Security Thursdays by yisusvii — 2026-09-24

Table of Contents

🚨 Cybersecurity News of the Week

1. mcp-atlassian — HTTP auth theater, host file read, toolset bypass, incomplete path fixes (Sep 22)

What happened: On September 22, 2026, the GitHub Advisory Database and vendor advisories for sooperset/mcp-atlassian published a large coordinated set fixed primarily in v0.22.0 (later 0.22.1 / 0.23.x also available on the release train observed at research time).

Headline issues:

Who is affected: Operators running mcp-atlassian < 0.22.0, especially Pattern A (server-side JIRA_* / CONFLUENCE_* env credentials) with Streamable HTTP / network-exposed transports. Default bind behavior described in advisories includes 0.0.0.0 for HTTP modes. Stdio-only local agent wiring without a network listener is a different exposure class but still deserves inventory.

Why it matters: This is the Atlassian-shaped sibling of last week’s MySQL MCP and mcp-gitlab failures. One reachable MCP port becomes Jira/Confluence API power and host secret theft (/proc/self/environ, .env, SSH keys) without attacking Atlassian Cloud itself.

Exploitation status: Not confirmed as mass in-the-wild exploitation in sources reviewed. Advisories include detailed root-cause and composition analysis.

Defender actions: Upgrade to ≥ 0.22.0 (prefer newest 0.23.x on the release page); disable network transports or bind loopback + reverse-proxy auth; enable OAuth proxy only with real verification; do not trust ENABLED_TOOLS alone on older builds; rotate Atlassian tokens and any secrets that lived on the MCP host; search estate for mcp-atlassian containers and desktop agent configs.

Primary sources: vendor/GHSA links above; v0.22.0 release.

2. KubeEdge — command injection on edge nodes via upgrade and config jobs (Sep 22)

What happened: On September 22, 2026, KubeEdge published:

• GHSA-5jpj-293f-rhvj / CVE-2026-62371 (CVSS 3.1 8.8): NodeUpgradeJob built keadm upgrade edge by shell-concatenating attacker-influenced spec.version and spec.image.
• GHSA-m3c6-2p7h-cfr3 / CVE-2026-62182 (CVSS 3.1 8.8): ConfigUpdateJob updateFields similarly shell-concatenated into edge config-update execution.
• Related GHSA-9vm9-pqxx-x83v / CVE-2026-62369 (CVSS 3.1 8.1): keadm DecompressTarGz path traversal → arbitrary file write on Windows during edge join.

Who is affected: KubeEdge trains called out in advisories — upgrade floors 1.21.2, 1.22.2, 1.23.1 (confirmed on the project release list at research time). Attackers need permission to create/update the relevant job resources (or influence join artifacts for the Windows path issue).

Why it matters: Edge nodes often sit on OT/retail/IoT segments with weaker patch cadence. Cloud-side RBAC mistakes become host RCE on the edge when jobs still shell out.

Exploitation status: Not confirmed in the wild in sources reviewed. Fixes switch to exec.Command with literal argv (no shell).

Defender actions: Patch to the floors above; restrict RBAC for NodeUpgradeJob/ConfigUpdateJob to break-glass admins; audit existing jobs for odd version/image/updateFields values; treat Windows join tooling as high trust.

Primary sources: linked GHSAs; v1.21.2, v1.22.2, v1.23.1.

3. Microsoft — EvilTokens PhaaS and device code phishing (Sep 22)

What happened: On September 22, 2026, Microsoft Security published Unmasking EvilTokens: Getting to the root of device code phishing. The post tracks EvilTokens, described as a widely used phishing-as-a-service platform that emerged around February 2026, combining device code phishing with AI-assisted lure tailoring and compromised-mailbox triage for BEC follow-on. Device code flow remains attractive because users approve a code in a legitimate login UI while the attacker holds the device session.

Who is affected: Organizations allowing OAuth 2.0 device authorization grant (common for CLI, smart-TV, and headless app patterns) against Microsoft Entra ID and similar IdPs, especially where Conditional Access does not constrain the grant or client apps.

Why it matters: No CVE required — protocol-permitted UX plus user training gaps yields refresh tokens and mailbox access. Defenders who only chase CVSS-critical CVEs will miss this class.

Exploitation status: Microsoft describes EvilTokens as an active PhaaS used in real campaigns. Treat as confirmed criminal service activity, not as a single-product remote code execution bug.

