Supply Chain · Watch Wednesday · 19 August 2026 End-of-day synthesis 4 watches · 26 items

From the watchtower — what crossed the wire today.

A four-times-a-day standing watch on the open-source supply chain. Each pass pulls newly disclosed CVEs, freshly catalogued KEV adds, and active attacks reported in the wild — then ranks them by severity for the day.

The story of the day — Six MCP-server disclosures in one hour turned the AI-agent tooling layer into today's supply-chain story, while CISA confirmed active exploitation of an MLflow SSRF flaw.

Today's GHSA queue ran heavy on trust-boundary bugs — the kind where the flaw isn't a memory-safety mistake but a place where two systems disagree about how much to trust each other. Nowhere was that clearer than the MCP ecosystem.

Six MCP-server advisories landed within about an hour: claude-faf-mcp, faf-mcp, and grok-faf-mcp all resolve caller-supplied file paths with zero confinement, Contentful's MCP server lets an LLM-controlled `host` parameter redirect its Personal Access Token to an attacker endpoint, and mcp-searxng ships its SSRF guard off by default. Paired with a Copier bug where a trust-prefix check passes for an untrusted scaffolding template, and this morning's CoSnitch disclosure in Copilot Personal, the pattern holds: AI-agent tooling keeps shipping the gap between what the LLM says and what the server should actually do. Separately, CISA added an MLflow SSRF (CVE-2026-64849) to the KEV catalog today with confirmed active exploitation — the one item on the board that's moved from disclosed to attacked.

→ Operational priority for the night audit any self-hosted MCP server (the faf-mcp family, Contentful, mcp-searxng) for unconfined path/host arguments before extending it further into agent workflows, and check whether any internet-reachable MLflow tracking server is unpatched — KEV confirms it's being exploited now, not eventually.

21:00 ET · Last Watch

Medium · GHSA · medium · npm · TinaCMS media-handling disclosures (2-advisory batch) ·added 21:00 ET

TinaCMS: dev-server CORS bypass allows arbitrary file write; production S3/Azure/Cloudinary media adapters allow cross-tenant write and delete

Two TinaCMS advisories landed together: the local dev server's CORS check only blocks the browser from reading the response, not from processing the state-changing request, so a malicious webpage can write arbitrary files into a running `tinacms dev` server's media root with no interaction beyond a page visit (CVE-2026-63123). Separately, the first-party production media handlers for S3, DigitalOcean Spaces, Azure Blob, and Cloudinary trust a caller-supplied key/path with no check that it falls under the configured `mediaRoot`, so any authorized CMS editor can mint presigned PUT URLs or issue deletes against any object the IAM credential can reach, including other tenants' content in shared-bucket deployments (CVE-2026-59992). Patch `@tinacms/cli` to ≥2.5.2 and the media adapter packages (`next-tinacms-s3`/`next-tinacms-dos` ≥23.0.4, `next-tinacms-azure` ≥14.0.4, `next-tinacms-cloudinary` ≥26.0.4); multi-tenant Tina deployments on a shared bucket should treat this as urgent, since the package's own README recommends bucket-wide IAM grants that this bug turns into a cross-tenant write primitive.

18:00 ET · First Watch

Critical · CISA KEV · added 2026-08-19 ·added 18:00 ET

CISA KEV adds MLflow SSRF (CVE-2026-64849) — confirmed exploitation in the wild

CISA added MLflow's server-side request forgery bug to the Known Exploited Vulnerabilities catalog today: a request handler lets an attacker reach internal or cloud-metadata services and read back `response_status`/`response_body`, which on any cloud-hosted MLflow tracking server is a direct path to IAM credentials. KEV inclusion means active exploitation is confirmed, not theoretical — treat any internet-reachable MLflow server as compromised-until-proven-otherwise if it hasn't been patched. Federal agencies have until 2026-09-02 per BOD 26-04; everyone else should not wait that long given MLflow's typical exposure pattern (internal tool, often left reachable from the internet).

