Posts

The Cookie Jar Goes to the Tool Server: Open WebUI’s Five-CVE 0.11.4 Batch Hands Your Authority to Everyone It Talks To

Five CVEs published 12 October 2026 against Open WebUI, all fixed in 0.11.4: CVE-2026-109292 forwards browser session cookies to third-party tool and terminal servers, CVE-2026-109572 lets any terminal user reach the admin Terminals API through the proxy, CVE-2026-109296 reaches disabled model backends by naming an index, and CVE-2026-109295/109298 turn model-invoked grep tools into event-loop stalls. Fix commits read first-hand.

One Annotation Beats Every Flag: Podman’s CVSS 10.0 Sandbox Bypass Was a 2022 Feature, Found by Claude

CVE-2026-94603 reached NVD on 13 October 2026 at CVSS 10.0: any OCI image carrying the io.podman.annotations.checkpoint.runtime.name annotation made podman run silently discard the operator’s own sandbox flags, including --cap-drop=ALL. The cause was a convenience feature merged in December 2022 and shipped in v4.4.0, whose early return skipped the function that applies user security options. The fix is a revert, a breaking change, and a green e2e test turned red. Credited to ADA Logics using Anthropic’s Claude models.

The Mapping Moved but the Cache Stayed: Vghost, the AI-Found vhost Flaw With a Root Exploit and a VM Escape

A Dot Is All You Need: Visual Studio Copilot Gets an 8.8 RCE via Trailing-Dot Path Bypass

The File Name Is the Argument: Eighteen Command-Injection CVEs in Nineteen Seconds, Nine With No Fix

VulnCheck published eighteen CWE-78 records between 15:16:59 and 15:17:18 UTC on 14 October 2026 — transcription wrappers, PDF and video converters, archive extractors — all the same bug: an attacker-controlled file name interpolated into a shell string. We read every record and all nineteen fix PRs: one researcher filed them, nine were merged, nine are still open, and two maintainers shipped fixes in the final hours before publication.

The Socket Is the Authorisation: Xoscar’s Actor Pool Unpickles Whatever Connects, and Xinference Ships It

CVE-2026-49950 reached NVD on 13 October 2026 at CVSS 4.0 9.3: Xorbits Xoscar’s actor-pool channel calls cloudpickle.loads on data from any peer that can open the socket, with no authentication and no message check before reconstruction. We read recv() and unpickle_buffers at v0.11.2 — there is no fixed version, no repository advisory, and Xinference 4.0.0 requires the library.

The Loop Runs Whatever the Model Asks: agno’s Fourth and Fifth CVEs

Retire the Lock, Skip the Cooldown: Ten CVEs Rebuild the BEAM Toolchain’s Threat Model in One Afternoon

On 12 October 2026 the Erlang Ecosystem Foundation CNA published ten CVEs against Hex, hex_core, rebar3 and Gleam in seven hours. One registry field reached three build tools in three languages and became a directory they delete. A second record turns the cooldown — the ecosystem’s own answer to compromised releases — off by retiring the release it protects.

One Missing Role Check, Three Ways to Own the Gateway: Check Point's LiteLLM Chains

Check Point Research chained LiteLLM's missing /config/update authorization (CVE-2026-35029) into file read, admin takeover and RCE, plus a user_config SSRF (CVE-2026-59823). Both fixed as of 1.83.9. What the mechanisms show about LLM gateways as credential stores.

Five SSRF Records Against One Orchestrator: What conductor-oss’s MCP and A2A Code Actually Does

Five CWE-918 CVEs landed against conductor-oss on 13 October 2026, covering the MCP tool lister, A2A agent-card fetch, the API-spec task, the Agentspan controller and the Kafka task. We read every named file. One has no outbound destination policy at all; one already ships the exact guard the record says is missing.