Defender actions: Review whether device code flow is required; apply Entra Conditional Access / authentication-strength controls; monitor anomalous device code redemptions; educate users that unexpected device codes are phishing; use the hunting guidance in the Microsoft article where Defender XDR is deployed.

Primary source: Microsoft Security Blog article linked above.

4. OpenBao — recovery-mode recovery-token timing leak (Sep 22)

What happened: GHSA-34fc-gh42-pj53 / CVE-2026-63132 (CVSS 4.0 9.1 on the GHSA record): while running in highly privileged recovery mode, OpenBao was vulnerable to a timing attack against the single recovery token, allowing extraction of the token and subsequent privileged operations (read/modify data). Vendor advisory: patched in OpenBao v2.6.0 (release). GHSA package metadata also lists a vulnerable 1.x band (≥ 0.1.0, ≤ 1.1.5) without a separate 1.x patched version in the ecosystem entry — operators still on 1.x should follow the v2.6.0+ vendor patch statement rather than inventing a 1.x floor.

Who is affected: OpenBao deployments that enter recovery mode on a network path an attacker can measure; secrets-platform operators migrating from or paralleling HashiCorp Vault operational patterns.

Why it matters: Recovery paths are rarely as hardened as steady-state auth, yet they unlock the kingdom. Timing leaks against a single shared recovery secret are practical on local networks and some multi-tenant control planes.

Exploitation status: Not confirmed in the wild in sources reviewed.

Defender actions: Upgrade to ≥ 2.6.0 (newer 2.6.x / 2.7.x releases existed on the project release page at research time); isolate recovery-mode endpoints; rotate recovery material after upgrade if recovery mode was ever exposed while vulnerable.

Primary sources: vendor GHSA; v2.6.0.

5. Moquette MQTT ACL bypass, Plone TALES RCE, and other high-signal items (Sep 22–23)

Additional items worth tracking:

• Moquette (Sep 23): CVE-2026-85724 (CVSS 3.1 9.6) — pattern ACL rules substitute raw clientId/username including MQTT wildcards (+ / #), enabling cross-tenant read/write when pattern ACLs are used; plus unauthenticated DoS crash classes. Fixed 0.18.1 (GHSA-5f42-97gr-vfhq, release). Not claimed as RCE (memory-safe JVM).
• plone.app.portlets (Sep 23): CVE-2026-57149 (CVSS 3.1 9.9) — Classic portlet TALES injection → RCE as the Plone process for users who can configure Classic portlets (default role map can include ordinary users on personal dashboards). Floors: 7.0.2 / 6.0.4 / 5.0.8 (GHSA-rr49-f9g6-c9r5).
• tinyauth (Sep 22): CVE-2026-77560 (CVSS 3.1 8.1) — forward-auth per-app ACL host match is case-sensitive while hostnames are not → authenticated users reach apps outside allowlists. Vendor release floor v5.1.2 (GHSA-328g-jx67-v94g, tag).
• Unleash (Sep 22): CVE-2026-77426 (CVSS 4.0 7.1) — missing await on admin permission check → any authenticated user can modify segment/strategy assignments cross-project; plus IDOR-style reads. Fixed unleash-server 8.0.3 (GHSA-72h8-wp98-7hch).
• OpenC3 COSMOS (Sep 23): CVE-2026-77602 (CVSS 3.1 9.9) authenticated RCE via user-writable config overlay; CVE-2026-77601 OS command injection via pypi_url. Fixed 7.3.0.
• Home Assistant (Sep 22): CVE-2026-91130 (CVSS 4.0 9.3) XSS in Statistics Graph card (including supply-chain-ish malicious default entity names). Fixed 2026.7.0.
• Gardener (Sep 22): CVE-2026-79767 (CVSS 3.1 5.5) manage-members bypass via Group/ServiceAccount subject injection — floors 1.142.6 / 1.143.3 / 1.144.2.
• Traefik follow-on (Sep 22): CVE-2026-88010 medium BasicAuth singleflight username-enumeration timing regression on 3.6.11–3.7.12; fixed narrative points at 3.7.13 (already the floor from last week’s critical cluster).