High · GHSA · high · npm/composer · MCP-server cluster (6-advisory batch) ·added 18:00 ET

MCP servers: six advisories in one hour span path-traversal file access, PAT exfiltration, and SSRF

Six MCP-server advisories landed within about an hour: claude-faf-mcp, faf-mcp, and grok-faf-mcp all resolve a caller-supplied `path` argument via `~` expansion and `path.resolve()` with no confinement to the project directory, so any MCP client — or an LLM steered by prompt injection — can read or write files anywhere the server process can touch. Separately, Contentful's MCP server spreads LLM-controlled `host`/`proxy` params straight into its CMA client, letting a poisoned prompt redirect the server's Personal Access Token to an attacker endpoint, and mcp-searxng's SSRF guard is off by default with redirect/canonicalization bypasses even when enabled. None of these need a compromised registry package — the vulnerable surface is the tool definition itself, which makes this the clearest confirmed case yet of prompt injection reaching real file and credential theft through MCP. Patch to claude-faf-mcp >5.7.1, faf-mcp >2.1.2, grok-faf-mcp >1.5.2, @contentful/mcp-server ≥1.7.19, or mcp-searxng ≥1.2.1, and audit your own MCP tool definitions for the same unconfined path/host/URL argument pattern.

High · GHSA · high · pip · Copier ·added 18:00 ET

Copier: trust-prefix bypass via path traversal runs scaffolding tasks unprompted

Copier's `trust` setting checks a template URL against a trusted prefix with a raw `str.startswith` and no path normalization, but the URL is normalized before the template is actually fetched — so `https://github.com/trusted-org/../attacker-org/repo.git` passes the trust check yet resolves to the attacker's repo, whose `tasks`/`migrations`/`jinja_extensions` then execute without the `--trust` prompt. This is a textbook supply-chain trust-boundary bug: the whole point of the trust prefix is to gate arbitrary code execution from scaffolding templates, and a naive string comparison against a normalized-later value defeats it completely. Affects copier 9.5.0–9.15.1 — upgrade, and audit any CI pipeline that scaffolds from a "trusted" prefix without pinning to an exact org/repo.

High · GHSA · high · Maven · GeoServer (CVSS 7.2) ·added 18:00 ET

GeoServer: FreeMarker SSTI in default WMS output formats reaches OS command execution

An authenticated GeoServer admin can upload a FreeMarker template that chains method calls around the `Execute`-class blocklist in `TemplateUtils.getSafeConfiguration()`, reaching arbitrary OS commands and file read/write — and this hits a plain GeoServer install via ordinary WMS GetFeatureInfo/GetMap output formats, no extensions required. Admin-gated, but GeoServer's admin role is often held by GIS analysts rather than security-reviewed operators, which is a wider practical population than the CVSS 7.2 implies. Upgrade to 2.27.0.

High · GHSA · high · mixed ecosystems (4 unrelated disclosures) ·added 18:00 ET

Four unrelated high-severity disclosures: logto-tunnel path traversal, Grav .htaccess bypass, XWiki privesc, Document Merge Service RCE

Four separate high-severity bugs landed today with no common thread beyond timing: @logto/tunnel's static-file proxy resolves `../` in request URLs and serves files outside `--experience-path`; Grav's shipped `.htaccess` blocks sensitive extensions case-sensitively, so uppercase variants (`.YAML`, `.PHP`) slip through on case-insensitive filesystems (Windows, macOS, Docker-on-Mac volumes); XWiki's Live Data edit REST API lets any page editor grant themselves script rights, bypassing listener-based security checks; and Document Merge Service has SSTI-to-RCE in XLSX templates via `xltpl`'s non-sandboxed Jinja environment. Patch each independently — @logto/tunnel to the fixed release, Grav 2.0.4+, XWiki 16.10.17/17.4.10/17.10.4/18.1.0, and Document Merge Service 9.1.0+ (or disable XLSX template uploads as a stopgap).

