First reported · updated · 3 reports sonarsource.com
Lead dispatch
First reported · updated · 3 reports embracethered.com
AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection
Researchers found a vulnerability (CVE-2026-10591) in AWS Kiro, an agentic IDE, where hidden instructions planted in a web page or source file that Kiro processes can trigger indirect prompt injection to rewrite Kiro's own MCP server configuration (~/.kiro/settings/mcp.json) or allowlist arbitrary Bash commands in .vscode/settings.json, achieving arbitrary code execution on the developer's machine with no approval prompt. The human-in-the-loop approval boundary is bypassed because Kiro can write to these config files without user consent, and AWS has issued a fix and CVE.indirect-prompt-injection · prompt-injection · remote-code-execution · tool-abuse · config-poisoning
ai-agents · mcp · llm · agentic-ide
Severity
0.85
The wire · latest
First reported · updated · 5 reports mindgard.ai
Amazon Kiro: AI Is Breaking Vulnerability Disclosure Processes
Mindgard disclosed a prompt-injection vulnerability in Amazon Kiro, an AI-powered agentic IDE, that lets attacker-controlled repository content coerce the Kiro agent into reading local sensitive data, modifying a workspace URL, and triggering an outbound request that exfiltrates the secret. The flaw was reproduced in Kiro IDE 0.7.45 on Windows in both trusted and untrusted workspaces via Kiro Powers (MCP configs and POWER.md steering files); exploitation requires the user open a malicious workspace file and message the agent, and is assessed as low difficulty. Details →First reported · updated · 2 reports amazon.com
CVE-2026-18655 - Broker Credential and OAuth Token Disclosure in AWS Labs Amazon MQ MCP Server via Prompt Injection
CVE-2026-18655 is a vulnerability in the AWS Labs Amazon MQ MCP Server that allows broker credential and OAuth token disclosure via prompt injection, disclosed in AWS security bulletin 2026-070-AWS and GitHub advisory GHSA-xwj6-8x5h-hjp6. An attacker can use indirect prompt injection against the MCP server to exfiltrate sensitive broker credentials and OAuth tokens. Details →First reported · updated · 2 reports splunk.com
SVD-2026-0808 | Splunk Vulnerability Disclosure
Splunk advisory SVD-2026-0808 discloses multiple vulnerabilities in Splunk apps including a critical (CVSS 9.1) remote code execution via untrusted-data deserialization (CVE-2026-76404) in the Splunk MCP Server app, plus several flaws in the Splunk AI Toolkit such as RCE in the Model Loading REST API (CVE-2026-76395), improper privilege management on agent run history (CVE-2026-76391), and missing authorization in container/connection management (CVE-2026-76394). Fixed versions are available for each affected app and add-on. Details →First reported · updated · 2 reports cve.org
CVE Record: CVE-2026-75845
CVE-2026-75845 is an authorization bypass in ArcadeDB's set_server_setting MCP server-level tool (versions 26.4.2 through 26.7.3). SetServerSettingTool.execute() checks only the global allowAdmin flag and never validates the caller's role, so in an MCP deployment with allowAdmin=true and a non-root allowedUsers set, any authenticated read-only user can invoke the tool to modify server GlobalConfiguration, enabling configuration tampering or denial of service. The issue is fixed in 26.8.1. Details →First reported · updated · 3 reports manifold.security
Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents
Manifold Security disclosed a confused-deputy flaw in Microsoft's official Azure DevOps MCP server where a tool returning pull request descriptions lacked the prompt-injection guardrail applied to other tools, letting a hidden PR comment inject instructions into a reviewer's AI coding agent. The agent then acts with the user's own permissions, reaching projects the attacker cannot access and quietly exfiltrating what it finds; Microsoft addressed it in a fix (v2.8.0). Details →First reported feedly.com
CVE-2026-30623 - Exploits & Severity
CVE-2026-30623 is a critical (CVSS 9.8) OS command injection flaw in LiteLLM 1.18.10's MCP server creation feature: the application executes arbitrary command and args values supplied via JSON MCP server configuration without validation. An unauthenticated network attacker can achieve remote code execution with the privileges of the LiteLLM process; patches are available for LiteLLM and related products (DocsGPT, Flowise, Bisheng), while Windsurf and Langchain-Chatchat were reported still vulnerable. Details →First reported ca.gov
CYBER ADVISORY
Cal-CSIC issued an advisory for CVE-2026-61459, a critical (CVSS 9.8) argument injection vulnerability in MCP Server Kubernetes, a component that bridges AI assistants and automated tools to Kubernetes clusters. If the MCP server is externally exposed, an attacker can send crafted requests to steal credentials, bypass security checks, inject malicious arguments, and compromise the entire cluster with potential lateral movement across clusters. A fix is available in version 3.9.0. Details →First reported cve.org
CVE Record: CVE-2026-47427
CVE-2026-47427 is a null pointer dereference denial-of-service in GitHub's official MCP Server (github-mcp-server) prior to version 1.1.0, where the CompletionsHandler in pkg/github/server.go accesses params.Ref without a nil check. A completion/complete JSON-RPC request with a missing or empty ref field triggers a Go runtime panic before any authentication, letting any unauthenticated client crash the server. The issue is fixed in version 1.1.0 (CVSS 7.5 HIGH). Details →First reported github.com
Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server · Advisory · awslabs/mcp
A vulnerability (CVE-2026-18954, GHSA-j694-4m5j-w8hc) in Amazon AWS Labs DocumentDB MCP Server lets an authenticated MCP client bypass read-only mode enforcement by submitting aggregation pipelines with write-capable stages ($out, $merge) through the aggregate tool, which fails to validate pipeline stages. The issue is fixed in version 1.0.12; a workaround is to configure the server with a read-only database user. Details →First reported redhat.com
CVE-2026-12112 - Red Hat Customer Portal
CVE-2026-12112 is a session management flaw in the foreman-mcp-server (MCP Server) shipped with Red Hat Satellite 6.18 and 6.19, where unauthenticated attackers can hijack active administrative sessions because the server caches authenticated client connections and trusts a non-secret session ID without re-validating authentication tokens, while also logging newly created session IDs to standard logs. Rated 7.8 CVSS v3 (Important), it can lead to privilege escalation and infrastructure-wide code execution; Red Hat has issued fixes via RHSA-2026:28405 and RHSA-2026:28438. Details →First reported gitlab.com
LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback | GitLab Advisory Database (GLAD)
CVE-2026-59822 is an authentication bypass in LiteLLM's MCP Streamable HTTP endpoint, where the OAuth2 passthrough fallback path replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object. An unauthenticated attacker could supply an arbitrary/fabricated Bearer token to establish an authenticated MCP session, then list and call configured MCP tools and access connected services. The issue is fixed in LiteLLM v1.84.0. Details →First reported undercodetesting.com
Code Under Siege: New Vulnerabilities Turn AI Coding Assistants Into Hackers' Gateways + Video
Check Point Research disclosed critical vulnerabilities (CVE-2025-59536, CVE-2026-21852, CVSS 8.7) in agentic AI coding assistants like Anthropic's Claude Code that allow malicious repositories to weaponize the tool against its users. Through configuration files (.settings.json, .mcp.json), MCP hooks, and environment variables such as ANTHROPIC_BASE_URL, attackers can achieve consent-bypass arbitrary code execution and API key theft simply by getting a developer to open an untrusted project. Details →First reported nist.gov
NVD - CVE-2026-57300
CVE-2026-57300 is a missing permission check in the Jenkins MCP Server Plugin (version 0.177.v629fdb_2557fe and earlier) that allows attackers with Item/Read permission to read the Pipeline replay scripts of jobs they can access. CISA-ADP scored it CVSS 3.1 4.3 (Medium), and a Jenkins security advisory dated 2026-06-24 addresses the flaw. Details →First reported strobes.co
CVE-2026-23744 - CVE Details, Severity, and Analysis | Strobes VI
CVE-2026-23744 is a critical (CVSS 9.8) remote code execution vulnerability in MCPJam Inspector versions 1.4.2 and earlier, a local-first development platform for MCP servers. Because the tool binds to 0.0.0.0 and its /api/mcp/connect endpoint extracts command and args without security checks, an attacker can send a crafted, unauthenticated HTTP request to trigger arbitrary command execution with no user interaction; public PoCs and vendor patches are available. Details →First reported · updated · 3 reports theregister.com
Red teamers turned Claude Desktop into a double agent to do their evil bidding
Oasis Security disclosed "PromptFiction," a vulnerability in Anthropic's Claude Desktop where a single click on a trusted-looking claude:// URL silently submitted attacker-controlled prompts to the assistant with no user confirmation. Chained with the earlier "Claudy Day" trio of flaws, it could enable silent exfiltration of prior conversations and — when Anthropic's official Filesystem MCP server is installed — file read/write, persistence, and remote code execution. Anthropic has fixed the flaw. Details →First reported jscrambler.com
Unauthorized Publication of a Malicious npm Package affecting CI
Jscrambler disclosed that a threat actor used compromised npm publishing credentials to publish a malicious version of its 'jscrambler' npm package (versions 8.14, 8.16, 8.17, 8.20), which ran an infostealer during the preinstall hook and was downloaded around 1,479 times in a two-hour window. Per Socket's analysis, the malware harvested developer credentials, cloud secrets, crypto wallets, browser data, and notably AI coding tool and MCP configurations (Claude, Cursor, Windsurf, VS Code, Zed), using ChaCha20-Poly1305 obfuscation to resist analysis. Jscrambler revoked credentials and released a safe version 8.22. Details →First reported microsoft.com
AutoJack: How a single page can RCE the host running your AI agent | Microsoft Security Blog
Microsoft researchers disclosed AutoJack, an exploit chain in AutoGen Studio where untrusted web content rendered by a browsing agent can reach a local MCP WebSocket and spawn arbitrary processes on the host, crossing the localhost trust boundary to achieve RCE. The issue was reported to MSRC and hardened upstream in commit b047730; the vulnerable MCP WebSocket surface was never shipped in a PyPI release. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector