Supply Chain · Watch Thursday · 18 June 2026 End-of-day synthesis 4 watches · 69 items

From the watchtower — what crossed the wire today.

A four-times-a-day standing watch on the open-source supply chain. Each pass pulls newly disclosed CVEs, freshly catalogued KEV adds, and active attacks reported in the wild — then ranks them by severity for the day.

The story of the day — AI agent frameworks and MCP servers became the day's soft target — a dozen-plus unauthenticated-control-plane and prompt-injection-to-RCE holes landed across PraisonAI, Crawl4AI, OpenClaw and the MCP tooling, while a real update-channel compromise hit WordPress and CISA flagged an actively-exploited Splunk file-write.

The open-source supply chain's newest soft underbelly showed itself today: the AI agent stack. PraisonAI shipped six criticals this morning, and the First Watch fetch added Crawl4AI (a CVSS-10 unauthenticated RCE plus an arbitrary-file-write and an SSRF), the gemini-mcp-tool and netlicensing-mcp MCP servers, AgenticMail's unauthenticated "bridge-wake" that resumes a Claude Code session with permissions disabled, and a twenty-advisory OpenClaw batch. The recurring shape is an agent or MCP server that binds a powerful control plane to the network with no auth, or guards it with a check that's wired in the wrong order or routable around — prompt and message become the new unauthenticated request.

Off the agent beat, the genuinely in-the-wild story is the ShapedPlugin update-channel compromise: trojanised commercial WordPress plugins pushed to paying customers through the vendor's own auto-update server, the same un-auditable-vendor-pipeline trust failure as last week's OptinMonster/Icegram tampering. CISA also catalogued CVE-2026-20253 today — a missing-auth arbitrary file create/truncate in Splunk Enterprise with a three-day BOD 26-04 deadline. Rounding out the day: a web-token/jose crypto cluster (algorithm confusion, a PBES2 p2c DoS, an RSA1_5 padding oracle), a second Daytona isolation break (sandbox-to-host path traversal), and Budibase SQLi across all three SQL connectors. The bright spot is that almost all of the agent-framework issues are pre-exploitation disclosures with fixes available — this is a chance to harden before the campaigns arrive.

→ Operational priority for the night patch internet-reachable Splunk Enterprise (CVE-2026-20253, due 2026-06-21) and get every AI agent / MCP server off routable interfaces behind authenticating proxies before morning — Crawl4AI, gemini-mcp-tool, AgenticMail and OpenClaw included — then inventory ShapedPlugin plugins and freeze WordPress auto-updates.

18:00 ET · First Watch

Critical · CISA KEV · 2026-06-18 ·added 18:00 ET

CISA KEV: Splunk Enterprise missing-auth lets an unauthenticated user create/truncate arbitrary files

CISA added CVE-2026-20253 today: Splunk Enterprise exposes a PostgreSQL sidecar endpoint with missing authentication that lets an unauthenticated user create or truncate arbitrary files on the host (CWE-306). A KEV add means active exploitation, and the BOD 26-04 due date is 2026-06-21 — three days. Inventory internet-reachable Splunk Enterprise, apply SVD-2026-0603, and restrict the sidecar endpoint at the network edge tonight.

Critical · GHSA · pip ·added 18:00 ET

Crawl4AI: unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args

Crawl4AI's Docker server passes `browser_config.extra_args` straight into the Chromium launch line, so an unauthenticated caller can inject flags (e.g. a malicious `--load-extension`/`--remote-debugging` shape) and reach code execution (CVSS 10.0). Any exposed Crawl4AI server is unauthenticated RCE-by-design. Take the Docker server off any routable interface and front it with auth; treat an exposed instance as already compromised.

