VulnCheck pushed a batch of Knowns CVEs into NVD on the evening of September 7, 2026 — five of them fixed in 0.30.0, and one that says the flaw is still present in 0.33.0, the current release.
What happened
Between 10:17 p.m. and 11:16 p.m. UTC on September 7, 2026, VulnCheck published a run of CVE records against Knowns, an open-source AI knowledge and coding agent distributed on npm as knowns and developed as knowns-dev/knowns. Every record carries vulnStatus of Received and the assigner [email protected]. Each one links a GitHub security advisory, a VulnCheck advisory, and — unusually for a batch this size — direct line-number links into the vulnerable Go source at a tagged release.
The heaviest is CVE-2026-86542, published at 2026-09-07T23:16:54.020. Its description reads: “knowns before 0.30.0 fails to validate import names in the import routes, allowing unauthenticated attackers to write files outside the imports directory.” The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H for 9.1, Critical. The references point at internal/server/routes/imports.go at tag v0.29.1, lines 376–420 and 519–551, plus the fix commit and the 0.30.0 release tag.
Alongside it: CVE-2026-86439, 8.8, “knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and delete files outside the project directory”; CVE-2026-86541, 8.3, path traversal in handleCodeReplace(); CVE-2026-86540, 7.8, failure to validate the settings.lsp.languages binary field in project configuration files; and CVE-2026-86538, 7.5, path traversal in POST /api/templates/preview. All five name 0.30.0 as the unaffected version.
The sixth does not. CVE-2026-86539 reads: “knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to caller-supplied destinations without validation. Attackers can enumerate internal hosts and cloud metadata endpoints by observing transport error messages that reveal network reachability information.” Its affected range runs from 0 through 0.33.0, and no fixed or unaffected version is listed. Its source references point at internal/server/routes/embedding_models.go at tag v0.33.0 — not at 0.29.1 like the others, but at the newest release.
So one batch, published in the same minute, splits along the fix line. Five flaws were closed three releases ago. One is described as reaching the current release with nowhere to upgrade to.
The GitHub advisory behind the MCP path traversal, GHSA-9gfj-28hw-jchp, is titled “Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools.” It gives the same 8.8 vector, names 0.30.0 as patched, and credits two reporters, uziii2208 and hoanggxyuuki. It also carries detail the CVE description does not: the storage functions in doc_store.go and memory_store.go call filepath.Join() on caller-supplied paths without a containment check, and separately, the docs.update action with a newPath argument performs a delete while being classified as CapWrite rather than CapDelete — an authorization bypass filed under CWE-863 alongside the traversal. The advisory’s publication date is August 16, 2026. The CVE record landed three weeks later.
There is prior history on the same tools. NVD already carries CVE-2026-30632 and CVE-2026-30633, both published July 21, 2026, both 7.5, both CWE-22: “Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted folder name value to the create_doc tool,” and the same via “crafted path value to the get_doc and update_doc tools.” Those are the July names for the doc tools that reappear in the August advisory as docs.create, docs.get, and docs.update. Neither July record names a fixed version.
Why it matters
Read the two severity systems on a single record and they do not agree. CVE-2026-86542 is 9.1 Critical under CVSS v3.1 and 8.8 High under CVSS v4.0 — same flaw, same record, two labels. CVE-2026-86539 is worse: 7.2 High under v3.1 and 6.9 Medium under v4.0. A triage rule that promotes anything labeled High and defers anything labeled Medium will produce opposite outcomes on the same record depending only on which metric block the tooling reads first. That is not a scoring error by VulnCheck — publishing both is good practice — but it is a real operational hazard for anyone whose pipeline reads one and ignores the other.
The split fix line is the sharper problem. A team that sees six Knowns CVEs land at once will reach for the obvious remediation: upgrade past the version they all name. Five of these say 0.30.0. Doing exactly that leaves the SSRF open, because that record’s range runs through 0.33.0 and the maintainers are already on 0.33.0. The batch reads like a cleared backlog, and it isn’t one. This is the inverse of the pattern this site keeps finding in vendor bulletins, where a real fix hides behind a record that understates it. Here the record is accurate and the shape of the batch is misleading — a majority of fixed items lends borrowed credibility to the one item that is not fixed.
The recurrence matters too. The same doc tools produced directory traversal CVEs at 0.11.4 in July and again at 0.29.1 in August, under renamed but recognizably identical operations. That is not a single missed bounds check; it is a storage layer whose contract does not include containment, being fixed one caller at a time. The August advisory’s authorization finding says the same thing from another angle: a delete operation reached through docs.update was gated as a write, so the capability model and the code disagreed about what the operation actually was. This publication has now documented that exact disagreement in three unrelated codebases in two weeks.
Finally, the category. MCP tool arguments are attacker-adjacent input by construction — the whole point of the protocol is that a model, steered by content it reads, chooses the arguments. A path field in an MCP tool call is closer to a URL parameter than to a config value, and it needs the same containment discipline. Knowns is not a large deployment, and nothing here is exploited. What makes it worth writing down is that the failure is generic: an agent runtime with a document store, a memory store, an import route, a template preview, and an embedding-model tester managed to leak path or destination control out of five of them at once.
What to do
- Upgrade Knowns to 0.33.0 or later. 0.30.0 closes CVE-2026-86439, CVE-2026-86538, CVE-2026-86540, CVE-2026-86541, and CVE-2026-86542; there is no reason to stop there.
- Do not treat the upgrade as closing CVE-2026-86539. As published, that record names no fixed version and its range includes 0.33.0. Track it separately and watch
GHSA-qx9v-m9gg-p5jgfor a patched release. - Until the SSRF is fixed, do not expose
POST /api/embedding-models/test. It requires no authentication under its own vector (PR:N) and the described leak is transport error text, so blocking egress alone is not enough — restrict who can reach the endpoint. On cloud hosts, enforce IMDSv2 or equivalent. - If you run the Knowns MCP server, check what it can reach. The path traversal escapes the project directory; the process’s own filesystem permissions are the only remaining boundary. Run it unprivileged, in a container, with the document root mounted and nothing else.
- Read the CVSS v4.0 block, not only v3.1. Two records in this batch carry different severity words in the two systems. Pick one system per pipeline and apply it consistently.
Sourcing note
Checked: NVD API records for CVE-2026-86439, CVE-2026-86538, CVE-2026-86539, CVE-2026-86540, CVE-2026-86541, and CVE-2026-86542, each retrieved individually or from the September 7, 2026 publication window; the NVD keyword query for knowns-dev, which returned CVE-2026-30632 and CVE-2026-30633 from July 21, 2026; and GitHub security advisory GHSA-9gfj-28hw-jchp. Version data, CVSS vectors, and descriptions are quoted from those records.
Not verified independently: the source line ranges named in the CVE references were not read; this page reports that the records point at them. The VulnCheck advisory pages were not retrieved separately from the CVE records that cite them, and GHSA-qx9v-m9gg-p5jg, the advisory behind the SSRF, was not retrieved — the “no fixed version” statement for CVE-2026-86539 comes from the NVD record’s own version data, and if a patched release exists that the record does not reflect, this page will need a dated correction.
Unresolved: whether CVE-2026-86539 is genuinely unfixed at 0.33.0 or whether the record simply predates a fix. Its reference set points at v0.33.0 source, which is consistent with unfixed, but the maintainers were not contacted. No exploitation of any of these flaws is reported by any source reviewed here, and none of them carries CISA KEV fields.