Security Digest: September 23, 2026 - 24 Critical Vulnerabilities

Today’s wave is dominated by remote file read/exfiltration, authorization bypasses, and command injection in tools many teams expose to users or automation. The most urgent risk is to patch internet-facing MCP, KubeEdge, and LightRAG deployments immediately, then verify no exposed instance is still running vulnerable versions.

· 16 min read

Executive Summary

Today’s wave is dominated by remote file read/exfiltration, authorization bypasses, and command injection in tools many teams expose to users or automation. The most urgent risk is to patch internet-facing MCP, KubeEdge, and LightRAG deployments immediately, then verify no exposed instance is still running vulnerable versions.

Several issues are especially dangerous because they require no admin rights or can be triggered over a network with minimal access. Treat the attachment-upload flaws in mcp-atlassian, the auth bypasses in tinyauth and deepstream, and the KubeEdge command-injection bugs as same-day fixes.

Critical Vulnerabilities

  • CVE-2026-85734: LightRAG login brute-force weakness
    • Impact: Unlimited password guessing against /login can lead to full account takeover.
    • Affected Systems: pip lightrag-hku
    • Immediate Action: Restrict access to the login endpoint now; place rate limiting in front of the service and rotate any exposed credentials.
    • Mitigation: Patch as soon as a fixed release is available; add lockout, throttling, and CAPTCHA at the edge.
  • CVE-2026-62371: KubeEdge NodeUpgradeJob command injection
    • Impact: Authenticated users can inject shell commands on edge nodes during upgrades.
    • Affected Systems: KubeEdge v1.23.0 and earlier branches prior to v1.23.1 / v1.22.2 / v1.21.2
    • Immediate Action: Freeze NodeUpgradeJob use and restrict who can create or edit these resources.
    • Mitigation: Upgrade to the fixed KubeEdge release; remove shell-based upgrade workflows.
  • CVE-2026-63116: deepstream PATCH_MULTI permission bypass
    • Impact: Any authenticated user can overwrite arbitrary records, including protected data.
    • Affected Systems: npm @deepstream/server
    • Immediate Action: Disable or firewall PATCH_MULTI usage if you rely on Valve permissions.
    • Mitigation: Patch to a version that registers PATCH_MULTI correctly in the rule map.
  • CVE-2026-62182: KubeEdge ConfigUpdateJob command injection
    • Impact: Authenticated attackers can run arbitrary commands on edge nodes through update jobs.
    • Affected Systems: KubeEdge v1.23.0 and earlier branches prior to v1.23.1 / v1.22.2 / v1.21.2
    • Immediate Action: Pause ConfigUpdateJob use and review RBAC for job creation.
    • Mitigation: Upgrade promptly; do not pass user-controlled values into shell commands.
  • CVE-2026-77243: mcp-atlassian tool-list bypass
    • Impact: Users can invoke tools that were intentionally hidden by ENABLED_TOOLS or TOOLSETS.
    • Affected Systems: pip mcp-atlassian
    • Immediate Action: Assume tool filtering is ineffective on exposed HTTP deployments and restrict network access now.
    • Mitigation: Patch and verify tool-call authorization is enforced at call time, not just list time.
  • CVE-2026-77248: mcp-atlassian unauthenticated file read via attachment upload
    • Impact: Remote attackers can read host files and exfiltrate secrets through attachment uploads.
    • Affected Systems: pip mcp-atlassian in streamable-http mode
    • Immediate Action: Take exposed instances offline or block them at the network edge immediately.
    • Mitigation: Require authentication by default and validate all file paths before upload.
  • CVE-2026-76819: Nuclei Goja JavaScript RCE
    • Impact: Malicious JavaScript templates can execute native code on the scanner host.
    • Affected Systems: go github.com/projectdiscovery/nuclei/v3
    • Immediate Action: Stop running untrusted templates and upgrade Nuclei immediately.
    • Mitigation: Move to v3.10.0+; v3.11.0 adds stronger template signing for JavaScript.
  • CVE-2026-77255: mcp-atlassian arbitrary file read via update_issue attachments
    • Impact: Agents can force the server to upload sensitive local files to Jira.
    • Affected Systems: pip mcp-atlassian
    • Immediate Action: Disable attachment-based issue updates until fixed.
    • Mitigation: Validate paths and restrict uploads to a safe workspace.
  • CVE-2026-77262: mcp-atlassian Confluence upload path traversal
    • Impact: Unauthenticated attackers can read arbitrary server files and send them to Confluence.
    • Affected Systems: pip mcp-atlassian
    • Immediate Action: Block external access to the MCP endpoint and remove exposed credentials from hosts.
    • Mitigation: Add path allowlisting to upload handlers; patch once available.
  • CVE-2026-77560: tinyauth host-case authorization bypass
    • Impact: Authenticated users can reach apps they are not allowed to access by changing host casing.
