Since August 31, the GitLab MCP server has sent the secrets in its environment to whichever registry the working directory's .npmrc names, every time it starts. 2.3.12, released overnight, stops it. If you ever launched it from a repository you didn't write, rotate the token too. Also today: a 9.8 in OpenHands' agent SDK that 1.52.0 fixed for Docker and not for Apptainer, a 9.8 in Mercury, and six AutoGPT advisories for fixes already released.

No scanner will raise any of these. OpenHands has only a CVE record, and none of the 28 repository advisories published since yesterday's digest is in GitHub's database: its reviewed feed has published nothing since 22:28 UTC on Friday, more than 80 hours ago.

Worth your morning

GitLab MCP server: an update check that carries your token. From 2.1.55 (August 31) through 2.3.11, @zereight/mcp-gitlab ran a version check at startup against the npm registry configured in the working directory's .npmrc, and the request exposed the secrets in the server's environment (GHSA-rr94-3mff-76gg, rated high, no score). GITLAB_PERSONAL_ACCESS_TOKEN is the obvious one, but job tokens, OAuth client secrets and unrelated cloud keys in the same environment went the same way. Exposure needs the server to start in a directory someone else controls: a fresh clone, a pull request checkout under review, an extracted archive. MCP clients that run stdio servers from the project directory do exactly that. Failures were swallowed and nothing was logged, so there's no trace to look for.

2.3.12 shipped at 01:15 UTC today. If you can't upgrade yet, set GITLAB_DISABLE_VERSION_CHECK=true. If the server has started in a repository you didn't write since August 31, rotate the token. The PATs this server uses usually carry the api scope, which reaches every project, CI/CD variable and pipeline the owner can. One caveat the advisory leaves out of scope: launched with npx from a project directory, npm itself may read the same .npmrc while it resolves the package.

OpenHands: a sandbox server on every interface, half fixed. VulnCheck's CVE-2026-112346 (9.8; 9.3 on v4), published yesterday, covers the OpenHands Software Agent SDK before 1.52.0. Its DockerWorkspace published the sandboxed agent server's port on every host interface with an empty session-key list, so anyone who could reach that port could run commands in the agent's sandbox without authenticating. PR 5209, merged on October 3 and released in 1.52.0 on October 5, publishes the ports on loopback and passes the configured key to the client. Upgrade openhands-workspace to 1.52.0 or later; 1.58.2 (Saturday) is current.

The CVE also names the Apptainer launcher, and the PR doesn't touch it. apptainer/workspace.py is identical at v1.51.0 and v1.58.2. It still starts the server on 0.0.0.0 and authenticates requests only when SESSION_API_KEY is set in the environment, and Apptainer shares the host's network by default. On Apptainer, set SESSION_API_KEY before starting a workspace, or keep the host off networks you don't trust.

Mercury: the third critical in its Jupyter routes since August. Mercury turns notebooks into web apps on top of a Jupyter server. Three advisories, published yesterday, cover every release after 3.0 through 3.2.11:

• GHSA-jgh7 (9.8): in standalone mode, Jupyter's configuration, conversion, settings and terminal WebSocket routes stayed reachable without authentication. An anonymous client could attach to a terminal that already existed and run shell commands, and could write shared configuration that survives restarts.
• GHSA-w823 (7.5): on servers protected by a token or password, notebook source and saved outputs were readable without either.
• GHSA-8hq5 (5.3): notebooks outside the configured directory could be listed.

3.2.12 (Saturday) blocks those routes in standalone mode and turns terminals off by default. 3.2.13 (yesterday) adds session isolation, and the advisory recommends it. Restart servers and replace runtime images after upgrading. Until then, put authentication in front and disable terminals; blocking /api/terminals alone doesn't close the WebSocket route. The two earlier criticals, in /api/terminals (fixed in 3.2.4) and /api/kernels (3.2.6), date from August.

AutoGPT: six advisories, fixes already out. AutoGPT published six advisories for its self-hosted platform between 05:32 and 06:06 UTC today. The fixes shipped in 0.8.4 (October 14) and 0.9.0 (October 23).

• GHSA-3c7g (7.7): the request blocklist missed the unspecified IPv6 address, so a signed-up user could reach services on IPv6 loopback in the backend's network. When the backend runs directly on a host, that includes the internal RPC services (database manager, execution manager, scheduler, notification manager), which have no authentication of their own, and databases on the same host.
• GHSA-hf7q (7.1): AutoPilot passed chat text through the Claude Code CLI's slash-command and file-mention handling, so a chat turn could read files the executor can read and run CLI commands. On the single-container image and Docker Compose that covered every user's workspace files and stored CLI sessions, plus the Claude credentials file in subscription mode. The advisory lists no complete workaround.
• 0.8.4 stopped the Sentry tunnel from forwarding first-party cookies, the session token among them, to Sentry (5.9), and closed a race that could restore access after a share was revoked (3.7). 0.9.0 fixed two billing flaws that let users run paid blocks without being charged (6.5, 4.3).

Also on the AI stack.

• ToolHive 0.57.0 (yesterday) fixes four session-handling flaws in its MCP proxy, rated 2.6 to 5.0. Passthrough headers fell back to the session creator's values, session ownership was checked only inside call handlers, an early disconnect could run the ownership check as the owner, and declining an elicitation with skip_remaining still ran the gated steps.
• Ludwig 0.17.10 (00:03 UTC today): the Ray backend loaded result files with torch.load(weights_only=False) (GHSA-p3h5, 6.6), the same class of flaw as August's checkpoint-resume fix in 0.17.9.
• LibreChat 0.8.9-rc1, a pre-release, moves to an MCP SDK past the OAuth credential leak covered on October 7, and to Node.js 24.22.1.

