Tag archive

Cve 2026 103758

Coverage tagged cve 2026 103758.

Data graphic: a charcoal cover with a large red 8.6 for CVSS v4.0 High 8.1 under CVSS v3.1 and an ACR BYPASS stamp. The headline reads: Any login opens restricted MCP servers CVE-2026-103758 . Obot 0.21.1 to 0.24.1 is affected, v0.25.0 is the fix per Obot release notes, and no exploitation has been reported.

Cve 2026 103758 AI Security

Obot MCP Gateway Flaw CVE-2026-103758 Lets Basic Users Reach Restricted MCP Servers

Obot 0.21.1–0.24.1 skips its ACR check on the composite MCP route, so any signed-in user can reach restricted servers. Obot says v0.25.0 fixes it.

Related desks

AI Security

Latest

Oct 2, 2026, 5:20 PM EDT · AI Security · Cve 2026 909707 minGitLab AI Gateway Flaw CVE-2026-90970 Lets Duo Agent Users Run Commands on Self-Hosted Gateways

GitLab fixed a CVSS 9.9 prompt-template sandbox escape in its AI Gateway. Self-hosted gateways must move to 19.2.4, 19.3.2 or 19.4.1.

Oct 2, 2026, 5:02 PM EDT · AI Security · Cve 2026 1037585 minObot MCP Gateway Flaw CVE-2026-103758 Lets Basic Users Reach Restricted MCP Servers

Obot 0.21.1–0.24.1 skips its ACR check on the composite MCP route, so any signed-in user can reach restricted servers. Obot says v0.25.0 fixes it.

Oct 2, 2026, 4:54 PM EDT · Exploits · Cve 2026 944865 minNext.js Dev Server MCP Flaw CVE-2026-94486 Lets Malicious Sites Read Source Snippets and Logs

Next.js 16's next dev MCP endpoint skipped origin checks, letting a visited site read disk paths, source snippets, routes and logs. Low severity; fixed in 16.3.8.

Oct 2, 2026, 3:31 PM EDT · Exploits · Local Privilege Escalation5 minWindows Cross Device flaw gives local users SYSTEM, with a public PoC

Project Zero's Forshaw details CVE-2026-66804, an incomplete fix for the Dark Elevator bug. A working exploit is public; August 2026 updates fix it.