Monday's lead is BotSharp, the .NET framework for AI agents: its sample host ships a JWT signing key in the repository, so any deployment that kept it accepts tokens anyone can sign (9.1, no fix). Two MCP gateways, Unla and Plano, hand out access or LLM provider keys to anyone who can reach them, and the Go and Kotlin MCP SDKs both took CVEs for unbounded memory use. virtualenv fixed a 7.8 overnight.

Five of the six are unreviewed CVE records with no package mapping, and virtualenv's is a repository advisory with no CVE, so no dependency scanner will raise any of them yet.

Worth your morning

BotSharp: a signing key anyone can read. CVE-2026-108860 (9.1; 9.3 on v4) covers BotSharp, SciSharp's open-source multi-agent framework for .NET (3,100 stars), published on NuGet as BotSharp.Core, BotSharp.OpenAPI and related packages. Its sample host, WebStarter, commits a fixed JWT signing key, issuer and audience to its appsettings.json. Any deployment that kept that key accepts bearer tokens that anyone can sign, for any known user, administrators included, on every route that requires authorization, with no login needed. The record covers everything through 5.2.0, published to NuGet on October 17, 2025 and still the newest release, and master ships the same key today.

If you run a BotSharp host built from WebStarter, or from a copy of its settings, generate a new random key of at least 32 bytes and supply it from outside the repository: a secret store such as Azure Key Vault, or a Jwt__Key environment variable, which WebApplication.CreateBuilder reads after appsettings.json. Restarting with the new key invalidates every token signed with the old one. Then review administrator activity for the period the old key was live.

Unla and Plano: two AI gateways that open up to anyone who can reach them. CVE-2026-108865 (8.2; 8.8 on v4) covers Unla, AmoyLab's gateway that turns existing APIs and MCP servers into MCP endpoints (2,200 stars). Its OAuth2 server issues valid access tokens without authenticating the resource owner, so anyone who can reach it can get a token for the OAuth2-protected MCP prefixes, the upstream APIs Unla proxies and the credentials it injects into those calls. Everything through 0.10.0 (August 4), the newest release, is affected, and the auth code hasn't changed since. Don't count on Unla's OAuth2 mode for access control: keep the gateway on a private network or behind a proxy that authenticates users.

CVE-2026-108863 (7.5; 8.7 on v4) covers Plano, Katanemo's proxy for routing agent traffic to LLM providers (7,100 stars). Plano runs Envoy with its admin interface open on all interfaces, without authentication, on port 9901, and that interface's configuration dump contains the LLM provider API keys in plain text. The planoai CLI publishes the port on the host as 19901. Everything through 0.4.37 (September 28), the newest release, is affected, and the Envoy template on main still binds the admin interface to all interfaces. Block 9901 and 19901 from everything but localhost, and if either was reachable from a network you don't control, rotate the provider keys.

mcp-go and the MCP Kotlin SDK: memory exhaustion in two server SDKs. CVE-2026-108859 (7.5; 8.7 on v4) covers mcp-go (9,200 stars), a widely used Go library for building MCP servers. Its Streamable HTTP server reads each POST body into memory in full before validating it, with no size limit, so anyone who can reach the endpoint can exhaust the server's memory without credentials. The record covers everything through 1.2.1 (October 9), the newest release, and the file is unchanged on main. Wrap the handler in Go's http.MaxBytesHandler, or set a body-size limit at your reverse proxy (client_max_body_size in nginx). Run 1.2.1 all the same: it fixed a separate high-severity flaw, GHSA-xf6j-693p-wqxx, published on the repository on October 9 and not covered here at the time. From 0.48.0 through 1.2.0, mcp-go's OAuth client accepted an unvalidated resource value from a server's published Protected Resource Metadata.

CVE-2026-108714 (7.5; 8.7 on v4) covers the official MCP Kotlin SDK (1,500 stars). Its WebSocket transport, mcpWebSocket, installs Ktor's WebSockets plugin with no frame-size limit, so a remote client can make the server allocate buffers until it runs out of memory. Everything through 0.15.0 (July 28), the newest release, is affected, and main still sets no limit. The record names only the WebSocket transport; the SDK also ships Streamable HTTP and SSE, whose request-body limit could be bypassed until 0.14.0 (CVE-2026-63658, 7.5, fixed September 3). If you serve MCP over WebSocket, move to Streamable HTTP on 0.15.0, or keep the endpoint reachable only by clients you trust.

virtualenv: a 7.8 in the shell prompt, fixed in 21.14.7. virtualenv's maintainers published GHSA-vxj4-q4g9-crj7 (7.8) at 01:57 UTC today, half an hour after 21.14.7 reached PyPI. Through 21.14.6, sourcing the bash activate script of an environment whose name someone else chose could run commands in your shell, with your privileges, each time the prompt is drawn. The fix is in the activate template, which virtualenv writes into an environment when it creates it, so upgrading virtualenv doesn't change environments that already exist. Recreate any you didn't create yourself. Until then, the advisory's mitigation is to set VIRTUAL_ENV_DISABLE_PROMPT=1 before sourcing activate and to check the name of an environment you didn't create. It's virtualenv's fourth advisory about its activation scripts since October 1, and it moves the floor this digest gave on October 3 from 21.14.4 to 21.14.7. tox, Hatch, Poetry and pipenv all depend on virtualenv with version floors that allow 21.14.7.

