MCP source review: at least 16 unpatched CVEs in three days

01What happened

The source-review campaign that produced eight MCP CVEs on October 10 and 11, 2026 now has at least eight more, published October 10 to 12 by the same two researchers, hieuPenguinnn and Nguyen Dinh Hai of the Post and Telecommunication Institute of Technology. The second set moves past gateways and SDKs into application MCP servers, the mistral.rs inference server and the Phi agent runtime. Each new finding carries an NVD CVSS v4.0 score, a HackMD write-up and a VulnCheck advisory, and GitHub's advisory database lists every one as unreviewed with no patched version.

02How it works

Most of the second wave are authorization gates that an attacker or a prompt-injected agent reaches through a tool call: Tabularis treats side-effecting SELECT statements as read-only, Odoo MCP's execute_method returns fields the caller is denied, phpMyFAQ's faq_search skips group checks, and Trinity's Telegram router accepts agent-scoped MCP keys for owner-only binding. Two findings break an isolation boundary instead. In mistral.rs, the sandboxed shell child creates a relative symlink and names it as an output file, and the unsandboxed parent reads the target with std::fs::read, which follows the link. In Phi, agent_spawn passes a model-supplied working directory to a child whose permission gate is rooted at that directory instead of the parent workspace, so a spawned worker writes outside a parent set to read-only.

03Who is affected

Operators of the named projects are exposed, not MCP users in general, and the versions and CVEs are listed above. Both researchers reviewed source at pinned commits, and the newer write-ups record coordinated disclosure as still pending. Only the mistral.rs escape was reproduced, in a syscall-faithful mirror and a Rust harness on synthetic data, never against a live instance.

04What to do

Check whether any listed project runs at or below its affected version, and treat it as exposed until maintainers ship a release. Put MCP gateway OAuth2 endpoints and HTTP MCP servers behind network controls, and stop treating a server-side read-only or workspace-only setting as the boundary for an agent that reads untrusted content. Resolve symlinks before reading agent output files, and restrict permissions on any HTTP MCP file store in a shared temporary directory.

Questions people ask

Is there a patch for CVE-2026-108865 in Unla?

No patched version appears in the Unla advisory for CVE-2026-108865. GitHub names Unla through 0.10.0 as affected and lists the fixed version as unknown, and the researcher's write-up records coordinated disclosure as pending, offering fixes only as proposed diffs. Operators should restrict who can reach the gateway's OAuth2 endpoints until AmoyLab publishes a release.

Were these MCP flaws proven with a working exploit?

Almost none were. The Unla and Phi write-ups state the work was a static review of pinned commits, with no gateway built, no endpoint called and no runtime validation. The mistral.rs sandbox escape is the exception: its author reproduced the symlink read and write in a syscall-faithful mirror and a Rust harness on synthetic data, never against a live instance.

Which of the 16 MCP CVEs matters most to a defender?

CVE-2026-108865 in the Unla gateway still leads, because an unauthenticated caller can mint a token that reaches protected MCP prefixes, proxied upstream APIs and injected credentials. From the second wave, CVE-2026-108759 in mistral.rs scores highest at 7.6, letting sandboxed shell code read and overwrite host files, and CVE-2026-108595 in Phi lets a spawned sub-agent write outside a read-only parent workspace.

Sources 20 links, all fetched

1. 1vulncheck.comVulnCheck Unla
2. 2github.comUnla Advisory
3. 3hackmd.ioUnla Write-Up
4. 4github.comhyper-mcp Signature
5. 5github.comhyper-mcp TOCTOU
6. 6github.comMCP Kotlin SDK
7. 7github.commcp-go Advisory
8. 8github.commcp-remote Advisory
9. 9github.comargocd-mcp Advisory
10. 10github.com1MCP Agent Advisory
11. 11github.commistral.rs Advisory
12. 12hackmd.iomistral.rs Write-Up
13. 13github.comPhi Advisory
14. 14hackmd.ioPhi Write-Up
15. 15github.comTabularis Advisory
16. 16github.comOdoo MCP Advisory
17. 17github.comGenOffice Advisory
18. 18github.comTrinity Advisory
19. 19github.comWanwu Advisory
20. 20github.comphpMyFAQ Advisory