Supply Chain · Watch Friday · 14 August 2026 End-of-day synthesis 5 watches · 12 items

From the watchtower — what crossed the wire today.

A four-times-a-day standing watch on the open-source supply chain. Each pass pulls newly disclosed CVEs, freshly catalogued KEV adds, and active attacks reported in the wild — then ranks them by severity for the day.

The story of the day — Three separate advisories landed against MCP server implementations today — a shell-injection RCE and an unauthenticated path traversal in the same npm MCP tool, plus a DNS-rebinding SSRF bypass in an MCP gateway.

A quiet day on the CISA KEV side — nothing newly catalogued since Monday — but GHSA's disclosure queue turned up a pointed cluster: the Model Context Protocol's own server ecosystem is now getting the same treatment as any other exposed daemon.

token-optimizer-mcp shipped two bugs at once — unescaped shell interpolation in its smart_user tool that gives arbitrary command execution to any calling client, and an unauthenticated path-traversal read on its dashboard API. ContextForge, an MCP gateway, adds a DNS-rebinding TOCTOU that the maintainers had already flagged in code comments but hadn't closed. Outside the MCP cluster it was a broader high-severity day than usual: Budibase's shared IP blacklist fails across five different automation integrations at once, Grav will let an unauthenticated request drive a worker to multiple gigabytes of RAM, Lima's QEMU driver leaks in-VM root through its guest-agent socket, OpenAM's SSO cookie doubles as its own CSRF token, and mchange-commons-java's JNDI object factory is still carrying the same gadget-chain shape that made Log4Shell dangerous.

→ Operational priority for the night if you run token-optimizer-mcp or expose an MCP gateway to any untrusted client, patch to the fixed versions (token-optimizer-mcp >=5.1.0, ContextForge >=1.0.3) before letting another tool call reach them.

19:00 ET · First Watch

High · GHSA · Token Optimizer MCP (CVE-2026-55157) ·added 19:00 ET

Token Optimizer MCP: OS command injection in smart_user via username in get-user-info

token-optimizer-mcp's smart_user tool interpolates the caller-supplied username straight into a shell command wrapped only in double quotes, which POSIX still evaluates for $(...) and backtick substitution — any MCP client that can call the tool gets arbitrary command execution as the server's user. This is the second disclosure against the same npm package today (see the path traversal below), and it's the more dangerous of the two: no auth check, no path constraint, just unescaped shell interpolation. Pin to >=5.1.0, and audit any other MCP tool arguments in your own servers that flow into execAsync or child_process without an allowlist.

High · GHSA · Budibase ·added 19:00 ET

Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist

Budibase's automation steps — Webhook, Zapier, N8N, Slack, Discord — share an IP blacklist that can be bypassed to reach internal addresses, turning any of those five integration points into an SSRF pivot. One shared filter bug becomes five separate attack paths because each integration wires outbound calls through the same unvalidated check. Patch and re-verify each integration's URL validation individually rather than trusting the shared blacklist to hold.

High · GHSA · Grav (CVE-2026-53653) ·added 19:00 ET

Grav: Unauthenticated denial of service via unbounded image derivative dimensions

Grav's image derivative pipeline passes query-string resize dimensions straight to imagecreatetruecolor with no ceiling, so a single unauthenticated request like ?forceResize=20000,20000 drives a worker to 3+ GB RAM and 22 seconds of CPU — libgd's buffer sits outside PHP's memory_limit entirely. A handful of concurrent requests takes the host down, no account or non-default config required. No fix version yet; front any self-hosted Grav site with a rule capping resize dimensions until one lands.

High · GHSA · Lima (CVE-2026-53657) ·added 19:00 ET

Lima: An arbitrary user in a QEMU VM could gain root privilege in the VM via the guest agent socket

On Lima's QEMU driver, any user inside the VM can reach /run/lima-guestagent.sock and tunnel through it to privileged sockets like D-Bus, picking up root inside the guest — not the host. Switch to the vz driver (default since v1.0) or disable the guest agent with --plain if you're still on qemu and multi-tenancy inside the VM matters to you.

