The MCP Door Skipped the Checks the Main API Enforced: Instatic CVE-2026-121458 and SurrealDB CVE-2026-121419

2026-11-04 AI Vulnerabilities & CVEs by al-ice.ai Editorial

On 3 November 2026, NVD published two CVEs that tell the same story from opposite ends of the identity stack. CVE-2026-121458 is a missing-authorization flaw (CWE-862) in Instatic: its AI/MCP content-read tools skip the object-level authorization checks the normal HTTP API enforces, so a low-privilege user can read other users‘ rows. CVE-2026-121419 is an improper-authentication flaw (CWE-269) in SurrealDB: the MCP session fingerprint is derived from the access method name rather than per-user identity, so one user‘s MCP session can be hijacked by another user of the same access method. Both records are still Deferred (NVD has not scored them); VulnCheck, which disclosed both, rates the Instatic flaw at CVSS 4.0 7.1 and the SurrealDB flaw at CVSS 4.0 8.6. Neither advisory mentions in-the-wild exploitation.

Instatic: the MCP tools never asked whose row it was

Instatic before 0.0.21 exposes content_get_document and content_list_documents through its MCP interface. A caller holding only the low-privilege ai.chat and content.edit.own capabilities can invoke those tools against data rows belonging to other users — including private or unpublished draft content — and can enumerate rows from the posts system table. The HTTP API applies object-level authorization; the MCP path simply does not. The affected range is 0.0.12 through before 0.0.21, and the fix line is 0.0.21 (released 12 October 2026, so the patch predates the CVE publication — upgrade, do not wait for a scanner to catch up). Credit goes to researcher Sriman Aluvala. The practical exposure is any deployment where the MCP interface is reachable by authenticated users who are not entitled to every row: the agent channel becomes a read-everything side door, and because agents fetch on instruction, indirect prompt injection can turn a benign user‘s session into the exfiltration path.

SurrealDB: sessions fingerprinted by method, not by user

SurrealDB from 3.1.0 before 3.3.0 computes the MCP BoundSubject fingerprint from the access method name instead of per-user identity for JWT/Bearer access. Any two users authenticating through the same access method therefore collide into the same fingerprint bucket: an attacker holding a valid low-privilege token for that method, plus a victim‘s mcp-session-id, can hijack the victim‘s MCP session and execute MCP tools with the victim‘s roles and permissions. That is both a confidentiality and an integrity break — hence the 8.6 — and the fix line is 3.3.0 (released 28 September 2026, again ahead of the CVE). Credit goes to researcher Yanhaoxi. The session identifier is the only per-victim secret standing between users here, and session IDs transit through agent logs, tool transcripts, and shared harnesses far more casually than passwords do.

The pattern: MCP as the less-reviewed interface

These two CVEs belong to a lineage we have tracked all autumn: the MCP surface re-implements — badly — a check the primary interface already got right. The AWS API MCP Server accepted any same-provider token because it skipped audience validation; the reference MCP TypeScript SDK shipped session confusion and audience blindness in the same week; Chainlit‘s MCP URL grants fell to a semicolon; and the RHOAI gateway let one tenant spend another‘s API quota. Instatic adds the authorization variant (right identity, no object check); SurrealDB adds the authentication variant (wrong identity binding from the start). Defenders should treat every MCP tool endpoint as a second, independently reviewable API surface: diff its authN/authZ logic against the primary API line by line, bind sessions to per-user identity rather than method or role names, and log which identity each tool call actually executed under. If you run Instatic below 0.0.21 or SurrealDB below 3.3.0 with MCP exposed: upgrade to 0.0.21 / 3.3.0 or later and review stored drafts and session logs for cross-user reads in the window.

Our verification was read-only. We read the full NVD JSON records first-hand for CVE-2026-121458 (published 3 November 2026: Instatic before 0.0.21, content_get_document/content_list_documents mechanism, ai.chat plus content.edit.own preconditions, CWE-862, Deferred status, release/GHSA/VulnCheck references) and CVE-2026-121419 (published 3 November 2026: SurrealDB 3.1.0 through before 3.3.0, BoundSubject access-method fingerprint collision, mcp-session-id plus same-method token preconditions, CWE-269, Deferred status, GHSA/VulnCheck references, VulnCheck CVSS 4.0 8.6 vector), the full VulnCheck advisories first-hand (both dated 11/3/2026, high severity, affected ranges 0.0.12 to before 0.0.21 and 3.1.0 to before 3.3.0, CVSS 7.1 and 8.6, researcher credits Sriman Aluvala and Yanhaoxi), and the GitHub release tags first-hand via the API (Instatic v0.0.21 published 12 October 2026, SurrealDB v3.3.0 published 28 September 2026). The GHSA advisory pages returned 404 to unauthenticated requests and are cited via the NVD references only. The MCP SDK, AWS, Chainlit, and RHOAI parallels are our prior coverage linked above. We ran no MCP server, crafted no session hijack, accessed no third-party data, and contacted no one. Brave Search was used for discovery only.

Sources: