Thirty-three further MCP security records landed between September 3 and 15; here is each one

Thirty-three more MCP security records were published, or entered a GitHub Advisory Database or NVD listing, between 2026-09-03 and 2026-09-15, beyond the AWS Labs, IBM ContextForge, Langflow, firecrawl-mcp-server, and CKAN MCP Server stories already covered this cycle. Severity below is exactly as each discloser, whether VulnCheck, GitHub's CNA, JFROG, VulDB, MITRE itself, Patchstack, Google, or the Apache Software Foundation, framed it.

The official Kotlin SDK's third distinct advisory this cycle, CVE-2026-53937 (6.2 medium, GitHub's CNA), covers an unbounded line buffer. ReadBuffer.append writes every chunk from a stdio peer into a buffer with no size cap and extracts frames only on a newline byte, so a peer that never sends one exhausts memory. It affects kotlin-sdk before 0.13.0 and was fixed in that release on 2026-06-02, about fourteen weeks before the 2026-09-08 record. This is separate from the already-covered pair fixed one release later, in 0.14.0; three Kotlin SDK denial-of-service advisories are now on record.

Three records landed against servers already in the catalog. DollhouseMCP's @dollhousemcp/safety package carried a critical AppleScript injection (GHSA-x8w3-wqcf-6p5c, no CVE assigned): its macOS verification-dialog code escaped the outer shell invocation but not the AppleScript string embedded inside it, allowing arbitrary shell commands via do shell script; fixed in @dollhousemcp/safety 1.0.2 and mcp-server 2.0.42, released 2026-09-05, three minutes before the advisory. mcp-searxng drew two more medium advisories beyond the three already covered, both in its web_url_read SSRF guard: one missed IPv6 site-local addresses (GHSA-q9wf-wwq5-qmjf, medium), the other missed IPv4-in-IPv6 notations including the NAT64 prefix 64:ff9b::/96 (GHSA-f653-hpvm-8rfh, medium, 6.8); both are fixed in 2.2.0, released 2026-09-09, four days before either advisory, which brings the server's advisory count to five. warp-agent-mcp had four related validation and output-escaping gaps bundled into one medium advisory (GHSA-7cc5-q98r-rjwj): a commodity denylist enforced on only two of eight quote tools, missing zip-code and address validation on its booking tools, and unescaped address fields in its booking-confirmation widget; fixed in 0.19.3, released 2026-09-02, about three and a half hours before the advisory.

Casdoor's /api/mcp endpoint carried the highest severity of the batch: CVE-2026-91998, 9.9 critical per VulnCheck (also CVSS 4.0 9.4), an authorization bypass in which any application's clientId and clientSecret unlocked user administration across every organization on the instance, including password-salt and email enumeration and account creation. Reserved and published the same day, 2026-09-15, it has no fix as of this fetch; v4.4.0, the affected and still-latest release, shipped the day before. Bifrost's MCP gateway had its own unauthenticated critical, CVE-2026-90898 (9.8, JFROG): registering a stdio MCP client starts the given command immediately with no MCP handshake, and the gateway's default configuration runs with authentication off, so one unauthenticated request could run an arbitrary program as the gateway's process user; fixed in transports/v2.1.0, released 2026-09-08, six days before the 2026-09-14 record.

MCPHub drew a ninth CVE, CVE-2026-90474 (6.8 medium, VulnCheck), an OAuth 2.0 authentication bypass in its embedded authorization server: client authentication was disabled by default and PKCE enforcement optional, so an intercepted authorization code could be redeemed for access tokens outright; fixed in v1.0.32, released 2026-08-23, the same release that closed the eight-CVE batch covered previously. Rowboat's custom-MCP-server configuration failed to validate server and webhook URLs, letting an authenticated user point them at internal services or cloud metadata endpoints (CVE-2026-86122, 5.0 medium, VulnCheck); the record names no fixed version, though v0.9.2 shipped four days before the 2026-09-05 record without an advisory tying it to this fix.

PraisonAI, previously the subject of a three-CVE trio, drew a second batch of three: an unauthenticated POST /api/mcp/connect that started an arbitrary local process (CVE-2026-57124, 9.8 critical), a Basic/OAuth authentication policy that accepted any non-empty Authorization header without validating it (CVE-2026-57134, 8.2 high), and an MCPServer.startHttp() that bound without a host restriction and forwarded every request unauthenticated (CVE-2026-57139, 9.8 critical); all three, GitHub's CNA, fixed in v4.6.59 and v4.6.60, both released 2026-06-17, about three months before the 2026-09-14 and 2026-09-15 records. That makes six CVE records against PraisonAI's MCP surface overall. OGX, the agent platform formerly named Llama Stack, had an unauthenticated SSRF through its MCP tool server_url parameter reaching cloud metadata endpoints (CVE-2026-85666, 7.5 high, VulnCheck); the repository's releases are tagged out of sequence and no changelog entry ties any of them to this fix, so the fix status could not be confirmed. Two older LiteLLM MCP Proxy records re-entered this window through GHSA listing updates rather than new publication: CVE-2026-12798 (SSRF via an unvalidated OpenAPI spec_path, 6.3 medium per VulDB, fixed in 1.82.3 on 2026-03-16) and CVE-2026-12773 (an improper-authentication defect in UserAPIKeyAuth, 7.3 high per VulDB, fixed in 1.59.9 back on 2025-01-29); both were originally published in June 2026 and appear here because their GHSA records were updated on 2026-09-14 and 2026-09-10 respectively.

