VulnWatch VulnWatch
← All articles
Weekly digest · Oct 19, 2026

VulnWatch Weekly: Agentic RCE, MCP Supply Chain, and Model DoS Surge

This week saw a critical surge in agentic vulnerabilities, with CVE-2026-96620 enabling RCE in Claude Agent SDK and deep flaws in MCP servers. Model serving stacks like SGLang and vLLM faced severe DoS vectors, while supply-chain risks in Podman and DeepSeek demand immediate patching.

Prompt Injection Supply Chain Remote Code Execution Data Leakage Auth Bypass SSRF Agentic / MCP

Week in Review: The Agentic Explosion and the Collapse of Trust Boundaries

Executive Summary The week of October 12–18, 2026, was defined by a catastrophic breakdown in the security boundaries of agentic systems, with the Model Context Protocol (MCP) emerging as the primary attack surface for remote code execution (RCE) and privilege escalation. The single most urgent item for all CISOs and platform teams is CVE-2026-96620, a critical argument injection flaw in the Claude Agent SDK that allows untrusted input to trigger arbitrary command execution at CLI startup, effectively bypassing all sandbox permissions. Simultaneously, we observed a coordinated wave of denial-of-service (DoS) vulnerabilities across major model serving engines like SGLang and vLLM, exploiting unbounded resource allocation in multimodal processing. The dominant theme is clear: the rapid integration of "agentic" capabilities has outpaced the implementation of fundamental input validation and authorization checks, turning powerful automation tools into immediate liabilities.

Top Items of the Week

The following vulnerabilities represent the highest impact risks identified this week. Immediate remediation is strongly advised.

  1. CVE-2026-96620 | Critical (CVSS 9.2) | Claude Agent SDK

    • Impact: Argument injection allowing arbitrary command execution via the --mcp-config flag during session resume.
    • Action: Upgrade claude-agent-sdk to version 0.2.121 or later immediately. Audit any application logic that passes user-controlled strings to the resume option.
    • Source: NVD

  2. CVE-2026-95182 | Critical (CVSS 10.0) | DeepSeek Harness

    • Impact: Untrusted search path vulnerability allowing attackers to execute arbitrary code by supplying crafted executable files.
    • Action: Patch DeepSeek Harness to commit c291e796 or later. Implement strict allow-listing for executable paths in agent workflows.
    • Source: NVD

  3. GHSA-2cvf-wqm6-wr9g | Critical (CVSS 10.0) | Podman

    • Impact: Container checkpoint images can silently disable all sandboxing (capabilities, seccomp) when run via podman run, leading to full host compromise.
    • Action: Update Podman to the latest patched version. Treat all OCI-distributed checkpoints as untrusted; verify image annotations before execution.
    • Source: GitHub Advisory

  4. GHSA-w5f2-9q9c-ff4h | Critical (CVSS 9.8) | LMCache (vLLM)

    • Impact: Unauthenticated RCE via unsafe Pickle deserialization on the multiprocess ZeroMQ transport.
    • Action: If using LMCache distributed mode, restrict the ZMQ socket to localhost only or implement network-level authentication. Upgrade LMCache immediately.
    • Source: GitHub Advisory

  5. CVE-2026-77366 | Critical (CVSS 9.9) | obsidian-tc (MCP Server)

    • Impact: Broken access control allowing any valid token to read/write/delete contents of any configured vault, not just the bound one.
    • Action: Upgrade obsidian-tc to version 1.3.1. Revoke and rotate all existing JWTs issued by affected instances.
    • Source: NVD

  6. CVE-2026-111391 | Critical (CVSS 9.2) | SGLang

    • Impact: Code injection via eval() sandbox escape in _evaluate_filter(), allowing Python execution in the scheduler process.
    • Action: Upgrade SGLang to version 0.5.23 or later. Disable the /dumper/configure endpoint if not strictly required.
    • Source: NVD