The rest of yesterday's batch. VulnCheck filed 106 CVE records in its 15:31 UTC batch yesterday, about forty of them against AI tools, and in nearly every case the range ends at the newest release:

• Vearch (8.8; 8.7 on v4), a distributed vector database (2,300 stars): from 3.5.2 through 3.5.9 (February 4, the newest), roles ignore read-only privileges, so any non-root account can write and delete documents and raise its own role. Give accounts only to people you'd trust with write access. CVE-2026-108746
• hyper-mcp (6.5; 8.3 on v4, two records), an MCP server extended by WebAssembly plugins: through 0.8.3 (June 24), the plugin loader checks the Cosign signature of a manifest, just not the one it loads, and by default accepts any signer identity and issuer. Load plugins only from registries you control and set the expected signer explicitly. CVE-2026-108698, CVE-2026-108699
• mistral.rs (6.8; 7.6 on v4), the Rust inference server (7,700 stars): from 0.9.0 through 0.9.4 (September 24, the newest), the code-execution sandbox follows symlinks, so code the model runs can read and overwrite files outside it with the server's permissions. If you enable code execution, run the server as an unprivileged user in a container. CVE-2026-108759. Don't stay below 0.9.4: on September 24 it fixed three repository-only advisories this digest missed, including a 9.3 SSRF in the built-in web search tools (GHSA-376v-h85w-v85v) and an unauthenticated path traversal in the web UI. mistral.rs has no built-in authentication, so bind it to loopback or put an authenticating proxy in front.
• mcp-remote (5.3; 6.0 on v4), 618,000 downloads a week: from 0.8.0 through 0.14.3 (September 21, the newest), the device-code login sends the client secret and receives tokens over plain HTTP when a server advertises non-loopback http:// endpoints. Connect only to servers whose OAuth endpoints use HTTPS. CVE-2026-108716
• OpenAgents Workspace (7.5; 8.7 on v4): through launcher-v1.0.17 (October 10, the newest), unauthenticated callers can list every workspace, including an unmasked API key in its settings, its creator's email address and its member list. CVE-2026-108739
• Hugging Face Text Embeddings Inference (3.3; 4.8 on v4): through 1.9.4, the router writes its configured API key to its logs. If those logs leave the host, rotate the key. CVE-2026-108857
• docling-serve (3.7; 6.3 on v4): from 1.14.0 through 1.36.0 (October 1, the newest), two memory-diagnostics endpoints skip the API key check. CVE-2026-108749

Also in the batch, with no fixed release: LlamaFarm (its unauthenticated API listens on all interfaces), Flyte 2.0.1 through 2.0.51 (file-mounted secrets readable by anyone who can read Pod specs), NornicDB, LLMGateway, Predibase LoRAX and two of UnicomAI Wanwu's four records. Wanwu's other two, including an 8.1 that let users delete other tenants' agent and RAG apps, are fixed in 0.6.3. Honcho, Hatchet and Quarkus LangChain4j took medium-severity records too.

Standing items. vLLM's PR 51504 merged on October 11, a fix for CVE-2026-94624, one of the six KV-transfer CVEs, but it's on main only and in no tag yet. The other five fix PRs are still open. The CVE-2026-90878 fix is in the v0.31.1rc0 tag of October 6, which isn't on PyPI, so 0.31.0 still lacks it. LiteLLM shipped stable 1.105.0 yesterday, and CVE-2026-93355 is still open on JWT-auth deployments. Unchanged: SGLang 0.5.21 with CVE-2026-93034 open, MLflow 3.17.0 with its second scorer advisory unpublished, LobsterAI at 2026.9.23 with the fix only on a release branch, AstronRPA 1.1.6 with all four CVEs open, cc-connect 1.5.0, the Cohere SDK 7.2.0, Chroma 1.5.9 with both CVEs open, MarkItDown 0.1.8 pinning mammoth~=1.11.0, Mooncake 0.3.13.post1, pandas-ai 3.0.0, LightLLM v1.2.0, Showdown 2.1.0 and the Milvus Helm chart 5.0.30. GitLab has tagged no self-hosted AI Gateway image since September 17, BrowserSkill PR 363 is unmerged, NeMo 3.0.0 still caps hydra-core<=1.3.2, and the latest tag of @deepseek-ai/dsh-client-connection still points at the affected 0.0.1-rc.1. GitHub's reviewed feed has published nothing since Friday 20:57 UTC.

For .NET and Azure. BotSharp is today's .NET item. Microsoft has revised no security documents since Sunday 02:15 UTC, and Patch Tuesday is tomorrow, October 13. ImageSharp's records in GitHub's database still name only 4.1.2, so NuGetAudit keeps flagging 3.2.0. For Angular teams, openapi-typescript-codegen's 9.8 is unchanged: 0.31.0 is still the newest release and issue 2809 has no reply. GitHub's record for webpack-dev-middleware GHSA-g84c still says < 7.4.5.