The Rule-Writer Splits on Semicolons, the Rule-Checker Doesn’t: Four Agent Guardrails Fail in One Batch

Wrap It in a Dict and the Gate Opens: Crawl4AI’s CVE-2026-109237 Reads the Server’s Secrets

CVE-2026-109237, published to NVD on 12 October 2026, names an untrusted-config gate bypass in Crawl4AI 0.9.0 before 0.9.4. Wrapping a forbidden LLMConfig in {"type": "dict", "value": ...} launders it past the type allowlist and re-deserializes it as trusted, letting a non-admin API client read OPENAI_API_KEY and SECRET_KEY and forge an admin JWT. We read both defects at v0.9.3 and both fixes at v0.9.4.

Ten in the Regex Compiler, Instructions in the Agent: GitLab’s 19.4.2 Critical Patch

On 12 October 2026 GitLab shipped a 24-fix critical patch (19.4.2, 19.3.5, 19.2.8) led by CVE-2026-97229, a 10.0 unauthenticated RCE via crafted regex in CI/CD config, plus two Duo Agent Platform flaws: CVE-2026-96893 (7.3) injects content into AI agent instructions causing command execution attributed to other users, and CVE-2026-105458 (4.3) bypasses Duo governance controls.

The Blocklist Named Its Own Default: MCP Context Forge’s CVE-2026-53709 Mints Platform Admins

CVE-2026-53709, published to NVD on 13 October 2026 and scored 9.8, covers IBM’s MCP Context Forge gateway through 1.0.1: a hardcoded HS256 JWT_SECRET_KEY shipped in config.py and .env.example, enumerated in the project’s own weak-secrets blocklist, accepted by verify_jwt_token, with a platform-admin bootstrap that needs no database row. The fix landed 26 May; the CVE arrived 140 days later. We read the vulnerable and fixed configuration code at v1.0.2.

Checked the First Field, Missed the Payload: Three New Network-AI CVEs and the Guardrail That Keeps Getting Bypassed

NVD published CVE-2026-109330, CVE-2026-109331 and CVE-2026-109332 against Jovancoding Network-AI on 12 October 2026. The headline record is a ClaudeHookBridge PreToolUse bypass that matches deny patterns against only the first candidate field, the second bypass of the same guardrail in two months. Fixed in 5.15.2.

The Fourth Path Was the MCP Interface: nginx-ui’s Four CVEs

The Fix Shipped in August, the CVE Arrived in October: NVIDIA’s 18-CVE AI-Stack Batch

NVIDIA PSIRT published six AI-stack security bulletins on 13 October 2026 covering 18 CVEs, including a CVSS 10.0 in AIStore. Every named “updated version” was already public — between 46 and 180 days earlier — one is a beta, and for the 10.0 the version the bulletin names still carries the vulnerable API.

Governed, Except by Default: Three obsidian-tc CVEs Sat Fixed but Undisclosed for Three Months

NVD published CVE-2026-77363, CVE-2026-77364 and CVE-2026-77366 against obsidian-tc on 12 October 2026, including a 9.9 cross-vault bypass. All three were fixed in v1.3.1 on 3 July. The fixes shipped, the advisories did not follow for over three months.

Patched in June, Published in October: Two PraisonAI CVEs and the Fix That Needed a Second Fix

CVE-2026-57118 (9.8, unauthenticated agent invocation) and CVE-2026-57143 (8.8, LLM-controlled SSRF in the default search tool) reached NVD on 12 October 2026 — 117 days after PraisonAI shipped both fixes on 17 June. We read both commits: the auth fix returns True when no token is configured, and the guard that makes it matter on an exposed host did not land until August.

Five Ways to Disagree With bash: Roo Code Gets Five Approval-Bypass CVEs and No Patch Is Possible

CVE-2026-110202 through CVE-2026-110206, published to NVD at 19:18Z on 13 October 2026, name five independent command-approval bypasses in Roo Code through 3.54.0. The repository was archived on 16 May 2026, so "through 3.54.0" is permanent. The same batch carries CVE-2026-109429 against Mistral Vibe, whose tree-sitter-bash parser was defeated by the one trick Roo Code’s regex denylist actually catches. We read both gates at the named tags and reproduced the glob tokenisation locally.