🛡️ CVEs That Deserve Attention

CVE-2026-77244 — mcp-atlassian HTTP authentication bypass

• Product / versions: PyPI mcp-atlassian < 0.22.0 → 0.22.0 (prefer newest 0.23.x available)
• Type: Broken authentication — opaque verifier accepts any non-empty token; optional auth provider off by default; missing bearer still reaches tools that use env credentials
• Prereqs: Network reachability to HTTP/Streamable HTTP transport; Pattern A env credentials amplify impact
• CVSS: 3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N)
• EPSS (GHSA field, observed 2026-09-24): ≈ 0.495% (percentile ≈ 0.42)
• KEV: Not independently verified (catalog feed unreachable)
• Public exploit: Advisory reproduction detail; no separate mass-exploit claim reviewed
• Priority: Emergency for any non-loopback deployment; High even on localhost shared multi-user agents
• Advisory: GHSA-wrhw-j3f9-8vc6

CVE-2026-77248 — mcp-atlassian unauthenticated arbitrary file read

• Product / versions: < 0.22.0 → 0.22.0
• Type: Missing transport auth + unconstrained file_path on upload_attachment → read host files into attacker-controlled Jira/Confluence content
• Prereqs: Reachable HTTP tools endpoint; write-capable Atlassian credentials on server amplify exfil channel
• CVSS: 3.1 8.6
• Related: CVE-2026-77255 / 77258 / 77259 / 77260 family (same package floor)
• Priority: Emergency when chained with CVE-2026-77244 on exposed transports
• Advisory: GHSA-cc5h-2pwp-pvcc

CVE-2026-77243 — mcp-atlassian tool allowlist bypass

• Product / versions: < 0.22.0 → 0.22.0
• Type: Authorization bypass — ENABLED_TOOLS / toolsets filter tools/list only
• Prereqs: Attacker can send tools/call with known tool names (public in OSS)
• CVSS: 3.1 8.8
• Note: READ_ONLY_MODE described as correctly dual-enforced; do not assume list filters equal call filters on older builds
• Priority: High (Emergency when combined with missing auth)
• Advisory: GHSA-3r68-hf9h-887v

CVE-2026-62371 — KubeEdge NodeUpgradeJob command injection

• Product / versions: Vulnerable ranges include ≥ 1.12.0, < 1.21.2; ≥ 1.22.0, < 1.22.2; ≥ 1.23.0, < 1.23.1 → fixed 1.21.2 / 1.22.2 / 1.23.1
• Type: OS command injection via shell-built keadm upgrade edge
• Prereqs: Permission to create/update NodeUpgradeJob (v1alpha2); targeted enrolled edge node
• CVSS: 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
• EPSS (GHSA field, 2026-09-24): ≈ 0.485% (percentile ≈ 0.41)
• Priority: Emergency on multi-tenant or broadly delegated edge fleets; High on single-tenant tightly RBAC’d clusters (still patch)
• Advisory: GHSA-5jpj-293f-rhvj

CVE-2026-62182 — KubeEdge ConfigUpdateJob command injection

• Product / versions: ≥ 1.21.0, < 1.21.2; ≥ 1.22.0, < 1.22.2; ≥ 1.23.0, < 1.23.1 → same fixed tags as above
• Type: OS command injection via shell-built config-update from updateFields
• Prereqs: Authz to create/modify ConfigUpdateJob
• CVSS: 3.1 8.8
• EPSS (GHSA field, 2026-09-24): ≈ 0.476% (percentile ≈ 0.40)
• Priority: High (pair with CVE-2026-62371 as one edge-control patch window)
• Sibling: CVE-2026-62369 Windows join path traversal (CVSS 3.1 8.1)
• Advisory: GHSA-m3c6-2p7h-cfr3

CVE-2026-63132 — OpenBao recovery-mode token timing attack

• Product / versions: Vendor patch OpenBao v2.6.0+. GHSA also marks ≤ 1.1.5 vulnerable without a listed 1.x first-patched version — consult vendor release notes; do not assume 1.x is safe.
• Type: Timing side channel against single recovery token in recovery mode
• Prereqs: Ability to send auth attempts to a node in recovery mode and measure responses
• CVSS: 4.0 9.1 (AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N)
• Priority: Emergency if recovery mode is network-reachable while unpatched; High for secrets platforms generally; Monitor only if recovery mode is offline-airgapped and short-lived and patch is scheduled immediately
• Advisory: GHSA-34fc-gh42-pj53