Critical · GHSA · pip ·added 18:00 ET

Crawl4AI: arbitrary file write via path traversal in crawler downloads → RCE

Crawl4AI writes downloaded files using an attacker-influenceable path with no traversal guard (CVSS 9.6), so a crawl target can drop a file outside the download directory — a startup script, a cron, an SSH key — and escalate to code execution. Same unauthenticated-control-plane theme as the launch-arg RCE; both land in the same advisory batch. Upgrade Crawl4AI and never expose the server.

Critical · GHSA · npm ·added 18:00 ET

gemini-mcp-tool: OS command injection and @file exfiltration via prompt quoting (CVE-2026-0755)

gemini-mcp-tool builds a shell command from prompt text without safe quoting, so a crafted prompt injects OS commands and the `@file` syntax exfiltrates local files (CVSS 9.8). For an MCP server this is prompt-injection-to-shell: any untrusted content the agent ingests becomes host command execution. Upgrade, and never run this MCP against untrusted input on a host you care about.

Critical · GHSA · pip ·added 18:00 ET

netlicensing-mcp: REST path traversal bypasses token redaction

netlicensing-mcp's REST proxy can be path-traversed to reach endpoints whose responses skip the token-redaction layer, leaking the credentials the redactor was supposed to hide (CVSS 9.6). The security control is present but routable around — the same shape as several agent-framework guards this cycle. Patch; assume any token handled by an exposed instance is disclosed and rotate.

Critical · GHSA · npm ·added 18:00 ET

@acastellon/auth: authentication bypass via spoofable headers in validateToken()

`validateToken()` trusts client-supplied headers to establish identity, so an attacker sets the header and is authenticated without a valid token. This is the same spoofable-header trust bug as today's Kirby Panel-install issue, in an auth library whose entire job is the thing it gets wrong. Upgrade immediately and audit anything that imported it for forged sessions.

High · GHSA · pip ·added 18:00 ET

Crawl4AI: unauthenticated SSRF on the Docker server /crawl/stream path

The `/crawl/stream` endpoint will fetch attacker-supplied URLs server-side with no auth (CVSS 8.6) — SSRF into internal networks and cloud metadata. Rounds out a three-CVE Crawl4AI cluster (RCE + file write + SSRF). Egress-filter the crawler host and require auth before exposing it.

High · GHSA · npm ·added 18:00 ET

AgenticMail: unauthenticated inbound mail resumes the operator's Claude Code session with bypassPermissions

An unauthenticated inbound email to AgenticMail can trigger a "bridge-wake" that resumes the operator's Claude Code session in `bypassPermissions` mode — i.e. a stranger's email drives an agent with approvals disabled. This is the prompt/message-as-control-plane pattern at its sharpest: the trust boundary is an open mailbox. Do not run AgenticMail against a public inbox; gate the bridge behind sender auth before any deployment.

High · GHSA · npm ·added 18:00 ET

AgenticMail: cross-agent task authorization bypass in the API

The AgenticMail API lets one agent enqueue or read tasks belonging to another agent — a missing authorization check across the multi-agent boundary. Companion to the bridge-wake issue; same release. Upgrade and scope agent task access per-identity.

High · GHSA · npm ·added 18:00 ET

Budibase: SQL injection in the PostgreSQL, MS SQL and MySQL database connectors

Budibase's database connectors interpolate user input into queries for all three major SQL backends (CVSS 8.4), so a low-code app builder becomes a direct SQLi path into the connected database. If you let untrusted users author or drive Budibase apps over a production DB, this reads/writes that DB. Upgrade and run connectors against least-privilege DB accounts.

High · GHSA · composer ·added 18:00 ET

PHP JWT Framework (web-token/jose): JWSVerifier reads the algorithm from the unprotected header — algorithm confusion

`JWSVerifier` selects the verification algorithm from the token's own unprotected header, the classic alg-confusion footgun — an attacker can downgrade RS256 to HS256 (or to `none`-adjacent behaviour) and forge signatures. Part of a multi-advisory web-token/jose disclosure today. Pin the accepted algorithm allowlist server-side and upgrade.

