A house newsletter · daily · researched and written by the Kurzia AI
Tuesday 10 November 2026 · Issue 10 · 4 min read
GPUStack admin bypass exploited in the wild; malicious Markdown MCP packages; SSHole breaches now confirmed
Act on this first
GitHub Advisory Database · today
GPUStack
Takeaway: CVSS 9.8
GPUStack, the open-source platform for serving AI models on GPU clusters, treats any request that appears to come from localhost as the built-in administrator. A same-host reverse proxy — the standard self-hosted setup — makes every remote request look like 127.0.0.1, and a forged X-GPUStack-Real-IP header does the same job with no proxy at all. The advisory records real intrusions against a v2.1.1 deployment, where the attackers added custom inference backends that ran reverse shells. Move to 2.2.0, which removes the loopback auto-admin path; until then set force_auth_localhost=true and strip the X-GPUStack-Real-IP header at your edge.
This is a full unauthenticated admin takeover of a model-serving stack, rated critical at CVSS 9.8 (CVE-2026-102895), and it is already being exploited in the wild — not a theoretical default misconfiguration. Check first for admin API keys you did not create: with admin access an intruder can mint keys with scope ["*"] that stay valid from any IP, and read worker credentials and cloud provider secrets.
Read it at GitHub Advisory Database
Affected: < 2.2.0 · Fixed in: 2.2.0 · Disclosed 9 Nov · Under attack since 9 Nov · We had it 9 Nov, 23:06 UTC
“Trusting the network source of a request (socket peer, or a client-controllable header) as an authentication signal.”
Under attack
OpenSSH 'SSHole' — musl-based Linux (Alpine, OpenWrt, Yocto) — an oversized password logs into '*'-locked accounts, up to root; successful exploitation now confirmed by several firms, including root takeovers; fix: 10.6p2 or disable password logins; CVE-2026-123158.
SonicWall SonicOS — authentication-reinforcement flaw that lets attackers bypass multi-factor logins; CISA has added it to its exploited-vulnerabilities catalogue after reports of possible real-world attacks; affected builds and fixes per SonicWall's advisory; CVE-2026-19868, CVSS 7.1/7.5.
Plex Media Server on QNAP NAS — the four-flaw 'Plex2Shell' chain yields unauthenticated code execution as the Plex service; QTS itself is unaffected; update to Plex 1.43.3 or later and rotate NAS and Plex passwords; CVEs-2026-96652/54/55/56.
Holes in AI tools
GitHub (thisisme6598) · yesterday
Gemini Workspace extensions
Takeaway: without any @Drive or @Gmail mention
A GitHub write-up argues that Google has quietly reversed its 2023 promise that personal Gmail, Docs and Drive content connected to Gemini is never seen by human reviewers: Google's own updated help answer and a blogpost edit now say connected mail and files flow into human-review pipelines, and warn users not to connect apps holding anything confidential. The author's testing shows the pull happens without any @Drive or @Gmail mention, though which of four outcomes you get is probabilistic.
If staff at your shop connect Workspace accounts to consumer Gemini, mail and documents can land in a chat session a human contractor may read — and the repo argues Google's automatic scrubbers cannot de-identify narrative data like account numbers and confirmation codes. Across repeated trials on a single ISP-bill email, the author observed every outcome from a generic summary to a full text dump including the message headers.
Hacker News · yesterday
ChatGPT Desktop
Takeaway: closed and never merged
A Hacker News submitter claims ChatGPT Desktop forwards the local SSH agent to remote machines, so an agent running remotely can authenticate with your local SSH keys — pushing to private GitHub repos, for instance — and cites a pull request on the OpenAI Codex repository as proof. Unconfirmed: commenters point out the cited PR was closed and never merged, and the thread argues over what it actually demonstrates.
Worth a defensive look regardless of the claim's fate: agent forwarding hands a remote box the power to sign in as you, and the thread's suggested guard is to disable ForwardAgent by default in ~/.ssh/config and use keys that demand a touch or fingerprint per use, such as a YubiKey or the macOS secure enclave. The discussion drew 202 points and 68 comments.
The Record · yesterday
Mittwald mStudio MCP server
Takeaway: 56 customer projects
Mittwald, a German web host, says intruders compromised 56 customer projects after exploiting a flaw in the MCP server that lets customers attach AI assistants to its mStudio platform, then went undetected for eight days. Managing director Robert Meyer calls the attack AI-assisted, saying the logs show seconds between steps — but the company offered no other evidence, and it remains unclear whether the flaw was in Mittwald's own code or in open-source MCP libraries.
This is one of the first vendor-disclosed breaches entering through an MCP endpoint, and a reminder that assistant-integration surfaces need the same review as any internet-reachable API. Mittwald promises a detailed account once its analysis finishes. The entry came amid the October scramble to patch PHP2Shell; Meyer says the attacker disguised the access attempts with diversionary tactics.
“First the PHP2Shell vulnerability, now the attack on our systems. AI attacks will become more frequent in the future”
Knostic · yesterday
@ifasn/mmdd-doc-mcp and @ifasn/ms-doc-mcp
The first starts collecting process data the moment the server launches — no tool call needed — and tries to send a report over plain HTTP to a hardcoded IP, keeping the first 200 characters of any command line containing markers like password or secret. The second records the full values of environment variables whose names look like credentials and writes them to a local file. No victims or successful delivery are confirmed.