12:00 ET · Forenoon Watch

High · GHSA · high · MineAdmin ·added 12:00 ET

MineAdmin: path traversal in plugin install/uninstall via unsanitized identifier, reaches arbitrary composer commands

MineAdmin's app-store plugin service concatenates a user-supplied `identifier` value straight into filesystem paths with no sanitization, so `../` sequences in the download/install/uninstall flow let an attacker read, install, or uninstall plugins outside the intended directory — and per the advisory, potentially execute arbitrary composer commands through the same unvalidated path. Same shape as any plugin-manager path-traversal bug: the identifier is trusted where it shouldn't be. Audit anywhere your MineAdmin instance exposes plugin management to less-trusted admin roles and patch before the fix version lands.

High · GHSA · high · MeshCentral ·added 12:00 ET

MeshCentral: rogue MeshAgent can stored-XSS an admin via unsanitized osdesc field in coreinfo message

A compromised or rogue MeshAgent can inject arbitrary HTML/JavaScript through the `osdesc` field of its coreinfo message; the server stores the value with zero sanitization (only a `typeof == 'string'` check) and renders it via `innerHTML` when an admin opens the device details panel — and the management UI's CSP already allows `'unsafe-inline'`, so there's no browser-side backstop. This flips the usual trust direction: MeshCentral's whole value proposition is a trusted server managing untrusted-ish endpoints, and here a single compromised agent gets script execution in the admin's session. Treat any agent reporting anomalous osdesc content as compromised until this is patched, and don't rely on CSP alone here.

High · GHSA · high · Kestra ·added 12:00 ET

Kestra: stored XSS via custom Markdown [[link]] attribute injection in flow descriptions

Kestra's Markdown renderer supports a custom `[[link ...]]` syntax that converts into an HTML element, but the parser doesn't allowlist or sanitize attacker-controlled attributes before rendering — so anyone who can create or edit Markdown content (a Flow description, for example) can inject JavaScript event-handler attributes that fire when another user views that content. Workflow-orchestration tools like Kestra often have broad internal audiences with edit access to flow metadata, which widens the practical attacker pool beyond "external threat." Patch and audit who currently holds flow-edit permissions if descriptions aren't tightly scoped.

Medium · GHSA · medium · pip · MobSF (4-advisory batch) ·added 12:00 ET

MobSF: four-advisory batch — arbitrary file read, CSRF gap, SSRF port bypass, zip-bomb DoS

Mobile Security Framework took four advisories from one review pass: `find_icon_path_zip()` resolves an APK's unsanitized `android:icon` manifest value as a filesystem path, so a crafted icon value reads arbitrary server files into the downloads directory for any authenticated user to fetch; separately, the post-Django-2.0 migration left `CsrfViewMiddleware` only in the deprecated `MIDDLEWARE_CLASSES` list, so every authenticated POST endpoint (delete scan, upload, change password) accepts requests with no CSRF token — verified by deleting a real scan with just a session cookie. Round out the batch with an SSRF port-restriction bypass in the assetlinks checker and a zip-bomb DoS where a missing `continue` statement lets oversized files write to disk anyway despite the size-limit log message. If you self-host MobSF for APK triage, patch all four together — the CSRF gap is the one to prioritize since it needs no attacker infrastructure, just a malicious webpage.

Medium · GHSA · medium · npm · MagicMirror² (4-advisory batch) ·added 12:00 ET

MagicMirror²: four unauthenticated Socket.IO findings — two SSRF, a secret-disclosure bypass, and an IP-whitelist gap

MagicMirror²'s Socket.IO server attaches directly to the HTTP server without the `ipWhitelist` checks Express middleware enforces elsewhere, so on any non-loopback deployment an untrusted network client can reach module namespaces directly — no authentication needed. That gap enables three follow-on bugs: the calendar and newsfeed node-helpers both accept attacker-supplied URLs via socket notifications (`ADD_CALENDAR`, `CHECK_ARTICLE_URL`) and fetch them server-side with no allowlist, and the shared socket dispatcher expands `**SECRET_NAME**` placeholders in inbound payloads before the `/config` endpoint's redaction ever applies, so a connected client can pull real `SECRET_*` environment variable values through a module helper. If your mirror listens on anything but loopback, treat `ipWhitelist` as broken for Socket.IO until patched, and rotate any secret exposed via module env vars.

Medium · GHSA · devpi-server ·added 12:00 ET

devpi-server: +changelog route on primary/master nodes leaks full database including password hashes and token salts

On any devpi-server instance running the replication `primary` (or deprecated `master`) role, a trivially modified GET to the `+changelog` route dumps the complete database — password hashes and the ids/salts backing devpi-tokens included. Hashes are argon2, so brute force is impractical but dictionary attacks aren't, and any private PyPI mirror running this role should treat exposed credentials as a live risk rather than a theoretical one. Patch, then rotate every password and token that could have transited a primary/master node before the fix landed.

Medium · GHSA · hex · membrane_mp4_plugin ·added 12:00 ET

membrane_mp4_plugin: unauthenticated DoS via BEAM atom table exhaustion from untrusted MP4 box names

membrane_mp4_plugin interns every 4-byte MP4 box name as a BEAM atom while parsing container headers, with no allowlist — so any code path that calls `Membrane.MP4.Container.parse/1` on attacker-controlled MP4 bytes can be driven to exhaust the BEAM atom table (capped around 1,048,576, never garbage-collected). Once the ceiling hits, the whole BEAM node aborts, which is a full-service DoS from a single malicious media upload if your Elixir/Membrane pipeline parses user-supplied MP4 files. Reject untrusted MP4 input ahead of this parser until patched, or rate-limit unique box-name variety per upload.

Medium · GHSA · Triton VM ·added 12:00 ET

Triton VM: missing constraint on sponge_absorb_mem lets a malicious prover forge memory-commitment hashes

Triton VM's `sponge_absorb_mem` instruction never verified that hashed values actually came from the claimed memory location, so a malicious prover can substitute arbitrary data for real memory contents and still produce an accepting proof — breaking the soundness of any memory-based commitment built on that instruction. Narrow audience (zero-knowledge VM users relying on this specific instruction), but soundness bugs in proving systems are the category where "it verified" stops meaning what you think it means. Already fixed upstream in commits 17c7ba0a and ef9d9e72 — if you depend on Triton VM for memory-commitment proofs, update and re-verify anything proved under the vulnerable version.

06:00 ET · Morning Watch

Critical · GHSA · kobako (CVSS 10.0) ·added 06:00 ET

kobako: guest-script sandbox escape reaches host RCE via method_missing → public_send

The Ruby mruby-sandbox gem kobako dispatches guest calls to bound host "Service" objects through `Object#public_send` with no restriction to the object's own methods, so a guest script sends `:send` with `[:eval, "<ruby>"]` and runs arbitrary Ruby in the host process — full sandbox escape, every version 0.1.0–0.9.0, PoC included in the advisory. If you embed kobako to run untrusted or attacker-influenced scripts, this is the gem's entire security guarantee gone; upgrade to 0.9.1, which blocks the ambient reflection surface (`send`, `instance_eval`, `method`, etc.) at the dispatcher.

High · GHSA · high · pip · resdata + surfio (CVSS 9.8 each) ·added 06:00 ET

resdata and surfio: matching CVSS-9.8 buffer overflows in subsurface-modeling file parsers

Two PyPI geoscience libraries — resdata (GRDECL reservoir files) and surfio (irap surface files) — got near-identical buffer-overflow fixes minutes apart, both scored CVSS 9.8 under the boilerplate assumption that the parser runs "in a networking context such as a web service." Neither advisory describes a concrete exploit chain and both are narrow-audience oil-and-gas/subsurface tooling, so treat the 9.8 with some skepticism unless you're actually exposing one of these parsers to untrusted uploads. If you are, upgrade resdata to 6.2.9+ and surfio to 0.0.19+ now; everyone else can pick it up on a normal patch cycle.

