Supply Chain · Watch Saturday · 19 September 2026 End-of-day synthesis 4 watches · 35 items

From the watchtower — what crossed the wire today.

A four-times-a-day standing watch on the open-source supply chain. Each pass pulls newly disclosed CVEs, freshly catalogued KEV adds, and active attacks reported in the wild — then ranks them by severity for the day.

The story of the day — MCP's trust-the-localhost design flaw hit five projects in one day — and on the KEV list, LiteLLM's version of the bug is already being exploited in the wild.

No new items landed in the six hours since Forenoon Watch, so this synthesis locks in the shape the day already took: two separate trust-boundary failures repeating across unrelated codebases, plus a live authentication bypass on the KEV list connecting one of them to a confirmed exploit.

The clearer pattern is MCP tooling trusting its own transport like localhost: Obot shipped three bugs at once (SSRF to cloud metadata, an unauthenticated registry API, and consent-free OAuth token minting), Process Compose's listener is exploitable via DNS rebinding, and ToolHive's containers can reach the host through host.docker.internal — five unrelated projects, one mistake, the same day. CISA confirms it's not theoretical: BerriAI LiteLLM's MCP endpoint accepting an arbitrary API key as an authenticated session made today's KEV catalog, meaning someone is already exploiting the pattern in production. The second thread is GitHub itself as trusted infrastructure — CrowdSec's disclosure that May's TanStack npm attack led to a 170-repo private-repo breach, Transparent Tribe's new Rust backdoor using private repos for C2, and a fresh Rapuncel infostealer campaign impersonating LastPass Authenticator through SEO'd fake repos all lean on the same assumption that GitHub URLs are inherently safe. AnyIO also picked up a third same-day CVE (a stderr-pipe DoS, joining this morning's TLS-spoofing and privilege-retention bugs), and JFrog Artifactory now has four CVEs on the KEV list within a single month — the most-targeted build-pipeline tool on today's watch.

→ Operational priority for the night if you run BerriAI's LiteLLM with MCP support enabled, patch or disable its Streamable HTTP endpoint tonight — it's the only item on today's watch with confirmed active exploitation rather than just disclosed risk.

12:00 ET · Forenoon Watch

Critical · GHSA ·added 12:00 ET

LMDeploy — three same-day CVEs, including pickle-deserialization RCE on the model-serving control plane

LMDeploy disclosed three bugs at once: an SSRF-filter bypass, an eval()-based RCE triggered by loading a malicious HuggingFace model's quant_dtype config, and — the critical one — a PyTorch DistServe control-plane endpoint that connects to an attacker-supplied ZeroMQ peer and deserializes the response with pickle, which is remote code execution by design once you control the peer. Anything serving LMDeploy's DistServe/PD-disaggregation API or loading untrusted HuggingFace models is exposed on two independent paths at once. Patch immediately, and treat any HuggingFace model you didn't vet as capable of executing code on load, not just running unsafe tensors.

Critical · GHSA ·added 12:00 ET

org.xwiki.rendering — eval injection lets any user with edit rights get RCE with programming rights

xwiki-rendering-xml includes rendering output in HTML macro content without escaping it, so any user who can edit their own profile or any document can close the HTML macro early and inject Groovy or Python script macros that execute with programming rights — full read/write over wiki content and effectively RCE on the XWiki instance. The bar to exploit is just edit access, which most XWiki deployments hand out to any registered user. Patch now and audit recent document edits for injected script macros if you can't patch immediately.

High · GHSA ·added 12:00 ET

MCP infrastructure has a five-advisory day: Obot (SSRF, open registry, OAuth token theft), Process Compose (DNS rebinding), and ToolHive (Docker host escape)

Five separate MCP-tooling projects disclosed access-control bugs today: Obot alone shipped three (SSRF to cloud metadata via remote-server registration, a registry API that ignores its own auth flag, and an OAuth flow that mints full-scope tokens without a consent screen), while Process Compose's MCP listener is exploitable via browser DNS rebinding and ToolHive's containerized MCP servers can reach host services through host.docker.internal. None are known-exploited, but it's five unrelated codebases making the same mistake — treating the MCP transport as trusted as localhost — on the same day. If you run any of the three, patch and audit what your MCP listener actually trusts.