CVE-2026-85724 — Moquette pattern-ACL wildcard injection

• Product / versions: io.moquette:moquette-broker ≤ 0.18.0 → 0.18.1
• Type: Authorization bypass (MQTT wildcard characters in clientId/username expand pattern ACLs) + DoS crash classes
• Prereqs: Pattern ACL rules in use (%c / %u substitution); broker reachable to untrusted clients (anonymous default called out in advisory)
• CVSS: 3.1 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N)
• Priority: High for multi-tenant MQTT; Medium if pattern ACLs unused and clients fully trusted
• Advisory: GHSA-5f42-97gr-vfhq

CVE-2026-57149 — plone.app.portlets Classic portlet TALES RCE

• Product / versions: 7.0.0–7.0.1 → 7.0.2; 6.0.0–6.0.3 → 6.0.4; 5.0.0–5.0.7 → 5.0.8
• Type: Server-side template/TALES injection → code execution in Plone process
• Prereqs: Authenticated user who can add/edit Classic portlets (default map may include personal dashboard portlet managers)
• CVSS: 3.1 9.9
• EPSS (GHSA field, 2026-09-24): ≈ 0.638% (percentile ≈ 0.49)
• Priority: High for any Plone site with Classic portlets enabled; restrict portlet management if patch delayed
• Advisory: GHSA-rr49-f9g6-c9r5

🔧 Basic Security Tool of the Week

Trivy v0.74.0 — all-in-one vulnerability, misconfig, secret, and license scanner

What it does: Trivy (Aqua Security) scans container images, filesystems, git repos, Kubernetes resources, and SBOMs for OS/app vulnerabilities, IaC misconfigurations, embedded secrets, and license issues. One CLI covers several jobs teams often split across SCA + image + misconfig tools.

Who it is for: Developers, DevOps/SRE, and platform engineers who ship containers or edge agent images — especially relevant this week for KubeEdge node images, MCP server containers, and secrets-platform base images.

Why this week: Different category from last week’s Checkov (IaC-focused policy-as-code) and the earlier TruffleHog (secret validation) / OSV-Scanner (advisory SCA) / gosec (Go SAST) picks. Trivy is a practical “scan the artifact you actually deploy” step after patching mcp-atlassian and KubeEdge. Latest GitHub release tag observed at research time: v0.74.0 (active maintenance; prior tags v0.73.x / v0.72.x also present).

Install (authorized machine only, pick one):

# macOS / Linux Homebrew
brew install trivy

# Official binary install script (review script before piping in production)
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v0.74.0

# Docker (no host install)
docker pull aquasec/trivy:0.74.0

Safe basic example — scan only images or trees you own or are authorized to assess:

# Scan a local authorized project directory for vulns, secrets, and misconfig
trivy fs --scanners vuln,secret,misconfig --severity HIGH,CRITICAL .

# Scan an authorized container image you built or pulled for your org
trivy image --severity HIGH,CRITICAL your-registry.example/your-app:1.2.3

# Dockerized filesystem scan of the current authorized repo
docker run --rm -v "$PWD":/src aquasec/trivy:0.74.0 fs --severity HIGH,CRITICAL /src

How to read results: Prioritize CRITICAL/HIGH with a known fixed version in your direct base image or direct dependencies. Secret findings need immediate rotation, not just suppression. Misconfig hits on latest tags, run-as-root, and open capabilities are cheap wins for edge and MCP hosts. Export SARIF/JSON into CI gates when ready.

Limitations: DB freshness depends on update connectivity (trivy image --download-db-only in air-gapped workflows). Not a substitute for vendor PSAIRT feeds on closed-source appliances. Does not prove exploitability. Never point Trivy at third-party registries, clusters, or hosts without explicit authorization. Pin the Trivy version in CI.

Links: Repository · Docs · Releases

💡 Security Tip of the Day

Today’s tip: Inventory every app registration / OAuth client that may use the device code grant, then disable device code where unused or wrap it in Conditional Access / authentication strength controls — and tell users that an unexpected device code prompt is phishing until proven otherwise.

Why it matters: Microsoft’s EvilTokens research this week shows criminals industrializing device code phishing. Unlike a one-off CVE, this abuse path works against correctly implemented IdPs because the protocol is designed for user-approved headless login.

How to apply it (≈10–15 minutes):

1. In Microsoft Entra ID (or your IdP), list application policies / grant types that allow device code / device authorization.
2. Disable the grant on apps that only need auth-code + PKCE or client-credentials.
3. Where device code must remain (some CLIs, kiosks), require compliant device + phishing-resistant strength where possible, and alert on unusual geographic or burst redemptions.
4. Add one sentence to your internal phishing guide: “Support will never ask you to enter a device code from an unsolicited email or chat.”