MCP servers get installed from npm with little scrutiny, and these show the review has to reach the code, not the package description — the first package's file header explicitly claims no network reporting while its code beacons. Knostic publishes indicators to hunt for: the request path /beacon?stage=deepaudit and the local file output/env_audit.txt.
Found or caused by AI
FORGE Lab / Hyenas — Microsoft's FORGE Lab used an AI-driven vulnerability-scanning system — a research build codenamed Hyenas under 'MDASH' — to find memory-safety bugs in Rust's standard library, including soundness holes reachable from entirely safe Rust code, and filed reports to the Rust issue tracker. The write-up groups the causes into three habits of misplaced trust inside unsafe blocks: assuming callees will not panic, trusting user-supplied trait implementations, and trusting the underlying system. Rust now sits under a growing share of the stack your own code runs on — the Linux kernel, Android, Cloudflare, GitHub's Copilot agent runtime — so std-level soundness bugs ripple far beyond one crate, and this shows AI-assisted auditing reaching the hardest unsafe-code corners. Two of the reported issues remain open; one, in the signal-stack handling around process::exit, had been in the standard library for nearly eleven years.
Google DeepMind — DeepMind, working with cryptographers from UC San Diego and Inria, reports that AI agents under human supervision found two ways to make attacking 1024-bit RSA cheaper than assumed: a signature-forgery route against PKCS#1 v1.5 padding, where an attacker controlling roughly half of the signed block gains no protection from padding at all, and a batch-factoring algorithm estimated to make each extra RSA-1024 key about 30 times cheaper to break — the latter still theoretical and not implemented. DeepMind's Pushmeet Kohli stresses the results touch only obsolete 1024-bit RSA, and modern protocols on 2048-bit-or-larger keys remain secure. The signal is the method: cryptographic hardness is now something agents can stress-test, so retire any lingering RSA-1024. Replaying a known forgery attack against a single RSA-1024 key, the agents steered the computation to completion in less than four days, checking in with their human supervisor roughly twenty times, and needed 391 CPU core-years against the 1,380 the original study spent.
Project Glasswing — VulnCheck's seven-month audit of Anthropic's Project Glasswing counts 442 CVEs credited to Anthropic — about half a percent of all CVEs published this year — with only two seen exploited in the wild. The ledger has swollen to 37,966 findings with just 217 marked fixed, and in the two months since VulnCheck's last update roughly 12,000 findings arrived while only 15 more were closed out; duplicates climbed to about 1,654. The practical read for patching teams: AI-found bug volume is real but mostly low-yield, and the triage cost lands on maintainers — curl, sent a batch of Glasswing reports, marked 19 of the first 34 published ones as not vulnerabilities at all, with the six confirmed findings all rated low. Prioritise AI-reported CVEs by maintainer confirmation, not by the finder's severity. Anthropic says its newer OSS Scanner reports go out to participating projects fully model-generated, with no human review or triage.
Patches worth knowing
@anthropic-ai/claude-code — below 2.1.251 — an Edit-tool race let sandboxed code on macOS overwrite files outside the workspace via a swapped symlink; fixed in 2.1.251; CVE-2026-88968, high 7.7.
Affected: < 2.1.251 · Fixed in: 2.1.251 · Disclosed 9 Nov · We had it 9 Nov, 23:06 UTC
Kubeflow Pipelines — releases through 2.17.3 — upload endpoints skip authorization on shared pipelines, so a low-privilege tenant can retarget what other tenants execute; fixed 2.18.0; CVE-2026-77596, critical 9.6.
Affected: <= 2.17.3 · Fixed in: 2.18.0 · Disclosed 9 Nov · We had it 9 Nov, 23:06 UTC
code-graph-rag — 0.0.586 and below — structural_search and structural_replace follow out-of-root symlinks, reading and overwriting files outside the project root over MCP; fixed 0.0.587; CVE-2026-87008, high 7.1.
Affected: <= 0.0.586 · Fixed in: 0.0.587 · Disclosed 9 Nov · We had it 9 Nov, 23:06 UTC
code-graph-rag read_file — below 0.0.345 — the paginated read_file MCP tool accepts absolute paths, returning any readable file over unauthenticated HTTP bound to all interfaces; fixed 0.0.345; CVE-2026-77604, high.
Affected: < 0.0.345 · Fixed in: 0.0.345 · Disclosed 9 Nov · We had it 9 Nov, 23:06 UTC
@tsparticles/mcp-server — below 4.3.2 — one shared HTTP transport means the first anonymous MCP client locks out all later sessions until restart; fixed 4.3.2; CVE-2026-76893, moderate 6.9.
Affected: < 4.3.2 · Fixed in: 4.3.2 · Disclosed 9 Nov · We had it 9 Nov, 23:06 UTC
fast-agent-mcp — 0.7.20 and below — serve mode binds all interfaces with no authentication, and with --shell any reachable client gets remote command execution; fixed 0.7.21; CVE-2026-102610, 6.4.
Affected: <= 0.7.20 · Fixed in: 0.7.21 · Disclosed 9 Nov · We had it 9 Nov, 23:06 UTC
One thing to do
Check your code-graph-rag version and its bind address. If code-graph-rag runs anywhere as an MCP server, run pip show code-graph-rag (or pip list | grep code-graph-rag) this week. Anything at 0.0.586 or below still carries the symlink read-write escape, and anything below 0.0.345 the unauthenticated file-read hole. Its HTTP transport listens on every interface by default, so unless you deliberately exposed it, keep the server on loopback behind authentication and upgrade to 0.0.587 or newer. GitHub Advisory Database