewall rules. Never expose ZeroMQ ports to untrusted networks.
    • Source: NVD

  4. CVE-2026-101065: Obot Default Authentication Disabled

    • Severity: Critical (CVSS 9.3)
    • Affected Component: Obot (AI Agent/MCP Platform) <= commit d7e6970
    • Impact: The Docker quickstart command exposes the API on 0.0.0.0:8080 with authentication disabled by default. Unauthenticated users gain full Owner/Admin access, allowing them to register malicious MCP servers.
    • Recommended Action: Do not use the default quickstart command in production. Explicitly enable authentication flags and bind services to localhost or internal interfaces only. Upgrade to the latest patched version.
    • Source: NVD

  5. CVE-2026-61742: DBHub DNS Rebinding & Unauthenticated Access

    • Severity: Critical (CVSS 9.3)
    • Affected Component: DBHub (Database MCP Server) < v0.22.5
    • Impact: The HTTP MCP endpoint is unauthenticated and vulnerable to DNS rebinding. Attackers can trick a victim's browser into sending requests to the DBHub server, executing arbitrary SQL commands against connected databases.
    • Recommended Action: Upgrade to v0.22.5+. Implement strict CORS policies and validate the Host header against a whitelist. Avoid exposing DBHub HTTP endpoints to the public internet.
    • Source: NVD

  6. CVE-2026-77262 / GHSA-p6hp-93wp-fh6p: MCP Atlassian Arbitrary File Read

    • Severity: High (CVSS 8.6)
    • Affected Component: mcp-atlassian < v0.22.0
    • Impact: The confluence_upload_attachment tool accepts arbitrary file paths without validation. Combined with the auth bypass, attackers can read sensitive server files (e.g., /etc/passwd, .env) and exfiltrate them via Confluence attachments.
    • Recommended Action: Upgrade to v0.22.0. Audit MCP tool definitions to ensure path validation is enforced on all file system interactions.
    • Source: NVD | GitHub Advisory

  7. CVE-2026-96775 / CVE-2026-96804: MLflow Pickle Deserialization Bypass

    • Severity: High (CVSS 8.8)
    • Affected Component: MLflow (dspy and statsmodel flavors)
    • Impact: Security controls preventing pickle deserialization are bypassed if the model artifact does not end in .pkl (dspy) or omitted entirely (statsmodel). Remote attackers can execute code via crafted model artifacts.
    • Recommended Action: Upgrade MLflow. Enforce strict file extension validation for model artifacts and disable pickle deserialization globally unless absolutely necessary.
    • Source: NVD CVE-2026-96775 | NVD CVE-2026-96804

  8. CVE-2026-89032: LiteLLM Tenant Isolation Bypass

    • Severity: High (CVSS 8.7)
    • Affected Component: BerriAI LiteLLM < v1.101.0-rc.1
    • Impact: A metadata key mismatch in the semantic cache layer allows authenticated users to read cached responses from other tenants, leading to PII and source code leakage.
    • Recommended Action: Upgrade to LiteLLM v1.101.0-rc.1 or later. Review semantic cache configurations for multi-tenant deployments.
    • Source: NVD

Thematic Analysis: The MCP Supply Chain Collapse

This week's data reveals a disturbing trend: the Model Context Protocol (MCP), designed to standardize agent-tool interactions, has become a primary attack surface due to inconsistent authentication implementations. The mcp-atlassian server alone accounts for over a dozen critical and high-severity entries. The root cause is a fundamental design flaw in the HTTP transport mode, where the server assumes a trusted network environment and fails to enforce identity verification on incoming JSON-RPC requests. Instead, it defaults to using globally configured operator credentials (JIRA_API_TOKEN, etc.).

This "trusted network" assumption is fatal in modern cloud environments where network segmentation is often porous. Vulnerabilities like CVE-2026-77243 (Toolset authorization bypass) and CVE-2026-77248 (Unauthenticated file read) demonstrate that once an attacker bypasses the non-existent authentication layer, they inherit the full power of the connected SaaS platform. The impact is compounded by tools like upload_attachment which lack path traversal protections, turning these MCP servers into efficient data exfiltration pipelines. Security teams must treat MCP servers as high-value targets, applying the same zero-trust principles used for traditional APIs: enforce mutual TLS, require explicit bearer tokens for every request, and never bind these services to public interfaces without a robust WAF or API Gateway in front.

