Twenty-five agent CVEs in two days, from one researcher

On 10 October 2026 NVD published seven CVEs in about four hours, from CVE-2026-108115 at 15:16 UTC to CVE-2026-108600 at 19:16, every one of them in AI agent or MCP software and every one credited to the same researcher, HaiND (Nguyen Dinh Hai), disclosed through VulnCheck with a public writeup pinned to exact source lines. The seven were Kortix Suna, zotero-mcp, the official Argo CD MCP server, 1MCP Agent, mini-swe-agent, Phi, and open-multi-agent. As of the same day, six of the seven had no published fix.

The next day NVD published 68 CVEs from the same researcher and the same channel, their IDs running nearly contiguously from CVE-2026-108688 to CVE-2026-108760 and clustered around 13:17 UTC. Eighteen were in agent or MCP software. Together with the first day's seven, that is twenty-five agent or MCP CVEs in two days from one researcher, and the individual scores run from CVSS 2.3 on the first day to a 9.4 on the second. Each writeup again pins the flaw to exact source lines, so the batch is checkable claim by claim.

Read as a batch the disclosures are not twenty-five unrelated bugs. Both days describe a catalogue of one failure repeating: a trust boundary the framework drew, and a second path around it that nobody enforced. On the first day three shapes recurred. Four of the seven were reachable by design through prompt injection, because the zotero-mcp, Argo CD MCP, Phi, and mini-swe-agent writeups each describe untrusted content steering the model into a legitimate tool call with attacker-influenced arguments, so the tool itself is the vulnerability's delivery mechanism. Three were authorization checks that verified the wrong thing: 1MCP checked which tags a filter named rather than which backends it selected, Argo CD MCP checked nothing about where the final normalized path landed, and Phi checked the spawn action's category rather than the workspace it created. And the guards the projects needed already existed nearby, one sink short. zotero-mcp's PDF path carried the SSRF guard its webpage path lacked. Suna's private-address check handled two of the three IPv4-in-IPv6 encodings and missed 6to4, so a wrapped private address passed as public. mini-swe-agent's Bubblewrap backend passed --setenv PATH but not --clearenv, so sandboxed commands inherited the host's provider keys.

The second day repeated the lesson in four new shapes. Scoped credentials that do not scope: Honcho minted peer- and session-scoped keys and then checked only the workspace claim, so a caller could read configuration reserved for higher-privilege keys, Trinity drew a human/agent line around Telegram binding and never enforced the key type, and mcp-remote moved OAuth device-code secrets over whatever transport the discovered endpoints advertised with no HTTPS enforcement. Agent infrastructure accepting unauthenticated input: the official MCP Kotlin SDK installed its WebSocket endpoint with no frame-size limit, so a remote client could declare a roughly two-gigabyte payload behind a small header and exhaust the server heap, with 0.15.0 still the newest release. Sandboxes that checked the name rather than the file: mistral.rs rejected absolute and parent-directory paths lexically and then joined, resolving no symlink; MoAI-ADK staged a template deploy through a symlinkable .moai-tmp; both rerunning the day-one shape open-multi-agent's realpathTolerant helper set when it re-attached a dangling final symlink with a plain join and never called lstat. And self-host defaults that shipped the keys: Agnai's committed compose file set INITIAL_PASSWORD=password and JWT_SECRET=self-hosting, so anyone deploying the documented path got a publicly known admin password and signing secret, while LlamaFarm bound an unauthenticated management API holding provider keys to every interface and its CLI silently discarded the operator's attempt to change that.

The fix status is what turns a bug list into a finding. Of the first day's seven, exactly one had a shipped remediation: Kortix Suna, fixed in v0.13.52, commit 9c949e4, released 7 October, with v0.13.53 following on 9 October. The other six named no fixed version, and release checks on 10 October found each still inside its advisory's affected range. None of the second day's eighteen from the batch named a fixed version either, and the two most load-bearing cases were still exposed at their newest published release, mcp-remote 0.14.3 and the MCP Kotlin SDK 0.15.0, each sitting at the top of its own affected range.

Across the batch the NVD records sat at status Received (Deferred for the day-one Argo CD entry) with no independent analysis, and several writeups described coordinated disclosure still in progress. The pattern is a familiar one, the sources' own framing for their week of coverage: fixes that exist but never ship, and here mostly nothing to upgrade to at all. What the two days show is less a set of seven and eighteen bugs than a supply chain that keeps rebuilding the same missing check in new code, found by one researcher faster than the projects ship the correction.