After two quiet mornings, the GitHub Advisory Database caught up on the Model Context Protocol layer — four npm advisories at the top of the reviewed feed over the June 30–July 1 window, all circling the same two failures: an MCP server that leaks the credential it holds, or one whose SSRF guard doesn't hold. The loudest is @apify/actors-mcp-server (CVSS 8.1): the official Apify MCP server can be steered into handing its API token to an attacker-controlled endpoint, which is full account access. The catch, and the reason most of this is a version check rather than a fire drill — three of the four carry CVEs whose fixed versions shipped back in late May, so if you track these packages you're likely already past them. OpenClaw's fix is the genuinely recent one.

Worth your morning

@apify/actors-mcp-server (CVE-2026-50143). The official MCP server for Apify's Actor platform holds an API token that maps to your whole account. In versions below 0.10.11 that token could be leaked to an attacker-controlled endpoint, so the impact isn't a single tool call gone wrong — it's account takeover. Fixed in 0.10.11 (CVSS 8.1). Upgrade, and if you ran an exposed version against anything you don't fully control, rotate the Apify token rather than assume it stayed home.

Two SSRF filters that didn't hold. auth-fetch-mcp (CVE-2026-49857, 7.4) and @jshookmcp/jshook (CVE-2026-49856, 4.3) are the recurring MCP shape: a server that reaches out to fetch or probe on your behalf, with a loopback/internal-address guard that a crafted address form slips past — enough to reach services meant to sit behind the network boundary. Fixed in 3.0.2 and 0.3.2. Both fixes have been out since late May; this window is just when the advisories were reviewed, so treat them as a confirm-your-version pass unless you only just installed.

OpenClaw — the one that's actually new. GHSA-9c3v-684m-579c (6.5, no CVE, published June 30) is the fresh item: before 2026.6.5, the agent forwarded authentication headers through Server-Sent-Event redirects, so a credential meant for one host could ride along to another. Fixed in 2026.6.5 — the recent release, not a May catch-up. If you run OpenClaw, this is the one to move on today.

Quiet again on the runtimes and the .NET side: the vLLM, Ollama, and llama.cpp items still circulating are the same weeks-to-months-old fixes, and nothing has cleared the bar for the Venicecom stack since the June 9 .NET set.