Verify: A test user on a non-approved app no longer completes device code login; approved apps still work for a known-good CLI; detection/hunting queries from the Microsoft article (if you run Defender) return expected lab activity only.

✅ Security Actions for This Week

1. Emergency: Patch mcp-atlassian → ≥ 0.22.0 (prefer 0.23.x); unpublish HTTP/SSE from non-loopback interfaces; rotate Atlassian API tokens and MCP host secrets.
2. Emergency/High: Upgrade KubeEdge → 1.21.2 / 1.22.2 / 1.23.1; restrict NodeUpgradeJob/ConfigUpdateJob RBAC; review job specs for injection attempts.
3. High: Upgrade OpenBao → ≥ 2.6.0 if deployed; isolate recovery mode; rotate recovery tokens after patch if exposure possible.
4. High/Medium by estate: Moquette ≥ 0.18.1, Plone portlets floors above, tinyauth ≥ 5.1.2, unleash-server ≥ 8.0.3, OpenC3 ≥ 7.3.0, Home Assistant ≥ 2026.7.0, Gardener floors if you operate it; finish last week’s Traefik ≥ 3.7.13 if still open (includes CVE-2026-88010).
5. Hygiene: Run Trivy on one authorized image or repo; complete the device-code grant inventory tip; confirm prior MCP transport inventory from 2026-09-17.

Sources

• GHSA-wrhw-j3f9-8vc6 — CVE-2026-77244 mcp-atlassian auth bypass
• mcp-atlassian v0.22.0 release
• GHSA-cc5h-2pwp-pvcc — CVE-2026-77248 mcp-atlassian unauth file read
• GHSA-3r68-hf9h-887v — CVE-2026-77243 mcp-atlassian tool allowlist bypass
• GHSA-6vmq-24h2-pj7j — CVE-2026-77271 mcp-atlassian incomplete path fix / RCE class
• GHSA-2xj6-xx86-cwwc — CVE-2026-77255 mcp-atlassian file read via update_issue
• GHSA-hgcf-4mq8-5266 — CVE-2026-77274 mcp-atlassian SSRF protection bypass
• GHSA-5jpj-293f-rhvj — CVE-2026-62371 KubeEdge NodeUpgradeJob command injection
• GHSA-m3c6-2p7h-cfr3 — CVE-2026-62182 KubeEdge ConfigUpdateJob command injection
• GHSA-9vm9-pqxx-x83v — CVE-2026-62369 KubeEdge keadm path traversal (Windows)
• KubeEdge v1.21.2 release
• KubeEdge v1.22.2 release
• KubeEdge v1.23.1 release
• GHSA-34fc-gh42-pj53 — CVE-2026-63132 OpenBao recovery-token timing attack
• OpenBao v2.6.0 release
• Microsoft Security Blog — Unmasking EvilTokens (device code phishing)
• GHSA-5f42-97gr-vfhq — CVE-2026-85724 Moquette pattern-ACL bypass
• Moquette v0.18.1 release
• GHSA-rr49-f9g6-c9r5 — CVE-2026-57149 plone.app.portlets TALES RCE
• GHSA-328g-jx67-v94g — CVE-2026-77560 tinyauth forward-auth ACL host case bypass
• tinyauth v5.1.2 release
• GHSA-72h8-wp98-7hch — CVE-2026-77426 Unleash admin API authz bugs
• Unleash v8.0.3 release
• GHSA-jjq7-m736-w977 — CVE-2026-77602 OpenC3 COSMOS config-overlay RCE
• GHSA-vp3w-52v9-q57f — CVE-2026-77601 OpenC3 COSMOS pypi_url command injection
• GHSA-wx4m-69m9-gx3m — CVE-2026-91130 Home Assistant Statistics Graph XSS
• GHSA-gfjv-gqf2-c888 — CVE-2026-79767 Gardener manage-members group injection
• GHSA-8fcf-v89g-xpg6 — CVE-2026-88010 Traefik BasicAuth timing regression
• Trivy repository
• Trivy v0.74.0 release
• NVD — CVE-2026-77244
• NVD — CVE-2026-62371
• NVD — CVE-2026-62182
• NVD — CVE-2026-63132
• NVD — CVE-2026-85724
• NVD — CVE-2026-57149