High · GHSA ·added 12:00 ET

File Viewer — legacy .doc renderer lets a crafted document execute javascript: links on click

The @file-viewer/doc legacy renderer HTML-escapes hyperlink text but never allowlists the URL scheme, so a crafted .doc can embed a live javascript:, vbscript:, or data: link that runs script in the embedding origin when clicked. Anything rendering untrusted .doc uploads — document-preview features, support-ticket attachments — inherits this if it's on a pre-2.3.1 version. Upgrade to 2.3.1, and until then strip or sandbox hyperlinks in previewed legacy Word documents.

High · CISA KEV ·added 12:00 ET

Three Linux kernel bugs land in CISA's Sept 18 KEV release: AF_ALG race, ebtables SNAT OOB write, TLS receive-path check bypass

CISA's most recent catalog release (Sept 18) added three actively-exploited Linux kernel vulnerabilities at once: a race condition in concurrent AF_ALG socket writes (CVE-2025-39964), an out-of-bounds write in the ebtables SNAT target reachable via ARP hardware-address rewriting (CVE-2026-53266), and a TLS receive-path check a zero-length record can bypass (CVE-2025-39682). Three kernel KEV adds in a single release is an unusually concentrated signal — this isn't backfill, it's this week's catalog. If you're running exposed kernels without the latest LTS patches, prioritize these over the rest of today's list.

High · CISA KEV ·added 12:00 ET

KEV: Cisco ISE, Google Pixel modem, Acronis Backup, and Cisco Secure Email Gateway all added Sept 14–16

A tighter cluster from the Sept 14–16 KEV window: Cisco ISE/ISE-PIC's privileged-API misuse (CVE-2026-76460), a Google Pixel cellular-modem authorization bypass (CVE-2026-58704), Acronis Backup's cPanel/Plesk plugin shipping incorrect default permissions (CVE-2026-87886), and a Cisco Secure Email Gateway SQL injection that runs commands as root (CVE-2026-76461). Different vendors, same theme — privileged interfaces trusting input they shouldn't. If you run any of these four, they're all within their KEV remediation window now, not later.

High · CISA KEV ·added 12:00 ET

KEV: BerriAI LiteLLM's MCP endpoint accepts an arbitrary API key as an authenticated session — same MCP-trust theme as today's GHSA batch

LiteLLM's MCP Streamable HTTP endpoint doesn't properly authenticate, letting an unauthenticated caller supply an arbitrary API key and get treated as an authenticated MCP session — the same 'MCP transport trusted the network' failure mode as today's Obot/Process Compose/ToolHive advisories, just on the KEV list because CISA confirmed active exploitation. If you run LiteLLM's MCP support, this one's confirmed in the wild, not theoretical — patch ahead of the rest of today's queue.

High · CISA KEV ·added 12:00 ET

KEV: two more JFrog Artifactory adds (Sept 2, Aug 27) — four Artifactory CVEs on the KEV list within a month

Two more Artifactory bugs joined KEV this pull: an improper-authentication flaw that under default config lets an unauthenticated network attacker gain admin (CVE-2026-82329, Sept 2), and a path-traversal letting an authenticated user write outside the intended Docker-cache path (CVE-2026-66384, Aug 27) — on top of the two Artifactory adds already flagged on this watch. Four separate Artifactory CVEs reaching KEV inside one month makes it the most-targeted build-and-release tool on this list by a wide margin. If Artifactory sits in your release pipeline, this is the single highest-priority patch queue on today's watch, full stop.

High · BleepingComputer ·added 12:00 ET

Fake LastPass Authenticator GitHub repos push a new Rapuncel infostealer

An active, SEO-optimized campaign publishes GitHub repositories impersonating well-known software — LastPass Authenticator among them — to distribute a previously undocumented infostealer called Rapuncel. It's the third GitHub-repos-as-attack-surface story on today's watch alongside CrowdSec/TanStack and Transparent Tribe — SEO'd fake repos are now a standing distribution channel, not a one-off trick. If your team finds tools by searching GitHub rather than going through a known-good org, treat star count and README polish as no signal at all.

Medium · GHSA ·added 12:00 ET

md-editor-v3 — fenced-code language string bypasses the shipped XSS filter

md-editor-v3's markdown-it highlighter interpolates a fenced-code block's language tag directly into an HTML attribute without escaping, so a crafted info string executes JavaScript even with the bundled XSSPlugin enabled — the filter only inspects existing html_block/html_inline tokens, not attributes generated during highlighting. Anywhere rendering user-supplied markdown with this editor's preview is exposed regardless of XSS-plugin configuration. Patch, and don't rely on XSSPlugin alone as your only sanitization layer for user markdown.

Medium · GHSA ·added 12:00 ET

Paymenter — unlocked refund path lets concurrent downgrade requests double-spend credit

Paymenter's service-downgrade handler calculates a proration refund and credits the user's account with no database transaction or row lock around either step, so firing the downgrade request concurrently races past the only guard (an unisolated pending-upgrade check) and multiplies the refund. It's a billing-integrity bug, not a remote-code or auth issue, but it's real money leaking from a race condition anyone could trigger from the UI. Patch, and audit account credit balances for users who've triggered service downgrades recently.

Medium · GHSA ·added 12:00 ET

AnyIO's third same-day bug — process-pool workers can wedge on undrained stderr

A third AnyIO advisory landed today alongside the TLSStream cert-spoofing and extra_groups bugs already on this watch: process-pool workers redirect stdin/stdout to /dev/null but never drain stderr, so code that writes enough attacker-influenced output to stderr fills the pipe and blocks the pool call indefinitely — a DoS if you run untrusted or simply buggy code through AnyIO's process pool. Three independent bugs in one library on one day is worth a full dependency-pin review, not three separate patches. Patch, and if you fan untrusted workloads through AnyIO process pools, add a timeout independent of the library's own handling.

Context · CISA KEV ·added 12:00 ET

KEV: two Chromium V8 memory-safety bugs (Sept 4, Sept 9) backfilled

Two actively-exploited Chromium V8 bugs — an out-of-bounds write (CVE-2026-87491) and a type-confusion issue (CVE-2026-85046), both sandbox-escape-capable via a crafted HTML page — were added to KEV Sept 4 and Sept 9 and are only surfacing on this watch now. Chrome auto-updates for most users, but managed/pinned-version fleets should confirm they're past both fixed versions.

Context · CISA KEV ·added 12:00 ET

KEV backfill: Kestra unauthenticated RCE, Starlette request smuggling, Switchvox SQLi, and an ownCloud auth bypass, all added late Aug–early Sept

Four more early-September/late-August KEV adds surfacing in today's pull: Kestra OSS lets an unauthenticated attacker create and run arbitrary workflows via command injection (CVE-2026-49869), Starlette's request-smuggling bug lets attackers prepend paths into the host segment (CVE-2026-48710), Sangoma Switchvox has an unauthenticated blind SQLi against its Postgres backend (CVE-2026-9586), and a years-old ownCloud auth bypass (CVE-2023-49105) exposes any file when the victim's username and a public link are known. Starlette sits under a lot of Python web stacks — if that's you, confirm the fix is in before treating this as someone else's problem.

Context · CISA KEV ·added 12:00 ET

KEV backfill: six more late-August adds — Linux kernel IPv6 privesc, a second Citrix NetScaler bug, Gitea, Oracle HTTP Server, Zimbra, and TrueConf

The remainder of today's 30-day KEV backfill: a Linux kernel IPv6 privilege-escalation bug (CVE-2026-53362, Aug 27), a second and distinct Citrix NetScaler ADC/Gateway memory bug from the one already on this watch (CVE-2026-8452, Aug 26, DoS rather than auth bypass), Gitea's diffpatch endpoint allowing a malicious patch to plant an executable Git hook (CVE-2026-60004, Aug 25), an Oracle HTTP Server/WebLogic proxy access-control gap (CVE-2026-21962, Aug 24), Zimbra SMTP command injection (CVE-2026-73570, Aug 21), and a TrueConf missing-authentication bug (CVE-2026-72529, Aug 20) alongside the code-injection TrueConf CVE from the same batch already covered. None are fresh news, but Gitea's hook-planting path is worth a second look if you accept external patches through its diffpatch API.

Context · BleepingComputer ·added 12:00 ET

North Korea's WaterPlum crew tied to 30,000 device compromises and $10.7M in stolen crypto since December

A joint law-enforcement advisory attributes WaterPlum, a North Korean group, to compromising at least 30,000 devices worldwide between December 2025 and July 2026 and laundering over $10.7 million in stolen cryptocurrency back to the DPRK. It's broad threat-intel rather than a specific package or dependency compromise, but the scale confirms North Korean crypto-theft operations are running at industrial volume, not isolated incidents. Worth knowing if you're threat-modeling crypto-adjacent infrastructure, even without a direct supply-chain vector named yet.

Context · The Hacker News ·added 12:00 ET

Transparent Tribe adds a Rust backdoor and four new tools, using private GitHub repos for C2 against India and Afghanistan

Zscaler ThreatLabz attributes a fresh campaign with new tools (RUSTYSHADE, RUSTYMOVE, PSNATCH, BASHNATCH) to Pakistan-aligned Transparent Tribe (APT36), targeting government and defense entities in India and Afghanistan and using private GitHub repositories for command-and-control. It's the second story on today's watch where a threat actor leans on GitHub-as-infrastructure rather than a public package registry — the CrowdSec/TanStack disclosure this morning was the first. If your org has any exposure in the targeted region, treat unexplained outbound traffic to GitHub raw-content endpoints as worth a second look, not automatically benign.

Context · Socket ·added 12:00 ET

Socket marks one year since Shai-Hulud's first appearance on npm

Socket's retrospective notes it's been a year since Shai-Hulud — the self-propagating npm worm that kicked off last year's wave of credential-stealing supply-chain campaigns — first appeared. No new activity reported; included here for continuity with today's GitHub-as-infrastructure theme rather than as a fresh incident.

06:00 ET · Morning Watch

Critical · GHSA ·added 06:00 ET

Mnemosyne — JWT signature verification bypass in sync server allows full authentication bypass

Mnemosyne's sync server accepts JWTs without properly verifying their signature, so an attacker can forge a token claiming to be any user and get full API access with no valid credentials. GHSA rates it critical because the exploit is trivial once you know the endpoint under-verifies tokens — no privileged access or social engineering required. Patch immediately and rotate any secrets the sync server has touched, since forged and legitimate sessions are indistinguishable after the fact.

Critical · GHSA ·added 06:00 ET

AnyIO — TLSStream's IDNA 2003 hostname encoding lets a lookalike domain pass certificate validation

AnyIO's TLSStream encodes hostnames using the outdated IDNA 2003 standard before certificate validation, so an attacker who registers a hostname that IDNA-2003-encodes to match a legitimate domain can present a certificate AnyIO accepts as valid — TLS spoofing via encoding mismatch. AnyIO underlies async networking for a large slice of the Python ecosystem, so the exposure is anything doing outbound TLS through it with hostname-based trust decisions. It shipped the same day as a second AnyIO bug (a supplementary-group leak in run_process/open_process, high) — patch both together.

Critical · GHSA ·added 06:00 ET

kcp — front-proxy fails to strip inbound identity headers, letting any client impersonate system:masters

kcp's front-proxy doesn't strip X-Remote-* identity headers on inbound requests, so any authenticated client can set its own X-Remote-Group header to system:masters and be treated as a cluster-admin-equivalent identity in any workspace. It's the same bug class as historical Kubernetes API-aggregation header-trust failures — proxies that trust client-supplied identity headers without controlling ingress are a recurring pattern, not a one-off mistake. If you run kcp as a multi-tenant Kubernetes-API-like control plane, patch now and check that nothing external can reach the front-proxy directly.

High · The Hacker News ·added 06:00 ET

CrowdSec discloses a 170-repo private GitHub breach traced back to May's TanStack npm attack

CrowdSec says an attacker copied roughly 170 of its private GitHub repositories in May, using a departed employee's laptop that had been compromised by May's TanStack npm supply-chain attack — and whose GitHub access the company had never revoked. The breach is four months old, but the disclosure is the useful part: it's a concrete, named example of a package-registry compromise turning into a source-code breach at a downstream security vendor, purely because offboarding lagged. If TanStack packages touched any developer machine in your org during that window, confirm departed employees' tokens and SSH keys from that period were actually rotated, not just their SSO account disabled.

High · GHSA ·added 06:00 ET

AnyIO — run_process/open_process ignores extra_groups, can retain the parent's full supplementary groups

AnyIO's process-spawning functions don't apply the extra_groups parameter correctly and can leave a spawned subprocess holding the parent's full supplementary group membership instead of the intended restricted set — a sandboxing failure for anything spawning subprocesses expecting reduced privileges. Paired with today's TLSStream cert-spoofing bug in the same library, it's a two-CVE day for AnyIO. Audit anywhere you rely on extra_groups to drop privileges before assuming the patch alone fixes your isolation.

High · GHSA ·added 06:00 ET

adm-zip — uncontrolled memory allocation from a zip's declared uncompressed size enables DoS

adm-zip trusts the uncompressed-size field declared in a zip's central directory and allocates memory accordingly before validating it against actual data, so a small malicious archive can claim a multi-gigabyte uncompressed size and force an out-of-memory crash. adm-zip is one of the most-downloaded zip libraries on npm, so anything unzipping user-supplied archives — CI artifact handling, file-upload processing — is potentially exposed. Patch, and if you can't immediately, cap archive processing with a memory limit as a stopgap.

High · GHSA ·added 06:00 ET

zot — bearer authentication maps DELETE requests to push scope, allowing unauthorized image deletion

zot's bearer-token authorization maps DELETE method requests to the push scope instead of a dedicated delete scope, so any token with push access to an OCI repository can delete images it should only be able to write to. zot is a CNCF sandbox OCI registry increasingly used as a lightweight registry — a scoping bug in a registry's own auth model undermines the assumption that push access doesn't imply destructive access, which is directly supply-chain relevant. Patch, and audit recent DELETE calls against push-scoped tokens for unexpected image removals.

High · GHSA ·added 06:00 ET

Convoy — cross-tenant IDOR leaks plaintext message-broker credentials

Convoy's source-ID lookup doesn't scope by tenant, so an authenticated user in one tenant can enumerate another tenant's source IDs and pull back their message-broker credentials in plaintext. It's a straightforward but severe multi-tenancy boundary failure — anyone running Convoy as a shared webhook/event gateway across multiple customers or teams should treat this as a credential-exposure incident until patched. Patch immediately and rotate any broker credentials Convoy has stored, since you can't rule out they were already enumerated.

High · GHSA ·added 06:00 ET

Perses — three same-day access-control bugs: path traversal, cross-scope secret disclosure, cross-project bypass

Perses, the CNCF dashboarding project positioned as a Grafana alternative, disclosed three separate authorization bugs at once: an unvalidated project parameter enabling filesystem path traversal (GHSA-vr5f-w35q-98jp), a datasource-proxy flaw disclosing secrets across project scopes (this one), and a project-query parameter bypass exposing cross-project resources (GHSA-cjgj-2fwf-4c2w). Three independent access-control failures in one release suggests the authorization layer needs a broader audit, not three point patches. If you run Perses multi-tenant, patch now and review datasource-proxy logs for cross-project secret access.

High · GHSA ·added 06:00 ET

Capsule — tenant owners can bypass forbidden namespace/label enforcement, one of three same-day multi-tenancy bugs

Capsule, the Kubernetes multi-tenancy operator, disclosed that tenant owners can bypass its forbidden namespace, service, and node label/annotation enforcement — defeating the isolation guarantees the operator exists to provide. It shipped alongside a stale-regex validation gap and a malformed-regex admission-webhook panic in the same enforcement path (GHSA-f94q-w3w8-cj67, GHSA-gxjc-74v5-3vx3), suggesting the regex-based policy engine needs re-review rather than three separate patches. If you rely on Capsule for tenant isolation, patch and re-verify forbidden-label policies are actually enforced post-patch.

High · GHSA ·added 06:00 ET

io.moquette:moquette-broker — missing authorization allows unauthorized MQTT operations

moquette-broker, a Java MQTT broker used in IoT and device-messaging stacks, has a missing-authorization issue letting clients perform operations they shouldn't be authorized for. Advisory detail is thin, but MQTT brokers sit at the center of device fleets, so an authorization gap there has outsized blast radius relative to its obscurity. Patch and review broker ACLs for any client performing operations outside its intended scope.

High · GHSA ·added 06:00 ET

Semantic MediaWiki — admin-API auth bypass headlines an eight-advisory disclosure batch

Semantic MediaWiki's smwtask API module is missing authorization, letting unauthenticated users trigger admin-only maintenance tasks; it's the most severe of eight advisories published together, the rest a spread of reflected-XSS and open-redirect bugs across Special:Ask, Special:SearchByProperty, and Special:URIResolver. Treat this as one mass-patch event for any wiki running the extension rather than eight separate incidents. Patch, and since maintenance tasks were unauthenticated, check job-queue logs for runs you didn't trigger.