High · GHSA · high · Maven · com.rabbitmq:amqp-client (6-advisory batch) ·added 06:00 ET

RabbitMQ Java client: six-advisory batch, headlined by reflective class loading via untrusted AMQP messages

The official RabbitMQ Java client shipped six advisories from one review pass; the standout is JSON-RPC's `ProcedureDescription` calling `Class.forName(javaReturnType, initialize=true)` on a class name pulled straight from an untrusted `system.describe` AMQP response, so a co-tenant on a shared broker (or a MITM) can trigger arbitrary static-initializer execution in your JVM. The other five are lower-severity DoS shapes in the frame/value reader (unbounded recursion, oversized allocations, a default TLS trust-everything manager in `useSslProtocol()`). Upgrade to 5.33.0+; if you use `JsonRpcClient` against a broker you don't fully control, that's the one to prioritize.

High · GHSA · high · pip · MONAI (third disclosure in two days) ·added 06:00 ET

MONAI: pickle RCE via NumpyReader.read() plus a separate OS command injection via YAML config

MONAI's NumpyReader hardcodes `np.load(name, allow_pickle=True)` with no way to override it, so any `.npy`/`.npz` file routed through the standard `LoadImage` pipeline can run arbitrary code on load — the advisory explicitly calls out dataset poisoning on shared medical-imaging repos as the realistic attack path. A separate report shows `dataset_name_or_id` from a training YAML reaching `subprocess(shell=True)` unescaped for OS command injection. This is MONAI's third distinct issue in 48 hours after yesterday's incomplete pickle-RCE fix in `algo_from_pickle()` — audit anywhere you load third-party `.npy` files or YAML configs before 1.6.0 lands, and don't process datasets you didn't produce yourself.

High · GHSA · LibreNMS ·added 06:00 ET

LibreNMS: RCE via Signal alert-transport exec() injection, chainable through composer_wrapper.php

An admin configuring a Signal alert transport can point the `Path` field at `../scripts/composer_wrapper.php` and smuggle a shell command through the `Recipient` field into `deliverAlert`'s unsafe `exec()` call, chaining into a second unsafe exec in the composer wrapper for full RCE — PoC and screenshots in the advisory. It's admin-gated like the two other LibreNMS findings from this week's 26.5.0–26.7.0 disclosure run, but unlike those this one is a clean RCE, not just XSS. Upgrade past 26.5.0 and audit who holds alert-transport-edit permissions in the meantime.

High · GHSA · high · pip · Netflix/lemur (8-advisory batch) ·added 06:00 ET

Netflix Lemur: eight-advisory batch — ACME SSRF, plaintext destination creds, cert-revocation and sub-CA authz gaps

Netflix's certificate-lifecycle manager Lemur took eight advisories in one pass: the ACME client follows server-controlled URLs into internal IPs (classic ACME SSRF, RFC 8555-shaped), an incomplete prior fix lets a non-admin repoint `acme_url` via the authority-update endpoint, and the destinations API hands back plaintext SFTP passwords and private-key passphrases to any authenticated user with no redaction. Round out the batch with unchecked `replaces[]` letting any user hijack another cert's auto-rotation, missing ownership checks on cert revocation and export, and a sub-CA creation path that skips `AuthorityPermission` on the parent authority. Given Lemur sits at the root of an org's cert-issuance trust chain, patch it before anything else self-hosted in this batch — check Netflix's advisory list for the fixed version per finding.