High · GHSA · composer ·added 18:00 ET

PHP JWT (web-token/jose): PBES2-HS+AKW accepts an unbounded p2c count — CPU-amplification DoS

PBES2 key-unwrap honours an attacker-supplied `p2c` iteration count with no upper bound, so a single token forces millions of PBKDF2 rounds and pins a CPU (CWE-400). One crafted JWE per request is an asymmetric DoS. Cap `p2c` and upgrade; part of the same jose batch as the alg-confusion issue.

High · GHSA · composer ·added 18:00 ET

spomky-labs/otphp: unbounded digits in a provisioning URI triggers an uncaught DivisionByZeroError

A hostile `otpauth://` provisioning URI with an out-of-range `digits` value drives an uncaught DivisionByZeroError during OTP generation — a crash/DoS in 2FA enrolment for anything that imports user-supplied provisioning URIs. Validate `digits` before constructing the OTP and upgrade otphp.

High · GHSA · npm ·added 18:00 ET

OpenClaw: ~20 advisories land at once — exec allowlists, .env-derived paths, and mutable-identity allowFrom checks all bypassable

OpenClaw disclosed roughly twenty advisories in one batch (CVE-2026-53853 and siblings): exec allowlists that skip configured argument patterns, workspace `.env` values that steer dependency/runtime roots and PATH, and `allowFrom` checks across Discord/Zalo/BlueBubbles that bind to mutable display names instead of stable IDs. Individually mostly high/medium, collectively a coordinated audit showing the chat-agent's trust boundaries leak from the workspace and from spoofable chat identities. Treat opening an untrusted workspace as code execution, and upgrade to the fixed release in one move rather than chasing each CVE.

Medium · GHSA · composer ·added 18:00 ET

PHP JWT (web-token/jose): RSA1_5 decryption lacks implicit rejection — Bleichenbacher/Marvin padding oracle

RSAES-PKCS1-v1_5 decryption returns distinguishable behaviour on bad padding, re-opening the Bleichenbacher/Marvin oracle that recovers plaintext or keys over many queries. Disable RSA1_5 in your allowed algorithms entirely (prefer RSA-OAEP) and upgrade.

Medium · GHSA · composer ·added 18:00 ET

PHP JWT (web-token/jose): Chacha20Poly1305 key-wrap discards the Poly1305 tag — no authentication

The Chacha20Poly1305 key-encryption path drops the Poly1305 auth tag, so decryption is effectively unauthenticated and ciphertext can be tampered without detection. Fourth issue in today's web-token/jose cluster — upgrade once to the fixed release rather than chasing each algorithm.

Medium · GHSA · composer ·added 18:00 ET

spomky-labs/otphp: mass-assignment in Factory::loadFromProvisioningUri corrupts OTP state

`Factory::loadFromProvisioningUri` mass-assigns parameters from the provisioning URI, letting a hostile URI corrupt OTP object state or throw an uncaught TypeError. Same untrusted-provisioning-URI surface as the DivisionByZero issue; fold into one otphp upgrade.

Medium · GHSA · go ·added 18:00 ET

Daytona: path traversal in sandbox volume id mounts arbitrary host paths — cross-tenant access and host escape

A traversal in Daytona's sandbox volume-id handling lets a sandbox mount arbitrary host paths (CVE-2026-54319), reaching other tenants' data and the host filesystem — a container/sandbox escape in the dev-environment control plane. Second Daytona advisory today after this morning's cross-tenant WebSocket leak; the multi-tenant isolation story is shaky. Upgrade and avoid exposing Daytona to untrusted sandbox workloads.

Medium · GHSA · npm ·added 18:00 ET

Signal K Server: unauthenticated SSRF via remote-connection endpoints

`makeRemoteRequest()` takes attacker-controlled host/port/TLS params on three admin endpoints with no validation, and in the default (security-not-configured) state those endpoints need no auth (CVE-2026-55591) — SSRF to internal services and cloud metadata. Configure Signal K security and don't expose the admin API; upgrade past 2.27.0.