Medium · GHSA ·added 06:00 ET

AnyCable — telemetry subsystem ships a hardcoded auth token and forwards CLI arguments, plus a signed-request replay gap

AnyCable's telemetry subsystem contains a hardcoded authentication token and forwards CLI arguments — potentially including secrets passed on the command line — to its telemetry endpoint; a second same-day advisory found the Pusher-compatible REST API doesn't verify request-body MD5, enabling replay of a previously-signed request with an arbitrary body (GHSA-5p54-whvp-x327). Neither is a full compromise alone, but together they're a reminder to check what a 'harmless' telemetry integration actually phones home. Patch both, and audit whether secrets have ever been passed via CLI args to AnyCable processes.

Context · CISA KEV ·added 06:00 ET

KEV backfill: seven edge/remote-access appliance CVEs from late Aug–early Sep surface in today's catalog pull

Today's 30-day KEV pull surfaced seven previously-uncaptured actively-exploited bugs in edge and remote-access gear, added between Aug 31 and Sep 11: Citrix NetScaler auth bypass (CVE-2026-19490), Cisco Firewall Management Center auth bypass (CVE-2026-20079), a SonicWall SMA1000 SSRF/command-injection pair (CVE-2026-83548 / CVE-2026-83549), two MikroTik RouterOS bugs (CVE-2026-86060 / CVE-2026-67277), and a ConnectWise ScreenConnect privilege-management flaw (CVE-2026-84869). These are backfill, not fresh news — check whether your fleet already remediated them under their original KEV due dates, and flag it if this pipeline's KEV coverage has a gap worth investigating, since none of these were caught on the days they were actually added.

Context · CISA KEV ·added 06:00 ET

KEV backfill: JFrog Artifactory, GitLab, and Adobe Commerce/Magento CVEs from Sep 8–11 surface late

The same backfill pull turned up five KEV adds touching dev-tooling and commerce infrastructure directly: two JFrog Artifactory authorization/authentication bugs (CVE-2026-42016, CVE-2026-42018), a GitLab CE/EE path traversal (CVE-2026-85706), an Adobe Commerce/Magento template-injection bug (CVE-2026-75650), and an N-able N-central static code injection (CVE-2026-86218) — all added to KEV between Sep 8 and Sep 11. Artifactory sits directly in build-and-release pipelines as an artifact repository, so prioritize that pair over the rest if unpatched. Confirm these were caught by your existing KEV-driven patch process, since their absence from this watch until today suggests they weren't.

Context · CISA KEV ·added 06:00 ET

KEV backfill: two PaperCut NG/MF bugs from Aug 31 — the same product line ransomware actors chained in 2023

CVE-2026-82078 (unsafe reflection) and CVE-2026-81578 (missing authentication) were added to KEV on Aug 31 and are only surfacing in this watch now. PaperCut NG/MF is the same print-management line that Cl0p and LockBit affiliates chained into ransomware deployments in 2023 via a near-identical RCE pattern, so 'it's just print management' skepticism isn't warranted. If you run PaperCut and haven't patched since Aug 31, prioritize this over the rest of today's backfill.

Context · CISA KEV ·added 06:00 ET

KEV backfill: nine older/EoL CVEs — including a pair from 2015 — surface from the Aug 26 and Sep 8–9 catalog batches

The rest of today's backfill spans two Windows bugs (link-following, heap overflow, both added Sep 8), a Fortinet heap overflow (CVE-2025-25249, Sep 9), a second TrueConf code-injection bug (CVE-2026-72530) from the same Aug 20 batch as an already-covered TrueConf auth issue, and five older CVEs CISA added on Aug 26 despite ages back to 2015: a SQL Server RCE (CVE-2019-1068), an Ajax.NET deserialization bug (CVE-2021-23758), two Red Hat bugs from 2015 (libuser race condition, ABRT privilege escalation), and a 2022 Linux kernel out-of-bounds write. The 2015-vintage entries are the more interesting signal — CISA adding decade-old CVEs to KEV means someone is still actively exploiting them, worth knowing even without a named campaign attached.