On the Venicecom stack. Quiet. Microsoft's table for the Brotli flaw (CVE-2026-111497) in yesterday's .NET release lists Visual Studio 2022 17.14.43, Visual Studio 2026 18.11.2 and Visual Studio 2019 16.11.61 as fixed builds, so update Visual Studio as well as standalone SDKs. VulDB filed two mediums against the A2A .NET SDK: error messages that exposed internal details (4.3, fixed in 1.0.0-preview3 on October 14) and a race in task status updates (5.4, through preview3; PR 453 awaits review). Angular hasn't released since Thursday, and PrimeNG has no advisories.

Corrections. Yesterday's digest took Pillow's own range for GHSA-654x, which then included 13.0.0, at its word, and advised keeping PILLOW_ALIGNMENT unset on 13.0.0. The fix, PR 10172, merged on October 12 and is in 13.0.0, and the maintainers corrected their range to "below 13.0.0" at 04:54 UTC today, adding CVE-2026-114501. Upgrading to 13.0.0 is enough. The Hydra advisory linked yesterday as GHSA-wf6j now returns 404. Hydra has moved to hydra-ecosystem/hydra, and the same flaw is published as GHSA-757g-8w3h-hp29 (7.8), still fixed in 1.3.8 and 1.4.0rc3.

Paperwork your scanner may raise. VulnCheck filed six CVEs for llama.cpp's GGUF loading, all for bugs fixed in builds from b2731 (2024) to b11301 (September 30). The worst are CVE-2024-58400 (8.2, an out-of-bounds read in llama-server, fixed in b3701) and CVE-2026-116816 (7.8, a heap write while loading a crafted model, fixed in b10261 on August 4). The current build is b11913, and Ollama 0.40.11 builds llama.cpp b11845, past every fix. GitHub assigned CVE-2026-115911 to CVE-2026-115918 to eight of the nine vLLM advisories covered on October 21, all fixed in 0.32.0. NLTK published eleven advisories yesterday for flaws its 3.10.4 release notes already cited, all fixed in 3.10.4 as covered on October 22. ONNX published five advisories on October 20 that this digest hadn't covered. Four now have CVEs (CVE-2026-115919 to CVE-2026-115922, 6.2 each), in which crafted models crash shape inference or read out of bounds; they're fixed in 1.22.0 (June 15), the fifth (4.0) in 1.23.0, and 1.23.2 is current. Two July records (5.5 and 3.3) are fixed in 1.22.0 as well.

Claude Code's CVE-2026-88968 (7.7 on v4), published yesterday: on macOS, a process inside the Bash sandbox could make an Edit write land outside the workspace. 2.1.251 fixed it on August 28; 2.1.311 is current. msgpack's GHSA-j586 (7.5), a memory leak in the C extension when map-key validation fails, now has CVE-2026-114613, and Microsoft added it to its update guide on Sunday. Only 1.2.2 is affected, 1.2.3 fixed it on September 29, and the record isn't in GitHub's database; vLLM and Ray install msgpack. Google filed CVE-2026-93328 (9.3 on v4) for MCP Toolbox for Databases 1.2.0 through 1.4.0, file exfiltration and overwrite through the cloud-storage source, fixed in 1.5.0 on June 18 (1.15.0 is current), and CVE-2026-85297 (7.7 on v4) for a bucket-name collision in the Cloud Run MCP server before 1.11.0 (September 28). VulnCheck's CVE-2026-116489 (7.5) covers pgvectorscale before 0.9.1 (September 4) and needs a database user with CREATE on the vectorscale schema. Rembg's CVE-2026-115924 (8.6), unauthenticated local file disclosure through its HTTP API, was fixed in 2.0.82 on September 2; 2.0.86 is current. Mem0's GHSA-5324, covered on October 21, now has CVE-2026-116575.

Standing items. MLflow has released nothing since 3.17.2, so the fix for CVE-2026-53995 is still on master only, while GitHub's record still names 3.17.2 as fixed. GitHub's records for .NET's CVE-2026-70197 and CVE-2026-102870 still name 8.0.32, 9.0.21 and 10.0.13; go by 8.0.33, 9.0.22 and 10.0.14. Open WebUI hasn't published the advisories its 0.12.4 notes promised. Aider's issue 5885 has no reply, and Hugging Face Datasets' PR 8879 is still open. MongoDB filed CVE-2026-115930 for the eMudhra intermediates in the Node.js runtime bundled with mongosh before 2.14.0; installed through npm, mongosh uses the host's Node.js, so update that instead. SGLang 0.5.22 is still the newest, with PRs 45017, 44314 and 44653 open. Unchanged: DB-GPT 0.8.2 with issue 3167 open, picomatch PR 194, Archon 0.12.1, Chroma 1.5.9, Portkey AI Gateway 1.15.2, BotSharp, Unla 0.10.0, the MCP Kotlin SDK 0.15.0, Vearch 3.5.9, openapi-typescript-codegen 0.31.0, cc-connect, pandas-ai 3.0.0, LightLLM v1.2.0, GPT-SoVITS, Langchain-Chatchat 0.3.1.3, BrowserSkill (PR 363 unmerged), AstronRPA 1.1.7 and mcp-remote 0.15.2.