Medium · GHSA · maven ·added 18:00 ET

NL Portal Backend: document contents still downloadable by any logged-in user (incomplete fix of CVE-2026-49463)

The fix for CVE-2026-49463 was incomplete — document contents remain downloadable by any authenticated user regardless of entitlement (CVE-2026-54683, CVSS 6.5). Another "the patch didn't close it" item this cycle; verify you're on the genuinely-fixed release, not just past the original CVE.

Medium · GHSA · maven ·added 18:00 ET

Armeria: external control of file path in xDS SDS DataSource

Armeria's xDS SDS DataSource lets an external value steer a file path (CVE-2026-11752), exposing arbitrary-file-read in the secret-discovery path of the service mesh control plane. Patch if you run Armeria xDS; constrain the SDS source to trusted config.

12:00 ET · Forenoon Watch

Critical · BleepingComputer · 2026-06-18 ·added 12:00 ET

ShapedPlugin update channel compromised — infected releases pushed to paying WordPress customers

Multiple commercial ShapedPlugin WordPress plugins were trojanised at the vendor's own update server, so paying sites pulled the backdoor through the legitimate auto-update flow rather than a third-party mirror. This is the textbook update-channel compromise — the same shape as the OptinMonster/Icegram CDN tampering last week — where the trust boundary you can't audit is the vendor's release pipeline. Inventory ShapedPlugin products (Smart Post Show, Logo Carousel, and siblings), pin/freeze plugin auto-updates, and diff installed plugin files against a known-good release before trusting the next push.

Critical · GHSA · npm ·added 12:00 ET

PraisonAI (npm): MCPServer exposes an unauthenticated HTTP tools/call endpoint

The npm `praisonai` MCPServer serves tools, resources and prompts over HTTP JSON-RPC with no auth path — `startHttp()` ignores the Authorization header and every POST is executed (CVSS 9.8). Anyone who can reach the port can invoke the agent's tools directly, which for a tool-calling framework is unauthenticated RCE-by-design. Never bind MCPServer to a routable interface; front it with an authenticating reverse proxy and treat any exposed instance as already compromised.

Critical · GHSA · npm ·added 12:00 ET

PraisonAI (npm): AgentOS HTTP server defaults to 0.0.0.0 with no auth on agent invocation

AgentOS registers sensitive agent-listing and agent-invocation routes with no authentication middleware and defaults to `host: 0.0.0.0` (CVSS 9.4). A network-adjacent attacker can enumerate agent names/roles/instructions and invoke them — same unauthenticated-control-plane failure as the MCPServer issue, different entrypoint. Bind to localhost and require auth before any AgentOS deployment leaves a dev laptop.

Critical · GHSA · npm ·added 12:00 ET

PraisonAI (npm): codeMode `sandbox:true` is a regex blocklist, escapable via Function constructor

The `codeMode` tool advertises `sandbox: true` but only applies a small regex blocklist and nulls `process`/`require`; `Function('return this')()` recovers the global object and restores full execution (CVSS 9.9). Any agent that runs LLM-authored code through codeMode is effectively running it unsandboxed — a blocklist is not an isolation boundary. Do not rely on codeMode for untrusted code; run agent code in a real sandbox (separate process, seccomp/gVisor, or a disposable container).

Critical · GHSA · pip ·added 12:00 ET

PraisonAI (pip): `multiedit` tool does arbitrary file read/write with no path validation

The Python `multiedit` tool performs LLM-controlled file read and write with no workspace boundary or protected-path guard (CVSS 9.1), so a crafted prompt or malicious YAML workflow can read `/etc/shadow` or `~/.ssh/id_rsa` and overwrite arbitrary files. Prompt-injection becomes host file access the moment this tool is registered. Drop multiedit from agent tool sets that touch untrusted input, or wrap it in a chroot/jailed workspace.