High · GHSA · OpenAM (CVE-2026-53660) ·added 19:00 ET

OpenAM Insecure SSO Cookie Initialization

OpenAM's default config ships the iPlanetDirectoryPro SSO cookie without HttpOnly, and reuses that same cookie as the CSRF token for OAuth/OIDC consent — so a single XSS anywhere in the OpenAM origin both steals the session and auto-completes consent grants in one step. Update to 16.1.1 and don't inherit the default cookie flags in any fork or downstream config.

High · GHSA · mchange-commons-java ·added 19:00 ET

mchange-commons-java contains elements susceptible to abuse via JNDI injection and deserialization gadgets

mchange-commons-java's JNDI ObjectFactory will construct arbitrary classes and set JavaBean properties from a Reference object — the same shape as the gadget chains that made Log4Shell dangerous. Pair it with commons-beanutils/commons-collections on the classpath and a pre-Java-16 JVM and you get RCE via a crafted Reference. Most current exposure is transitive through c3p0's JDBC pooling; check whether your dependency tree still pulls a pre-0.6.0 copy.

Medium · GHSA · Token Optimizer MCP (CVE-2026-55156) ·added 19:00 ET

Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints

The same package's dashboard HTTP server exposes /api/session-summary and /api/session-events with zero auth middleware, concatenating a caller-supplied sessionId into a filesystem path that Node normalizes through .. traversal — any network client can read arbitrary .jsonl files, including session logs full of tool invocations and token-usage data. Same fix version (5.1.0) closes this alongside the RCE above; if you're on an older release you're carrying both bugs at once.

Medium · GHSA · ContextForge (CVE-2026-53708) ·added 19:00 ET

ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (/admin/gateways/test)

ContextForge's admin gateway-test endpoint validates a URL's DNS resolution once at check time, then hands the raw hostname to httpx, which re-resolves independently at connect time — a textbook TOCTOU that a DNS-rebinding attacker with a short TTL can walk through to reach 169.254.169.254. The maintainers already flagged this as a tracked limitation (ICACF-15) in two separate code comments, so the fix — pin the validated IP into the connection — is known but not yet shipped. Exploitation needs the admin API enabled plus a gateways.read role, so it's not wide open, but any MCP gateway exposing that endpoint should move to 1.0.3.

Medium · GHSA · SurrealDB ·added 19:00 ET

SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users

SurrealDB's array-element (field.*) SELECT permission filter removes denied elements by index while iterating forward, so each removal shifts the remaining indices and leaks roughly half the array back to record-scope users — a deny-all returns the odd-indexed elements instead of nothing. Root and record-owner sessions aren't affected, and field-level permissions still hold; only element-level filtering on record users leaks. Upgrade to 3.1.4.

Medium · GHSA · s2n-quic (CVE-2026-10740) ·added 19:00 ET

s2n-quic has excessive memory allocation

s2n-quic's CRYPTO-frame reassembly buffer has no size ceiling, so a single 1200-byte packet with a high offset can force roughly 9.4 MB of allocation before any handshake completes — repeat it and you exhaust server memory with no auth required. Upgrade to 1.82.0; there's no workaround.

Medium · GHSA · Fabric CA (CVE-2026-53658) ·added 19:00 ET

Fabric CA: LDAP Injection via Unescaped Username in GetUser Filter

When fabric-ca is backed by LDAP, the HTTP Basic username goes straight into the uid search filter unescaped, letting an unauthenticated attacker inject LDAP filter syntax before password validation and potentially redirect an enrollment attempt at a different account. Only relevant if you've wired fabric-ca to LDAP; patch before your next CA enrollment cycle.

12:00 ET · Forenoon Watch

High · GHSA · Authorizer (CVE-2026-35511) ·added 12:00 ET

Authorizer: zero-click account takeover via OAuth identity linking to unverified email accounts

Authorizer's OAuth callback links an incoming Google/GitHub/etc. identity to any existing account matching that email — including one an attacker pre-registered and deliberately left unverified — then auto-marks the email verified and never invalidates the attacker's original password. Stage an account on a victim's email ahead of time, wait for them to do a normal OAuth login, and you get a persistent password-based backdoor that survives the victim revoking the OAuth grant — zero-click, no user error required. If you run Authorizer, audit for pre-existing unverified accounts on any domain your users OAuth into, and patch to a version that refuses to link OAuth identities to unverified existing accounts.