State of MCP security — October 2026

Most-affected servers

Advisories published in October

• GHSA-2gpf-2492-q9jhHIGH PraisonAI — PraisonAI: Call API localhost-only authentication bypass via spoofed Host header
• GHSA-4r3p-w3mc-5v34MODERATE PraisonAI — PraisonAI: Prompt-injection defense blocks only when 3+ detector families fire simultaneously; realistic single-vector injections pass through unblocked
• GHSA-4w49-gwv8-fpjgHIGH PraisonAI — PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF
• GHSA-5r6c-gj4g-r697HIGH PraisonAI — PraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backend
• GHSA-79fv-7hq9-w7xgHIGH PraisonAI — PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source
• GHSA-7c92-x8vg-4258HIGH PraisonAI — PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents
• GHSA-9mp3-24cc-77mgCRITICAL PraisonAI — PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls
• GHSA-cv3g-hj65-pcfhHIGH PraisonAI — PraisonAI: Shell command allowlist bypass via find -exec built-in action
• GHSA-fj8f-m44g-c479HIGH PraisonAI — PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats
• GHSA-g6j7-pffp-8whgCRITICAL PraisonAI — PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation
• GHSA-hc5v-gxvj-58whHIGH PraisonAI — PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface
• GHSA-q7m5-3jmv-vm48MODERATE PraisonAI — PraisonAI: ContextGatherer include resolution permits absolute and traversal reads outside the workspace
• GHSA-qj9c-59p6-8cgxHIGH PraisonAI — PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing
• GHSA-wf65-4jjx-q444MODERATE PraisonAI — PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL
• GHSA-xpx6-x8c2-mw5wMODERATE PraisonAI — PraisonAI: Project custom command templates can read outside-workspace files into model prompts

Notable changes

• 2026-10-18 Archived OpenAdapt: your agent decides, OpenAdapt enters it and checks it saved — Repository OpenAdaptAI/openadapt-agent was archived
• 2026-10-18 Score drop OpenAdapt: your agent decides, OpenAdapt enters it and checks it saved — Score dropped 93 → 73

2 alert(s) this month. See all alerts.

Licenses

MIT (336) · Apache-2.0 (81) · none detected (34) · AGPL-3.0 (20) · no repo linked (19) · unknown (5) · BSD-3-Clause (2) · GPL-3.0 (1) · ISC (1) · CC-BY-SA-4.0 (1)