High · GHSA · high · Froxlor (second batch in 24h) ·added 06:00 ET

Froxlor: second-order SQLi with full DB exfiltration, plus stored XSS that takes over the admin account

Two more Froxlor findings land the day after yesterday's credential-disclosure CVE from the same release: `Admins.add`'s `ipaddress` field stores a payload that fires as UNION-based SQL injection the next time `IpsAndPorts.listing` runs, exfiltrating the full database; separately, a stored XSS in DNS TXT record content executes in any admin's browser who views the zone, which is a complete admin-account takeover for a customer-role attacker. Round out the batch with a CSRF gap in the standalone AJAX endpoint and DNS zone-file record injection via unescaped delimiters. Upgrade to 2.3.8+ and treat this as the same disclosure round as yesterday's API credential leak — rotate admin sessions after patching.

Medium · GHSA · npm + pip · GeoLens (CVSS 7.5) ·added 06:00 ET

GeoLens: six-finding authz bypass discloses private datasets, some to anonymous callers

GeoLens's read endpoints authorize the resource named in the URL but not a second, caller-influenced dataset reached through a relationship, VRT mosaic, or AI-metadata request body — three of the six findings require no authentication at all and leak private vector tiles, raster pixels, table rows, or schema/sample data to anonymous callers; the other three need only the default `editor` role. Affects the published `geolens`/`geolens-cli` PyPI packages and `@geolens/sdk` on npm. No config workaround exists — upgrade to 1.2.3, all artifacts (PyPI, npm, GHCR).

Medium · GHSA · npm · @rhinostone/swig family (CVSS 7.5) ·added 06:00 ET

@rhinostone/swig: arbitrary local file read via include/extends path traversal, data-driven not just template-driven

This npm fork of the abandoned swig template engine inherited 2023's directory-traversal bug (CVE-2023-25345) — `{% include %}`/`{% extends %}`/`{% import %}` resolve paths without confining them to the template root. The dangerous case doesn't need attacker control of template source, only of the render-time `locals` data (e.g. `swig.renderFile('page.html', {partial: req.query.partial})`), so a variable-driven include path is enough to read `/etc/passwd` or app config through the response. Affects swig, swig-core, swig-twig, swig-jinja2, and swig-django on npm — upgrade to 2.7.2+ (2.7.1 fixed the traversal but broke relative basepaths).

Medium · GHSA · Trivy ·added 06:00 ET

Trivy plugin manager: path traversal in plugin manifests allows arbitrary file write outside ~/.trivy/plugins

Trivy's plugin manager trusts a plugin manifest's metadata when building filesystem paths under `~/.trivy/plugins`, so a crafted plugin can write its manifest or binary anywhere the user running Trivy can write. Notable mainly for the irony: Trivy is the scanner a lot of these same CI/CD pipelines use to catch exactly this class of bug in everyone else's dependencies. Only install Trivy plugins from sources you trust until the fix lands, same as you would any other third-party binary in your pipeline.

Medium · The Hacker News · Varonis Threat Labs ·added 06:00 ET

CoSnitch: three Microsoft Copilot Personal flaws let one click exfiltrate data from connected apps

Varonis disclosed three chained flaws in Microsoft Copilot Personal — collectively CoSnitch — that turn on an undocumented URL parameter the assistant itself surfaces, letting a single crafted-link click silently pull data from whatever apps and information the victim's Copilot session has access to. No confirmed in-the-wild exploitation yet, but the one-click-to-connected-app-exfil shape is the same pattern worth watching across every AI-assistant integration with OAuth-connected apps, not just this one. If you have Copilot Personal connected to email, files, or other apps, treat unexpected Copilot-adjacent links with the same suspicion as any phishing link until Microsoft ships a fix.

Context · The Hacker News · Microsoft Defender ·added 06:00 ET

Microsoft attributes 30+ rotating domains to MacSync Stealer infrastructure

Microsoft Defender correlated endpoint and network behavior across changing infrastructure to link 30+ domains to MacSync Stealer, a macOS infostealer, tracing it from payload retrieval through exfiltration staging. Not a new supply-chain compromise itself, but it's the same infostealer category StubMaker and other recent package-registry campaigns ultimately feed — worth having the domain list on hand if you're triaging macOS endpoint alerts this week.