    • Affected Systems: go github.com/tinyauthapp/tinyauth prior to 5.1.2
    • Immediate Action: Normalize hostnames at the proxy and treat mixed-case requests as suspicious now.
    • Mitigation: Upgrade to 5.1.2 and verify ACL checks fail closed on lookup misses.
  • CVE-2026-62369: KubeEdge keadm archive traversal
    • Impact: Crafted archives can write files outside the intended extraction directory.
    • Affected Systems: KubeEdge keadm in maintained branches before the fixed releases
    • Immediate Action: Stop using untrusted component archives and verify download integrity.
    • Mitigation: Upgrade to the patched release with secure extraction logic.
  • CVE-2026-77259: mcp-atlassian Confluence upload file read
    • Impact: Any authenticated client can upload arbitrary local files and leak their contents.
    • Affected Systems: pip mcp-atlassian
    • Immediate Action: Restrict write-tool access and inspect exposed MCP instances for abuse.
    • Mitigation: Add validate_safe_path() to upload paths and patch immediately.
  • CVE-2026-77258: mcp-atlassian upload_attachment missing path checks
    • Impact: Local files can be read and exfiltrated via Confluence attachment uploads.
    • Affected Systems: pip mcp-atlassian
    • Immediate Action: Disable attachment upload tools if the server is reachable by untrusted users.
    • Mitigation: Enforce safe-path validation before any file open.
  • CVE-2026-61570: MPXJ XML entity expansion / file read
    • Impact: Crafted project files can trigger arbitrary file reads during parsing.
    • Affected Systems: MPXJ across Maven, RubyGems, NuGet, and pip packages listed in the advisory
    • Immediate Action: Stop processing untrusted Merlin project files.
    • Mitigation: Upgrade to MPXJ 16.4.1 or later.
  • CVE-2026-59991: psd-tools memory exhaustion
    • Impact: Tiny crafted PSDs can force multi-gigabyte allocations and crash services.
    • Affected Systems: pip psd-tools
    • Immediate Action: Block untrusted PSD uploads and cap image-processing memory use.
    • Mitigation: Validate dimensions before allocation; patch when available.
  • CVE-2026-62985: request-filtering-agent crash on private IPs
    • Impact: A single request to a literal private IP can crash Node.js services.
    • Affected Systems: npm request-filtering-agent <= 3.2.0
    • Immediate Action: Replace or wrap the agent in exposed services.
    • Mitigation: Upgrade and ensure errors are emitted asynchronously.
  • CVE-2026-77322: sipgo WebSocket frame allocation crash
    • Impact: A crafted WebSocket frame can cause panic or memory exhaustion.
    • Affected Systems: go github.com/emiago/sipgo
    • Immediate Action: Rate-limit and isolate SIP WebSocket endpoints immediately.
    • Mitigation: Set frame-size limits and upgrade to a fixed version.
  • CVE-2026-58268: sipgo stream parser allocation bug
    • Impact: Oversized Content-Length values can trigger unauthenticated DoS.
    • Affected Systems: go github.com/emiago/sipgo
    • Immediate Action: Block untrusted SIP traffic or enforce a strict proxy limit now.
    • Mitigation: Validate Content-Length before allocation and patch.
  • CVE-2026-77246: mcp-atlassian header-driven file exfiltration
    • Impact: Unauthenticated attackers can redirect uploads and steal arbitrary files from the server.
    • Affected Systems: pip mcp-atlassian in HTTP transport mode
    • Immediate Action: Remove public exposure and audit for leaked Atlassian tokens and host secrets.
    • Mitigation: Require auth, tighten SSRF controls, and validate upload paths.
  • CVE-2026-77633: Cloudreve quota race
    • Impact: Concurrent uploads can bypass storage quotas and fill disks.
    • Affected Systems: go github.com/cloudreve/Cloudreve/v4
    • Immediate Action: Watch for sudden quota spikes and suspend suspicious upload bursts.
    • Mitigation: Patch to a version that performs atomic quota checks and updates.
  • CVE-2026-94462: Spree cart associate IDOR
    • Impact: Authenticated users can take over guest carts and read checkout PII.
    • Affected Systems: rubygems spree_api
    • Immediate Action: Restrict guest-cart association endpoints and monitor for cart enumeration.
    • Mitigation: Upgrade to Spree 5.4.4 or 5.5.4.
  • CVE-2026-85740: LightRAG NAT64 SSRF bypass
    • Impact: Markdown image downloads can reach internal hosts and metadata services.
    • Affected Systems: pip lightrag-hku <= 1.5.4
    • Immediate Action: Disable native markdown image downloads on exposed systems now.
    • Mitigation: Upgrade to 1.5.5 and verify NAT64/IPv6 transition wrappers are blocked.
  • CVE-2026-77261: mcp-atlassian redirect SSRF bypass
    • Impact: Redirects to internal IPs are followed in common auth modes, enabling SSRF.
    • Affected Systems: pip mcp-atlassian
    • Immediate Action: Treat Atlassian-connected MCP instances as SSRF-sensitive until patched.
    • Mitigation: Apply the missing redirect hook to basic auth and OAuth branches.

