← Back to feed
2026-10-16 Mcp SecurityPrompt Injection TLP:CLEAR

VulnCheck Source Review Yields 23 MCP and Agent Console CVEs in Five Days

Date: 2026-10-16
Tags: mcp-security, prompt-injection

Executive Summary

A static source review campaign by three researchers produced at least 23 MCP and AI agent CVEs published October 10 to 14, 2026, led by CVE-2026-110616 in NullHub at CVSS 9.2 where the management API checks no bearer token at all. The findings are largely authorization gates reachable through tool calls, with some breaking isolation boundaries and one allowing settings input to inject a shell command hook. Operators running AI agent consoles should treat these products as unaudited and prioritize patching or network isolation, noting that no advisory in the set names a patched version.

Campaign Summary

FieldDetail
Campaign / MalwareMCP and agent source review CVE wave
AttributionIndependent security researchers, no single actor (confidence: none)
TargetDeployments of MCP servers and AI agent consoles including NullHub, holaOS, 9router, mistral.rs, Phi, and Unla
VectorStatic source review, exploited through API calls, tool calls, and prompt injected agents
Statusactive
First Observed2026-10-10

Detailed Findings

According to VulnCheck, reported via theinjection.dev, a static source review campaign by three researchers produced at least 23 MCP and agent CVEs published October 10 to 14, 2026, and no advisory in the set names a patched version. CVE-2026-110616 in NullHub leads at CVSS v4.0 9.2: its /api/* management API never checks the bearer token it defines because auth_token defaults to null and is never assigned, letting an unauthenticated caller on a non loopback bind control agent instances, rewrite provider credentials, and manage cron jobs and MCP servers. holaOS received CVE-2026-110769 (8.3) and CVE-2026-110768 (6.3), where chat connectors accept tasks from any sender by default. Most other findings are authorization gates an attacker or prompt injected agent reaches through a tool call: Tabularis treats side effecting SELECT statements as read only, Odoo MCP execute_method returns fields the caller is denied, and Trinity's Telegram router accepts agent scoped MCP keys for owner only binding. Open Computer Use shows a desktop agent gap where its password manager denylist matches bundle ids case sensitively while the resolver for already running apps compares them case insensitively and never reapplies the denylist, so a case variant reaches the real process. Two findings break isolation boundaries: in mistral.rs a sandboxed shell child creates a relative symlink named as an output file that the unsandboxed parent reads following the link, and in Phi agent_spawn passes a model supplied working directory to a child whose permission gate is rooted at that directory. 9router writes dashboard input straight into config.yaml so quotes and newlines inside a baseUrl value add a hooks.post_llm_call entry the agent runs as a shell command without asking. The Unla gateway CVE-2026-108865 (8.8) lets an unauthenticated caller mint a token reaching protected MCP prefixes and injected credentials. hieuPenguinnn reported the holaOS pair through VulnCheck.

MITRE ATT&CK Mapping

TechniqueIDContext
Exploit Public-Facing ApplicationT1190Unauthenticated callers reach NullHub and Unla management APIs and token minting endpoints.
Command and Scripting InterpreterT10599router injects a hooks.post_llm_call entry that the agent runs as a shell command.

IOCs

Domains

_No patched versions named in any advisory. Affected version data is per VulnCheck via theinjection.dev._

Full URL Paths

_No patched versions named in any advisory. Affected version data is per VulnCheck via theinjection.dev._

Splunk Format

_No IOCs available for Splunk query_

Affected Platforms

NullHub <=2026.5.29
holaOS <=2026.822.1
Unla gateway
Tabularis
Odoo MCP
Trinity
Open Computer Use
mistral.rs
Phi
9router

Detection Recommendations

Inventory MCP servers and agent consoles and confirm no management API is bound to non loopback interfaces without enforced authentication. Verify that NullHub style auth_token fields are actually assigned at startup and that bearer checks run unconditionally. Audit agent configuration files for injected hooks or command fields and block model supplied working directories from escaping the parent workspace. Reject tool call inputs that alter request scope or permissions, and apply output validation around settings writes that flow into config.yaml. Treat exposed agent consoles as untrusted and place them behind authenticated proxies until patched versions exist.

References