  7. GHSA-637c-6jxx-4rwm | Critical (CVSS 9.9) | KEDA

    • Impact: Privilege escalation from namespace admin to cluster admin via TriggerAuthentication, allowing theft of cluster-wide secrets.
    • Action: Patch KEDA operator. Audit TriggerAuthentication resources for tenant-controlled URLs.
    • Source: GitHub Advisory

  8. CVE-2026-111704 | Critical (CVSS 9.3) | LangChat

    • Impact: Missing authentication allows unauthenticated access to REST controllers, exposing plaintext passwords and LLM API keys.
    • Action: Apply patch commit 2a6285a or later. Ensure Sa-Token interceptors are registered for all auth routes.
    • Source: NVD

The Agentic Attack Surface: MCP and CLI Injection

The most alarming trend this week is the weaponization of the Model Context Protocol (MCP) and agent CLI interfaces. As organizations rush to deploy "agentic" workflows, the assumption that these tools operate within a trusted perimeter has proven fatal.

CVE-2026-96620 in the Claude Agent SDK stands out as a paradigm-shifting vulnerability. By failing to validate the resume option, the SDK allows an attacker to inject the --mcp-config flag. This doesn't just run a command; it redefines the agent's entire tooling landscape at startup, bypassing the very permission controls the SDK was designed to enforce. This is a classic argument injection flaw with modern, high-stakes consequences. A similar pattern was observed in CVE-2026-111091 (JetBrains Junie CLI) and CVE-2026-88755 (Z.ai ZCode), where opening an untrusted project or repository automatically triggers connections to malicious MCP servers declared in workspace configurations.

The MCP ecosystem itself is fraught with peril. CVE-2026-77366 (obsidian-tc) demonstrated a catastrophic failure in multi-tenant isolation, where JWTs were not bound to specific vaults, allowing lateral movement between user data stores. Furthermore, CVE-2026-57496 (NetLicensing MCP Server) and CVE-2026-110616 (NullHub) revealed that many MCP implementations lack basic path traversal validation and authentication defaults, exposing management APIs to the public internet.

Perhaps most insidious is the rise of "prompt-injection-to-RCE" chains. GHSA-76pm-mq2q-9gcr and CVE-2026-84317 in Nginx UI showed that an MCP tool (nginx_config_add) skipped validation checks present in the UI, allowing an authenticated agent (or a prompt-injected one) to write arbitrary nginx directives, including load_module, leading to host compromise. This highlights a critical gap: agents often have access to "power user" APIs that bypass the safety rails of the human-facing UI.

Model Serving: The DoS Epidemic

While agents are being exploited for access, the underlying model serving infrastructure is collapsing under the weight of unbounded resource allocation. This week, SGLang faced a barrage of Denial of Service vulnerabilities, primarily targeting its multimodal processing pipelines.

CVE-2026-109227, CVE-2026-109228, and CVE-2026-109229 collectively illustrate a failure to enforce limits on video and image processing. Attackers can submit small, highly compressed files (videos, images, audio) that expand into massive memory buffers upon decoding. For instance, CVE-2026-109226 allows an attacker to send a tiny FLAC file that decompresses into gigabytes of PCM data, exhausting worker memory. Similarly, CVE-2026-111391 allows code injection via filter expressions, while CVE-2026-111392 enables cache poisoning by trusting caller-supplied hashes.

vLLM was not spared. GHSA-w5f2-9q9c-ff4h (mentioned above) is an RCE, but the ecosystem also saw multiple DoS vectors like PYSEC-2026-4310 and PYSEC-2026-4307, where request-controlled parameters for video frame extraction (max_frames, fps) allow attackers to spike CPU and memory usage arbitrarily. The common thread is the trust placed in client-supplied metadata for resource-intensive operations. Without strict server-side caps on decoding resolution, duration, and memory footprint, any public-facing inference endpoint is vulnerable to trivial exhaustion attacks.

Supply Chain and Infrastructure Risks

Beyond the AI-specific layers, the foundational infrastructure supporting these systems showed critical weaknesses.

Podman (GHSA-2cvf-wqm6-wr9g) introduced a severe regression where container checkpoints distributed via OCI registries could carry annotations that silently disable all sandboxing features (capabilities, seccomp, namespaces). When a user runs podman run on such a checkpoint, the engine prioritizes the checkpoint's saved state over command-line security flags like --cap-drop=ALL. This is a supply-chain nightmare: a malicious or compromised checkpoint image can escalate to root on the host instantly.

DeepSeek Harness (CVE-2026-95182) suffered from an untrusted search path vulnerability. By placing a crafted executable in a specific directory, an attacker could trick the harness into running malicious code instead of legitimate content. This is a classic "trojan horse" scenario enabled by poor path resolution logic in a tool designed to execute agent workflows.

Database and orchestration layers also cracked. MariaDB (CVE-2026-85748) had a use-after-free in SYS_REFCURSOR handling that could lead to RCE. KEDA (GHSA-637c-6jxx-4rwm) allowed namespace admins to escalate to cluster admins by tricking the operator into sending its service account token to an attacker-controlled URL. These vulnerabilities underscore that AI platforms are only as secure as the Kubernetes and database primitives they rest upon.

Data Leakage and Authentication Failures

Authentication mechanisms in AI tooling remain surprisingly fragile. LangChat (CVE-2026-111704) and NullHub (CVE-2026-110616) shipped with effectively no authentication on management APIs, exposing API keys and super-admin creation endpoints to the open internet. Open WebUI (CVE-2026-109292) leaked user session cookies to destination servers during OAuth connections, enabling session hijacking.

In the WordPress ecosystem, plugins like LifterLMS (CVE-2026-110284) and WSP MCP AI Agents Connector (CVE-2026-109382) failed to properly restrict access to sensitive data, allowing low-privilege users to include arbitrary local files or query draft posts across the entire site. The pattern is consistent: new AI features are bolted onto existing platforms without inheriting the host's authorization models.

Known Exploited Items

Fortunately, as of this writing, no items in this week's digest are marked as is_exploited=true in active wild campaigns. However, the public availability of proof-of-concept details for several critical vulnerabilities (particularly the SGLang DoS and the Claude SDK injection) suggests that exploitation is imminent. The window for defensive patching is rapidly closing.

What to Do This Week

  1. Patch Agentic SDKs Immediately: Prioritize updating the Claude Agent SDK, obsidian-tc, and any MCP servers in your environment. The risk of CLI injection and cross-tenant data access is extreme.
  2. Enforce Resource Limits on Inference: For SGLang, vLLM, and similar engines, implement strict server-side limits on video/audio decoding (max frames, max duration, max resolution). Do not trust client-supplied parameters for resource allocation.
  3. Audit Container Checkpoints: If using Podman, scan all OCI registries for checkpoint images. Verify that no images contain annotations that override security contexts. Consider disabling checkpoint distribution until patches are verified.
  4. Network Segmentation for MCP: Isolate MCP servers from the public internet. Use mutual TLS (mTLS) or network policies to ensure only authorized clients can connect to MCP endpoints.
  5. Review CI/CD Pipelines: Check for vulnerabilities in tools like Wheels CLI and DeepSeek Harness that might be invoked during build or deployment processes. Ensure that untrusted repositories cannot trigger automatic MCP connections.

What to Watch Next Week

Next week, we anticipate a surge in "indirect prompt injection" exploits targeting the newly discovered authorization bypasses in agentic tools. Expect attackers to craft natural language inputs that trick agents into invoking the vulnerable MCP tools or CLI flags identified this week. Additionally, monitor for supply-chain attacks targeting the Python packages underlying these AI frameworks, as the dependency trees for vllm, sglang, and mcp are deep and often pull in unvetted serialization libraries. Finally, keep an eye on the database layer; the MariaDB RCE may spur attempts to target other SQL-based vector stores used in RAG pipelines.

Covered entries (80)