Argo CD MCP: unauthenticated cluster access
An investigation into the authentication boundary between an AI tool and the infrastructure it controls.
EnglishSecurity practitioners · Builders
Security / MCPTake a look
Security research
Security research.
Published vulnerability disclosures and software supply-chain investigations, with links to the original evidence.
Three starting points
Follow the evidence.
AI infrastructure, malware distribution, and an authentication bypass.
Never Deleted, Only Re-Pointed: Inside the 17,600-Repo FakeGit Fleet That Re-Arms Overnight
Following README link changes across the FakeGit software-supply-chain campaign.
EnglishSecurity practitioners · Builders
Security / Supply chainTake a look
PraisonAI: Missing API authentication / agents workflow access
CVE-2026-44338. Public maintainer advisory. Reporter credit may be shared with other researchers.
EnglishAI-curious · Builders
Security / AdvisoryOpen original
Campaigns & collaborative research
More investigations.
Original articles include the evidence, methods, and research-team credits.
Darkroom: malware hidden in a photo
Tracing npm dotenv look-alikes that concealed a PowerShell payload inside a JPEG.
EnglishSecurity practitioners · Builders
Security / Supply chainTake a look
The Paste That Runs the Fleet: Inside CheatSheet, a 1,000-Repo Malware Network
Investigating a malware distribution network spread across GitHub and GitLab.
EnglishSecurity practitioners · Builders
Security / AIOpen original
Finding 6 CVEs in Open-Source AI Tools with Apiiro AI-SAST
Collaborative research into vulnerabilities in open-source AI tools. The original article distinguishes each researcher’s findings.
EnglishSecurity practitioners · Builders
Security / AIOpen original
NanoClaw: path traversal outside the sandbox
Two filename-validation gaps in host-side attachment handling: an inbound write and an outbound read. The public writeup links both maintainer fixes.
EnglishSecurity practitioners · Builders
Security / AI agentsTake a look
Maintainer advisories
Public disclosures.
Published findings with reporter credit. Consolidated advisories may include other researchers.
Gitea: a public-only token creates private repositories
CVE-2026-118395. Missing scope enforcement on repository creation routes. Shared credit in the consolidated advisory.
MCP TypeScript SDK (@modelcontextprotocol/hono): HTTP body / JSON-RPC batch denial of service
Public maintainer advisory. Reporter credit may be shared with other researchers.
OpenMage: restricted-admin authorization bypass
Authorization gaps in sales and order operations. The advisory narrative credits shmulc8 for the reported cases.
Twenty: pending-invite takeover
An unauthenticated signup path exposed a pending invitation token. Public advisory credits shmulc8.
MCP Python SDK: request-body exhaustion
CVE-2026-109527. Unbounded HTTP and OAuth body reads. Consolidated advisory with shared reporter credit.
OpenMetadata: SAML login redirect leaks a JWT
An open redirect in the SAML login flow could expose a JWT to an external host. The public advisory credits my work account, shmulik-apiiro.
FlexGet: archive extraction outside the destination
A malicious archive processed by the decompress plugin could escape the extraction directory and lead to code execution. The maintainer advisory credits shmulc8.
Bazarr: Windows PWA path traversal
An unauthenticated arbitrary-file-read issue on Windows. Public advisory credits shmulc8.
MCP Java SDK: request-body exhaustion
CVE-2026-108395. Unbounded body reads in HTTP transports. Consolidated advisory with shared reporter credit.
n8n: SQL injection in MySQL node
CVE-2026-59257. Public maintainer advisory. Reporter credit may be shared with other researchers.
Parse Server: Unauthenticated regular-expression DoS
CVE-2026-47138. Public maintainer advisory. Reporter credit may be shared with other researchers.
PraisonAI: Injection via SQL/CQL collection names
CVE-2026-44337. Public maintainer advisory. Reporter credit may be shared with other researchers.
PraisonAI: Missing API authentication / agents workflow access
CVE-2026-44338. Public maintainer advisory. Reporter credit may be shared with other researchers.
PraisonAI: Unsafe callable resolution / tool execution
CVE-2026-44339. Public maintainer advisory. Reporter credit may be shared with other researchers.
open-webSearch: SSRF / private IP filter bypass
CVE-2026-42260. Public maintainer advisory. Reporter credit may be shared with other researchers.
pyload-ng: Authorization flaw allowing TLS verification to be turned off
CVE-2026-42312. Public maintainer advisory. Reporter credit may be shared with other researchers.
pyload-ng: SSRF / proxy configuration
CVE-2026-42313. Public maintainer advisory. Reporter credit may be shared with other researchers.