42
42
[remote] mcp-server-kubernetes 3.8.x - Argument Injection
Argument injection in mcp-server-kubernetes 3.8.x MCP server could allow AI clients to execute unintended Kubernetes operations.
Exploit-DB entry 52638 documents an argument injection vulnerability in mcp-server-kubernetes version 3.8.x, a Model Context Protocol server that lets AI assistants interact with Kubernetes clusters. Crafted input can inject additional arguments into commands executed by the server, potentially enabling unauthorized operations or command execution against the cluster. This highlights growing security concerns around MCP servers bridging LLM agents and infrastructure.
50
47
Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise
Wiz found LiteLLM auth bypass (CVE-2026-59822) and post-auth RCE (CVE-2026-59821) chainable to cloud compromise; the bypass is in CISA KEV with in-the-wild exploitation.
Wiz scanned roughly 3,074 internet-facing LiteLLM deployments and found 9.6% accepted the default master key sk-1234 or required no authentication, making post-auth attacks effectively pre-auth. The MCP endpoint accepts any Bearer token and grants a valid session (CVE-2026-59822), confirmed exploited in the wild via honeypots and added to CISA's Known Exploited Vulnerabilities catalog. Custom code guardrails allow post-auth root-level RCE via exec(compile(...)) (CVE-2026-59821), while pass-through endpoints lack URL validation, enabling cloud credential theft in post-auth scenarios. All assigned vulnerabilities have been patched; the research was presented at DEF CON 34.
84
42
47
60
47
47
57
47
42
42
42
57
42
42
57
60
42
47
42
57
42
42
60
Marimo Notebook Flaw Could Run MCP Commands Before Cells Execute in Edit Mode
Marimo notebook flaw CVE-2026-75149 (CVSS 8.7) allows attacker-supplied MCP commands to run as local subprocesses before any cell executes in edit mode.
Marimo addressed CVE-2026-75149, a high-severity code injection flaw allowing attacker-supplied Model Context Protocol (MCP) commands to execute as local subprocesses when a crafted notebook is opened in edit mode, before any cell runs. The issue affects versions prior to 0.23.15, carries CVSS v4 of 8.7 and CVSS v3.1 of 8.8, and requires user interaction but no authentication. Marimo fixed it in version 0.23.15 (released July 23, 2026) via a PEP 723 hardening patch that treats notebook metadata as attacker-controlled and strips ai, mcp, completion, secrets, and server configuration sections. VulnCheck's CNA also disclosed CVE-2026-67618 (CVSS 7.1), involving an attacker-controlled AI base_url that exfiltrates operator API keys, and earlier CVE-2023-39987, a missing auth on /terminal/ws endpoint allowing full PTY shell access.
58
57
Hackers Use Autonomous AI Agents to Harvest Thousands of Credentials in Under 6 Hours
Google Cloud documents a financially motivated actor using autonomous AI agents on a compromised cloud tenant to harvest 23,800+ credentials in under six hours.
Google Cloud reports that an attacker compromised a victim's cloud environment and deployed a multi-agent framework driven by preconfigured Markdown playbooks to autonomously handle vulnerability scanning, credential collection, error troubleshooting, and IP rotation. An exposed command-and-control server hosted the 'Recon' framework with a live dashboard managing over 23,800 harvested secrets, including cloud and AI-service API keys. The report also ties DUSTMAKER to UNC6780/TeamPCP, targeting AI development tools and CI/CD systems via trojanized MCP packages such as tiktoken_mcp. Google has disabled linked assets and updated protections after the actors' operational security failures.
72
47
42
LiteLLM Flaws Let Attackers Execute Code as Root and Steal Cloud Credentials
Wiz disclosed LiteLLM flaws including CVE-2026-59822 MCP auth bypass, now in CISA KEV, enabling root RCE and AWS credential theft from exposed gateways.
Wiz researchers disclosed weaknesses in the open-source LiteLLM AI gateway: CVE-2026-59821 allows authenticated administrators to execute code as root via the Custom Code Guardrails feature, while CVE-2026-59822 is an MCP authentication bypass where a meaningless Bearer token establishes a valid session. The MCP bypass was observed in the wild through Wiz honeypots and added to CISA's Known Exploited Vulnerabilities catalog on September 2. A scan of 3,074 internet-facing instances found 294 (9.6%) accepting the default master key sk-1234 or lacking authentication. Fixes shipped in LiteLLM 1.82.0 (guardrail hardening) and 1.84.0 (MCP bypass); exposed instances can leak provider API keys and temporary AWS IAM credentials via the pass-through feature and metadata service, with a related config-check issue tracked as CVE-2026-35029.
70
57
47
AI Coding Tools Now a Prime Target for Threat Actors, Google Warns
Google Threat Intelligence Group warns threat actors increasingly target AI coding tools and proprietary AI data, with UNC6780's Dustmaker enabling large-scale supply chain compromises.
Google Threat Intelligence Group's September 8 report says AI-assisted coding tools have become prime targets, contributing to large-scale software supply chain compromises in 2025 and early 2026. Financially motivated group UNC6780 used its Dustmaker credential stealer to extract tokens from GitHub Actions runner memory and compromise packages across PyPI, npm, and Docker Hub, then sold harvested AI tool credentials to other criminals. Chinese nation-state actor UNC6508 conducted espionage against proprietary AI research at North American academic, medical, and military institutions, while extortion gangs stole models, prompts, and source code in Q2 2026. GTIG also documented agentic attacker experimentation, including an autonomous multi-agent credential harvesting campaign built in under six hours and a 'Recon' C2 framework managing over 23,800 harvested secrets.
75
42
57
42
42