Critical · GHSA · pip ·added 12:00 ET

praisonai-platform: ships a hardcoded default JWT secret 'dev-secret-change-me'

praisonai-platform signs auth tokens with the built-in default secret `dev-secret-change-me`, and 0.1.4 (the version GHSA-3qg8 declares as the fix) still boots on it (CVSS 9.8). Anyone who reads the public source can forge admin tokens for any deployment that didn't override the secret — classic CWE-798 + insecure-default. Set a real signing secret from the environment and fail closed if it's missing; rotate every token issued under the default.

Critical · GHSA · pip ·added 12:00 ET

python-statemachine: SCXML `<data expr>` evaluated through `eval()` — code injection

python-statemachine 3.1.2 evaluates `<data expr="...">` attributes from SCXML documents with Python `eval()` (CVSS 9.8), so any app that feeds attacker-controlled SCXML to `SCXMLProcessor` gets arbitrary code execution in-process. If you parse user-supplied state-machine definitions, this is a direct RCE. Upgrade once patched and, in the meantime, never pass untrusted SCXML to the processor.

Critical · GHSA · pip ·added 12:00 ET

Jupyter Server: stored XSS in nbconvert handlers escalates to kernel RCE

The nbconvert HTTP handlers render user-authored notebook HTML under the Jupyter origin without a `sandbox` CSP directive, and HTMLExporter doesn't sanitize by default — a notebook with an HTML payload in a display_data output yields stored XSS with cookie access, full `/api/*` authority, and kernel RCE. On any multi-user or shared Jupyter deployment, opening a malicious shared notebook is enough. Patch jupyter_server promptly; until then don't render untrusted notebooks through the nbconvert endpoints.

Critical · GHSA · composer ·added 12:00 ET

Kirby CMS: remote Panel installation via spoofable `Forwarded` / `X-Real-IP` header

On a freshly deployed Kirby site with no user accounts behind a reverse proxy that sets `Forwarded`/`X-Client-IP`/`X-Real-IP`, a remote attacker could spoof a trusted client IP and install the Panel — i.e. create the first admin account. A newly-stood-up site is takeoverable in the window before the real admin registers. Patch Kirby, and ensure your proxy strips client-supplied forwarding headers rather than passing them through.

High · GHSA · npm ·added 12:00 ET

PraisonAI (npm): AgentLoop onToolCall approval hook runs after the tool already executed

`createAgentLoop()` documents `onToolCall` as an approval gate, but the implementation calls `generateText()` (which executes the tools) first and only then invokes the callback (CVSS 8.8) — the human-in-the-loop approval fires after the side effect. This is the same after-the-fact-approval bug class seen in Pi Agent this morning: the guard exists but is wired in the wrong order. If you depend on onToolCall to gate dangerous actions, treat it as advisory only until patched.

High · GHSA · npm ·added 12:00 ET

undici: SOCKS5 ProxyAgent silently drops `requestTls`, bypassing certificate pinning

undici's ProxyAgent discards the `requestTls` option for `socks5://`/`socks://` proxies, so HTTPS through the tunnel falls back to Node's default trust store and ignores your `ca`/`cert`/`rejectUnauthorized`/`servername` (CVSS 7.4). Anyone pinning to an internal CA via a SOCKS5 proxy loses the pin without error — a silent downgrade to system trust. Given undici's reach as Node's default fetch backend, audit any SOCKS5+mTLS path and upgrade.

High · GHSA · npm ·added 12:00 ET

undici: WebSocket client DoS via cumulative fragment-size bypass

undici's WebSocket client enforces `maxPayloadSize` per-frame but not across fragments, so a malicious server can stream many small valid frames whose total exceeds the limit, driving unbounded memory growth and OOM (CVSS 7.5). Any client connecting to an untrusted WebSocket endpoint is exposed. Upgrade undici; if you can't, cap connection lifetime/message count on outbound WS to untrusted servers.