Seven single-purpose stdio MCP servers were the subject of a VulnCheck batch published within about thirty minutes on 2026-09-04, all path-traversal or injection classes; four remain unpatched as of this fetch. cli-mcp-server's command allowlist could be bypassed with shell substitution syntax like $(...) when ALLOW_SHELL_OPERATORS was enabled (CVE-2026-85660, 8.1 high; the latest PyPI release is still 0.2.5, from 2025-07-04). excel-mcp-server failed to enforce path confinement in stdio mode when EXCEL_FILES_PATH was unset (CVE-2026-85661, 9.8 critical; the latest release is still v0.1.8, from 2026-04-12). git-mcp-server's git_log, git_diff, and git_show tools lacked leading-dash validation on ref and object parameters, letting injected options like --output= write files outside the repository (CVE-2026-85626, 7.5 high; the latest tag is still v2.15.3, the affected version itself). Postgres MCP Pro's restricted mode skipped function-name validation on FROM-clause functions, letting pg_read_file and similar calls through (CVE-2026-85620, 8.6 high; the latest release is still v0.3.0, from 2025-05-16). PentestAgent's MCP HTTP Server carries a separate, still-open command-injection finding in its run_task function (CVE-2026-90617, VulDB rated it 7.3 high on its 3.1 scale; the referenced fix PR remains unmerged). SiYuan drew a fifth MCP-surface record, distinct from the four already covered: a path-guard bypass in its MCP file-access handler used case-sensitive matching on Linux, so requesting a case-variant filename like PublishAccess.json read the protected publishAccess.json configuration (CVE-2026-85580, 6.5 medium, VulnCheck); fixed in v3.8.2, released 2026-08-30, five days before the record. Oraios AI's Serena had its MCP server's default HTTP-mode bind address of 0.0.0.0 recorded as CVE-2026-38924, which MITRE itself rated 2.9 low as a self-disputed finding, noting the project's own documentation recommended a sandboxed environment rather than treating the bind address as the control; a researcher writeup published in July titled the same finding an unauthenticated remote code execution, a materially different severity framing the CNA record does not adopt. Fixed in v1.0.0, released 2026-04-03, five months before the record.

FrontMCP's OpenAPI adapter reopened an already-fixed SSRF: the dependency mcp-from-openapi 2.3.0 still reached loopback addresses through hostname resolution, redirects, or IPv4-mapped IPv6 syntax (GHSA-65h7-9wrw-629c, 8.5 high; CVE-2026-59973 is reserved but not yet published at MITRE), fixed in mcp-from-openapi 2.5.0 and frontmcp/@frontmcp/adapters 1.5.0, both released 2026-06-21. mysql-mcp-server's SSE transport mode constructed its transport without the MCP Python SDK's DNS-rebinding protection, binding unauthenticated to every interface (GHSA-rqfv-2mw9-78g2, critical, CVSS 10.0; CVE-2026-59971 reserved, not yet published); the advisory recorded twenty-five publicly reachable instances found by internet-wide scanning. Fixed in 0.4.2, released 2026-06-20. functype-mcp-server's set_functype_version tool interpolated an unvalidated version string into an npm package specifier installed via pnpm add, letting a file: alias substitute an arbitrary local package (GHSA-wcjj-9m6g-2fr2, 7.8 high; CVE-2026-59176 reserved, not yet published), fixed in 1.4.4, released 2026-06-20.

knowns drew two path-traversal records: its MCP doc and memory tools failed to validate filesystem paths at all (CVE-2026-86439, 8.8 high, fixed in v0.30.0 on 2026-08-16), and its code.find tool failed to confine its path argument to the project root (CVE-2026-88938, 6.5 medium; no fix as of this fetch, with v0.33.0 still the latest release). dbt-mcp's local OAuth helper exposed a GET /dbt_platform_context endpoint with no authentication or Host validation, returning full access and refresh tokens to any process that could reach it, or via DNS rebinding to a victim's browser (CVE-2026-55837, 6.8 medium); fixed in v1.20.0, released 2026-06-03. Google's MCP Toolbox for Databases had a path-traversal defect in its HTTP tool URL builder: dot-segment normalization in Go's ResolveReference let caller-supplied path parameters escape the operator-configured path scope while forwarding the toolbox's own credentials (CVE-2026-11720, 9.3 critical on Google's CVSS 4.0 scale); fixed in v1.3.0, released 2026-05-21, over a month before the record entered this window through a 2026-09-04 GHSA update. Apache Doris MCP Server had a SQL injection that bypassed authorization: a user-controlled database name was interpolated directly into a metadata query and executed without the caller's authorization context (CVE-2025-66336, rated important by the Apache Software Foundation, which assigns no CVSS score); fixed in 0.6.1, released 2026-03-13, over three months before the record, which likewise entered this window only through a 2026-09-11 GHSA update. mikromcp's ping, traceroute, and torch RouterOS tools built commands by interpolating unvalidated parameters and executing them over SSH, so a value like 127.0.0.1; /system reboot ran a second attacker-chosen command (GHSA-q6rp-2cj3-ffmh, high, no CVE assigned); fixed in v1.11.0, released 2026-09-05, nine minutes before the advisory.

Two WordPress plugins drew records. MountDev AI MCP Connector for WordPress had a broken-access-control defect Patchstack rated 6.5 medium (CVE-2026-85306); the CNA text is generic, but the fix, 1.6.6, is confirmed both by the CVE's own version-change field and by the plugin's WordPress.org listing, last updated 2026-09-02, a day before the record. Agentimus - AI SEO, llms.txt & MCP for AI Agents had a Patchstack-rated 8.1 high broken-access-control record (CVE-2026-84779) that the CNA text alone does not explain; the plugin's own changelog names the actual bug, a connection key or an approved assistant's access token accepted on two neighboring admin routes and not only at the MCP endpoint it was issued for, letting one request mint a write key from a read-only one whenever agent writes were enabled. It was fixed in 1.51.1; the next version, 1.51.2, was already live by 2026-09-03, consistent with the record's own publication date.