Thematic Analysis: Prompt Injection & Role Forgery

While MCP servers crumble under authentication issues, the application layer faces a more subtle but equally dangerous threat: Decepticon (CVE-2026-61732). Unlike traditional prompt injection which relies on confusing the LLM with natural language instructions, Decepticon exploits the structural parsing of ChatML formats. By injecting special-token literals (e.g., <|im_start|>system<|im_end|>) into web crawl results, attackers can prematurely close the "user" role and open a new "system" role within the context window.

This is particularly devastating for autonomous agents like Decepticon itself, which operate in a "Bring Your Own Key" (BYOK) model using open-source backends (vLLM, Ollama) that often do not sanitize user input for these tokens by default. The result is not just a jailbreak, but a complete hijacking of the agent's operational logic, allowing attackers to redefine the agent's goals or force it to execute arbitrary commands. This highlights a critical gap in the ML supply chain: inference engines must treat special tokens as reserved characters that cannot appear in user data, similar to how SQL engines handle quotes.

Thematic Analysis: Inference Engine Stability & DoS

A significant cluster of vulnerabilities affects vLLM and SGLang, focusing on Denial of Service (DoS) and resource exhaustion. Issues like CVE-2026-94626 (unbounded tp_size allocation) and CVE-2026-100647 (massive cache_salt values) allow attackers to crash inference engines by triggering out-of-memory conditions or stalling the scheduler thread. These vulnerabilities stem from a lack of input validation on parameters intended for internal cluster coordination. In disaggregated serving architectures, where prefill and decode stages are separated, these parameters are often exposed via API endpoints without sufficient sanity checks. For platform teams running high-throughput LLM services, this necessitates strict rate limiting and schema validation on all incoming completion requests, particularly for parameters controlling memory allocation and token processing.

Thematic Analysis: Data Leakage & SSRF in AI Agents

Beyond the major MCP and injection headlines, several vulnerabilities facilitate data leakage and Server-Side Request Forgery (SSRF). CVE-2026-89032 in LiteLLM exposes a tenant isolation flaw in the semantic cache, allowing cross-tenant data access. Meanwhile, CVE-2026-77274 in mcp-atlassian and CVE-2026-61612 in CKAN MCP Server highlight persistent SSRF risks via DNS rebinding. These attacks exploit the time-of-check to time-of-use (TOCTOU) race condition in DNS resolution, allowing attackers to bypass hostname allowlists. The prevalence of these issues in AI agents suggests that developers are frequently re-implementing HTTP clients without adopting robust, battle-tested SSRF protection libraries, or are misconfiguring existing ones.

What to Do This Week

  1. Patch MCP Servers Immediately: If you are running mcp-atlassian, DBHub, Obot, or any MCP server exposed over HTTP, apply patches immediately. If patches are unavailable, isolate these services behind a firewall or switch to stdio transport.
  2. Sanitize ChatML Inputs: For teams running self-hosted LLMs (vLLM, Ollama, SGLang), implement middleware that strips or escapes ChatML special tokens from all user-generated and external data sources before they reach the model context.
  3. Audit Tool Definitions: Review your agent's tool definitions. Ensure that any tool accepting file paths implements strict allow-listing or sandboxing. Disable unused tools, especially those with write or upload capabilities.
  4. Enforce Authentication: Verify that all AI platform endpoints (Obot, LiteLLM, MLflow) have authentication explicitly enabled. Do not rely on "default" secure configurations; assume defaults are insecure.
  5. Validate Inference Parameters: Implement strict schema validation on your inference API gateways to reject requests with out-of-bounds parameters (e.g., excessive tp_size, massive cache_salt).

What to Watch Next Week

Next week, we anticipate further disclosures related to the Model Context Protocol as security researchers continue to audit the growing ecosystem of MCP servers. Expect to see more findings related to OAuth token handling and cross-tenant data isolation in multi-user agent platforms. Additionally, keep an eye on multimodal processing pipelines; as seen with the SGLang and vLLM issues this week, the complexity of handling images, audio, and video inputs introduces new classes of memory corruption and DoS vulnerabilities that are only beginning to be understood. Finally, monitor for potential active exploitation of the mcp-atlassian flaws, as the combination of high impact and easy exploitability makes it a prime target for automated botnets.

Covered entries (120)