Previously Alerted

These CVEs were already covered in prior digests or alerts; do not re-summarize them, but keep them on your tracking list:

What to Do Now

  1. Patch exposed services first: mcp-atlassian, KubeEdge, LightRAG, tinyauth, deepstream, Nuclei, sipgo, Cloudreve, and Spree.
  2. Reduce exposure immediately: firewall or disable public access to MCP, SIP, and job-management endpoints until fixes are deployed.
  3. Assume file exposure where upload tools are present: rotate Atlassian tokens, cloud credentials, SSH keys, and any secrets stored on affected hosts.
  4. Verify versions and configuration: confirm patched releases are running and that rate limiting, auth, and path validation are actually enforced.
  5. Watch for abuse: look for unusual login bursts, unexpected attachment uploads, mixed-case host requests, and suspicious job creation or upgrade activity.

Verification steps: inventory all internet-facing instances, compare installed versions with the affected ranges above, and test whether tool filters, ACLs, and redirect protections still fail open. For MCP services, confirm no unauthenticated client can call write tools or upload arbitrary file paths.

Monitoring recommendations: alert on spikes in 401/403 responses, repeated login attempts, new NodeUpgradeJob/ConfigUpdateJob objects, unexpected outbound requests from scanners and MCP servers, and any attachment upload to attacker-controlled endpoints.

Related Resources

  • Internal blog post: Coming soon — “How to secure MCP servers before attackers turn tools into exfiltration paths.”
  • Internal blog post: Coming soon — “Why auth bypasses in shared automation platforms spread faster than RCEs.”
  • Official vendor advisories: KubeEdge, ProjectDiscovery Nuclei, tinyauth, Cloudreve, Spree, and the mcp-atlassian GitHub advisories linked above.

Keep reading