42
30
60
45
30
60
42
60
60
60
60
Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise
Wiz found LiteLLM auth bypass (CVE-2026-59822) and post-auth RCE (CVE-2026-59821) chainable to cloud compromise; the bypass is in CISA KEV with in-the-wild exploitation.
Wiz scanned roughly 3,074 internet-facing LiteLLM deployments and found 9.6% accepted the default master key sk-1234 or required no authentication, making post-auth attacks effectively pre-auth. The MCP endpoint accepts any Bearer token and grants a valid session (CVE-2026-59822), confirmed exploited in the wild via honeypots and added to CISA's Known Exploited Vulnerabilities catalog. Custom code guardrails allow post-auth root-level RCE via exec(compile(...)) (CVE-2026-59821), while pass-through endpoints lack URL validation, enabling cloud credential theft in post-auth scenarios. All assigned vulnerabilities have been patched; the research was presented at DEF CON 34.
84
30
45
60
55
47
55
55
60
60
Veeam, Terraform MCP, Django Patch Critical Flaws, Led by CVSS 10.0 Cross
60
57
60
30
47
Marimo Notebook Flaw Could Run MCP Commands Before Cells Execute in Edit Mode
Marimo notebook flaw CVE-2026-75149 (CVSS 8.7) allows attacker-supplied MCP commands to run as local subprocesses before any cell executes in edit mode.
Marimo addressed CVE-2026-75149, a high-severity code injection flaw allowing attacker-supplied Model Context Protocol (MCP) commands to execute as local subprocesses when a crafted notebook is opened in edit mode, before any cell runs. The issue affects versions prior to 0.23.15, carries CVSS v4 of 8.7 and CVSS v3.1 of 8.8, and requires user interaction but no authentication. Marimo fixed it in version 0.23.15 (released July 23, 2026) via a PEP 723 hardening patch that treats notebook metadata as attacker-controlled and strips ai, mcp, completion, secrets, and server configuration sections. VulnCheck's CNA also disclosed CVE-2026-67618 (CVSS 7.1), involving an attacker-controlled AI base_url that exfiltrates operator API keys, and earlier CVE-2023-39987, a missing auth on /terminal/ws endpoint allowing full PTY shell access.
58
55
Actively Exploited nginx-ui Flaw (CVE-2026-33032) Enables Full Nginx Server Takeover
60
55
55
[remote] mcp-server-kubernetes 3.8.x - Argument Injection
Argument injection in mcp-server-kubernetes 3.8.x MCP server could allow AI clients to execute unintended Kubernetes operations.
Exploit-DB entry 52638 documents an argument injection vulnerability in mcp-server-kubernetes version 3.8.x, a Model Context Protocol server that lets AI assistants interact with Kubernetes clusters. Crafted input can inject additional arguments into commands executed by the server, potentially enabling unauthorized operations or command execution against the cluster. This highlights growing security concerns around MCP servers bridging LLM agents and infrastructure.
50
⚡ Weekly Recap: AI Goes Rogue, Metabase 0-Day, MCP Supply
60
30
47
ThreatsDay Bulletin: FortiGate RaaS, Citrix Exploits, MCP Abuse, LiveChat Phish & More
60
57
How Cloudflare detects MCP traffic and helps secure it
Cloudflare Gateway now detects Model Context Protocol traffic via protocol-level heuristics to expose shadow MCP usage and enforce approved-server access.
Cloudflare Gateway identifies Model Context Protocol (MCP) requests using protocol-level heuristics. Security teams can use the signal to discover shadow MCP traffic on managed networks, enforce Portal-only access for approved MCP servers, and block direct connections. The updates extend standard gateway and zero-trust controls to AI agent traffic.
35
60
45