AI security researcher

Owen Park

Articles: 62
Desks: 2

Covers AI application security, model risk, and agentic system abuse.

ai-securityresearchapplication-security

Coverage by Owen Park

Data graphic: Dot plot of five MCP CVEs from 11 to 15 October 2026 by NVD CVSS. NetLicensing MCP secrets exposure scores 9.6 and needs only a non-admin API key; Unla gateway access 8.2; mac-shell-mcp code execution 7.8; two MCP Python SDK downtime bugs 7.5 and 6.9 the 6.9 under CVSS 4.0 .

Three MCP servers and the Python SDK shipped holes this week: here is what each hands an attacker

Five MCP CVEs in one week, sorted by what they give an attacker: secrets (NetLicensing, 9.6), access (Unla), code execution (mac-shell-mcp) and downtime (Python SDK).

Oct 18 · 4 min

Data graphic: Nginx UI's REST API and MCP tool compared on writing nginx config CVSS 8.8 High, CVE-2026-84318 and CVE-2026-84317 . The REST path checks the directive denylist and requires the OTP step-up, so it rejects the config. The MCP tool nginx_config_add skips both checks, and the config is written and reloaded. An attacker needs a valid login with MCP enabled; the fix is in Nginx UI 2.4.1.

highAI Security NGINX

Nginx UI's MCP tools skipped the config checks its web UI enforces, handing logged-in users nginx code execution

Four CVEs show Nginx UI's MCP tool wrote nginx config without the validation and OTP step-up its REST API applies. Fixed in 2.4.1; upgrade to the current release.

Oct 18 · 4 min

Data graphic: vLLM v0.32.0 at the centre of a diagram, with arrows out to the three denial-of-service fixes it ships PRs #50300, #59491 and #51504 and to its four breaking changes: CORS closed by default, Python 3.11 minimum, pinned Transformers and cascade attention removed. About 340 peers were enough to exhaust the 1023-socket limit; the tokenizer advisory is rated moderate.

elevatedAI Security Vllm Serving

vLLM 0.32 upgrade notes: three denial-of-service fixes, CORS closed by default, Python 3.10 dropped

vLLM v0.32.0 fixes three API-reachable denial-of-service flaws and ships four breaking changes: no CORS by default, Python 3.11, pinned Transformers.

Oct 18 · 3 min

Data graphic: A new Metasploit module turns CVE-2026-42249, a path traversal in Ollama's Windows auto-updater, into persistence, rated CVSS 4.0 7.7 High by CERT Polska. It needs an existing session on the target, auto-update is on by default, and Ollama has not confirmed a fix.

elevatedAI Security Ollama

Metasploit now ships a persistence module for Ollama's Windows auto-updater

CVE-2026-42249, a path traversal in Ollama for Windows' updater, now has a Metasploit persistence module. No fix is confirmed; turn off auto-update.

Oct 18 · 3 min

Data graphic: Junie CLI and ZCode both started MCP servers declared in an untrusted cloned repo, so opening a project runs code as the developer CVSS 7.8 High, both CVEs . The attack path runs from git clone to open, a repo-local MCP stdio config, the agent starting the server on open, and code running as the developer. Junie CLI CVE-2026-111091 is fixed in 26.8.3; ZCode CVE-2026-88755 has no known fix.

elevatedAI Security Cve 2026 111091

Two coding agents, one mistake: Junie CLI and ZCode both ran MCP servers from untrusted repos

JetBrains Junie CLI and Z.ai's ZCode started MCP servers declared in cloned repos, so opening a project could run code. Junie is fixed; ZCode is not.

Oct 18 · 4 min

CVSS 9.2 poster: Claude Agent SDK for Python flaw CVE-2026-96620, fixed in 0.2.121

highAI Security Cve 2026 96620

Claude Agent SDK for Python flaw lets a crafted session ID run commands (CVE-2026-96620)

CVE-2026-96620 (CVSS 4.0 9.2) lets an untrusted session ID passed to resume in claude-agent-sdk before 0.2.121 run commands. Fixed in July; no exploitation reported.

Oct 16 · 6 min

Poster: forged admin token via default JWT key in IBM MCP Context Forge, CVE-2026-53709, CVSS 9.8

highAI Security Cve 2026 53709

IBM MCP Context Forge's Default JWT Key Let Anyone Forge Admin Tokens (CVE-2026-53709)

MCP Context Forge up to 1.0.1 shipped a known default JWT signing key. With default admin settings, an unauthenticated attacker could gain platform admin. CVSS 9.8; fixed in 1.0.2.

Oct 14 · 7 min

Data graphic: a CVSS 9.8 stamp for two unauthenticated Langflow code-execution flaws among 25 fixed in 1.12.3

criticalAI Security Langflow

Langflow 1.12.3 Fixes 25 Flaws, Including Two Unauthenticated CVSS 9.8 Code-Execution Bugs

IBM's 2 October bulletin covers 25 Langflow CVEs, two of them unauthenticated 9.8 RCEs. Every release through 1.12.2 is affected; there is no workaround.

Oct 14 · 3 min