Three Critical advisories on the AI/MCP layer surfaced in GitHub's reviewed feed over the July 2–4 window, and they rhyme: an authentication check that isn't enforced, or a secret left at the value it shipped with. Loudest is 9router (CVSS 9.8), an LLM API router whose dashboard trusts a JWT signed with a default secret that sits in the public repo — leave that secret unset and a request can forge its way to full dashboard access and the API keys behind it. Beside it, two MCP servers that skip the check entirely: mcp-memory-service (9.8) exposes stored memories to any unauthenticated client, and fast-mcp-telegram (9.4) lets one impersonate the logged-in account. The catch is the one from Thursday's batch — every fixed version below has been available since late May, so this is a confirm-your-pins pass, not an incident.

Worth your morning

9router (CVE-2026-49352). This is the one to actually move on if you run it. The dashboard's session tokens are signed with a fallback secret named — and this is the whole lesson — 9router-default-secret-change-me, present in the public repo since 0.2.21. If JWT_SECRET is left unset, that default is what signs and verifies tokens, so an unauthenticated request can mint its own and take the dashboard, the stored API keys, and every setting with it. Fixed in 0.4.45 (CVSS 9.8). Upgrade, set a real JWT_SECRET, and if you ever ran an internet-reachable instance on the default, rotate the provider keys that dashboard held.

Two MCP servers that never checked. mcp-memory-service (CVE-2026-50027, 9.8) left its document API routes without an auth dependency, so an unauthenticated client on the network could read, write, and delete stored memories regardless of the auth you thought you'd configured — fixed in 10.67.1, which adds the read/write guards to the routes that never had them. fast-mcp-telegram (CVE-2026-52830, 9.4) let a crafted bearer token slip past its check and act as the default Telegram session, i.e. as the logged-in account — fixed in 0.19.1. Both fixes shipped in late May; treat this as a version confirmation unless you only just installed.

langroid. Two highs in the agent framework, both closed by 0.64.0: CVE-2026-50180 (8.7) is an arbitrary file-read reachable through the SQLChatAgent's query filter, and CVE-2026-50181 (7.1) is a path traversal in the read/write file tools that escapes the configured working directory. If you build on langroid, 0.64.0 is the floor.

openclaw — a second cluster, not a repeat. Thursday's digest flagged one openclaw advisory (the SSE header-forwarding fix in 2026.6.5). A further batch surfaced this window — distinct issues, the notable one being a native-command authorization bypass (7.2) where the owner-only command policy wasn't enforced. That one resolves in 2026.5.6, below the 2026.6.5 you were already pointed at — so if you took Thursday's advice and moved to 2026.6.5, you've cleared this batch too. If you didn't, 2026.6.5 covers both.

One to note without a fix to chase: the @grackle-ai/ packages (auth, mcp, plugin-core, powerline, runtime-sdk) carry a pair of unpatched high-severity advisories at ≤ 0.132.1 — an MCP-layer authorization bypass and an RPC-layer command-injection RCE, both 8.7, no patched release yet. Niche, but if it's in your agent stack there's no version to jump to today; restrict access to the RPC surface and watch the advisory for a fix. Quiet again on the .NET, Azure, and Angular side — nothing cleared the bar for the Venicecom stack since the June 9 set.