High · GHSA · npm ·added 12:00 ET

Nodemailer: message-level `raw` option bypasses disableFileAccess/disableUrlAccess

Nodemailer v9.0.0 honours a message-level `raw` option that ignores `disableFileAccess`/`disableUrlAccess`, letting attacker-influenced message content read local files or pull a full URL response into the delivered mail (CVSS 7.1) — arbitrary file read plus SSRF whose body is exfiltrated in the sent message. If user input reaches message construction, those two guards are not enough. Sanitize/forbid `raw` on untrusted message paths and upgrade.

High · GHSA · pip ·added 12:00 ET

Pipecat: dev-runner telephony `/ws` accepts unauthenticated call-control with attacker-supplied Call SID

Pipecat's development runner exposes a `/ws` telephony endpoint with no auth; a remote attacker who reaches it can send a crafted Twilio handshake with an arbitrary Call SID and drive call control (CVSS 7.5). It's billed as dev-only, but exposed dev runners are exactly how these reach the internet. Don't expose the Pipecat dev runner publicly; gate `/ws` behind auth before any non-local deployment.

Medium · GHSA · npm ·added 12:00 ET

undici: shared-cache cross-user disclosure via whitespace-padded Cache-Control field names

undici's cache interceptor mis-parses `private=" authorization"` / `no-cache="\tauthorization"` — the whitespace defeats the literal field-name comparison, so responses meant to be private get stored and can be served to other users (CVSS 5.9). On a shared undici cache this is a cross-user info leak. Upgrade; if you run a shared cache in front of authenticated upstreams, this is the one to prioritise of the three undici advisories.

Medium · GHSA · npm ·added 12:00 ET

DOMPurify: persistent ALLOWED_ATTR pollution via setConfig() bypasses the 3.4.7 hook clone-guard

DOMPurify 3.4.7's fix for permanent hook pollution clones ALLOWED_ATTR inside `_parseConfig`, but that guard is skipped whenever the app uses the persistent-config API via `setConfig()` — so a `uponSanitizeAttribute` hook's mutation leaks into later `sanitize()` calls again. Apps using persistent config get an incomplete fix and a re-opened XSS-allowlist hole. If you call `setConfig()`, upgrade past this advisory rather than assuming 3.4.7 closed it.

Medium · GHSA · go ·added 12:00 ET

Podman: WORKDIR symlink traversal can create dirs / change ownership on the host

A malicious image whose WORKDIR path contains a symlink can cause Podman to create a directory or alter ownership on the host filesystem during path dereference (CVSS 5.3); the ownership-change variant needs a race with a host-side mutator and is less likely. Pulling and running untrusted images is the trigger. For ARM64/Podman-based build hosts, patch and avoid running unvetted images as a privileged user.

Context · The Hacker News · 2026-06-18 ·added 12:00 ET

DragonForce hides Backdoor.Turn C2 inside Microsoft Teams relay infrastructure

DragonForce ransomware affiliates are tunnelling a Go-based RAT's C2 through Microsoft Teams relay infrastructure to blend with legitimate collaboration traffic. Not a package-registry attack, but the trust-the-SaaS-egress pattern rhymes with supply-chain tradecraft and defeats naive C2 blocklists. Worth knowing if your egress policy treats Teams/Microsoft IP ranges as inherently safe.

Context · The Hacker News · 2026-06-18 ·added 12:00 ET

Microsoft details a Windows clipper campaign using a USB LNK worm and Tor C2

Microsoft documented a long-running crypto-clipper spreading via a USB LNK worm with Windows Script Host / ActiveX launch logic and Tor-based C2. It's commodity crimeware rather than a registry compromise, included as context on live droppers in circulation. The LNK-on-removable-media vector is the durable lesson for endpoint policy.

06:00 ET · Morning Watch