Severity Daily

IT and AI security incidents, checked against the primary source

Tag: Knowns

  • A 10.0 under attack, two unfixed 9.8s, and not a version number among them

    A 10.0 under attack, two unfixed 9.8s, and not a version number among them

    Adobe published APSB26-146 on Labor Day afternoon and said, in one sentence of its own, that it is “aware of CVE-2026-75650 being exploited in the wild” — a CVSS 10.0 unauthenticated code-execution flaw reaching every supported branch of Adobe Commerce and Magento Open Source. That is the day’s top item, and the timing says more than the score does. Adobe’s regularly scheduled September release is set for September 8. It shipped out of band anyway, into a US federal holiday evening, with the NVD record landing after 5 p.m. Eastern. A vendor that gives up one day of coordination on a product this widely deployed is making a judgment about how bad this is, and that judgment is the more honest read.

    The day had a thread, and it is not a record-quality problem. Today’s records are clear. What they lack is a version. Adobe’s “Updated Version” column contains the string “Hotfix for CVE-2026-75650” — prose where a build number belongs — so nothing that answers “are we patched?” by comparing a version to a range can confirm this fix. Red Hat published two 9.8s and was equally plain: the FreeIPA record lists no fixed package for any affected product, and the 389 Directory Server record lists 31 affected products, one unaffected, and zero fixed. Neither record is wrong. The remediation does not exist yet, and the vendor says so in the remediation field.

    Those two Red Hat records are the second thing to deal with, and they are one attack chain rather than two bugs. FreeIPA’s description says the flaw is exploited “combined with a related flaw in the underlying directory server’s ACI evaluation (tracked separately)”; that companion, CVE-2026-76560, published an hour later and scored 7.5, is the load-bearing half of the 9.8. Red Hat says it independently confirmed the technique against a default, unmodified installation. What it offers in the meantime is a firewall rule for FreeIPA and, for the directory server, removing PLAIN from the SASL mechanisms the server will negotiate — the better of the two, because it addresses the mechanism instead of the reachability, though it asks administrators to introduce an explicit allow-list into deployments that, by Red Hat’s own account, mostly do not have one.

    The inverse case is Advantech’s WISE-6610 gateway, where the fix shipped weeks ago in firmware 1.2.4_20260821 and no advisory was published for any of the three root command injections it closes — one of which has had a working public exploit since February. Below that the day turns to scoring and record quality rather than urgency: MediaTek labels three flaws High that its own CVSS v3.1 scores put at Medium, on a bulletin that states it grades by CVSS v3.1; h3’s cookie-loop hang is Moderate to the project and High to VulnCheck, and the whole 2.2-point gap is one availability metric, with the only fix a pre-release build; the Knowns batch closed five flaws in 0.30.0 and left a sixth described as reaching 0.33.0, the current release, with nowhere to upgrade to; and Bilibili Desktop turns off TLS certificate verification process-wide and names no fixed version either. Ardent Health’s 8-K is the one item that is not a vulnerability at all: the SEC made the company drop $97.7 million in non-GAAP add-backs, and the carve-out for its November 2023 ransomware attack survived untouched.

    Still open. CVE-2026-75650 is not in CISA’s Known Exploited Vulnerabilities catalog as of this writing, so the one flaw confirmed under attack today carries no federal remediation deadline. Adobe’s next scheduled release is September 8, and APSB26-146 credits researchers against five CVE identifiers that do not appear in its own vulnerability table. The publication date of Sansec’s StyleSmuggler writeup — September 5 or September 7 — is unresolved. And Red Hat’s zero-fixed count now spans 31 products on one record and 41 on the other, eleven days after an earlier FreeIPA privilege-escalation flaw that still has none.

  • Six Knowns CVEs landed together on September 7 — five are fixed in 0.30.0, and one says the flaw reaches 0.33.0

    Six Knowns CVEs landed together on September 7 — five are fixed in 0.30.0, and one says the flaw reaches 0.33.0

    VulnCheck pushed a batch of Knowns CVEs into NVD on the evening of September 7, 2026 — five of them fixed in 0.30.0, and one that says the flaw is still present in 0.33.0, the current release.

    What happened

    Between 10:17 p.m. and 11:16 p.m. UTC on September 7, 2026, VulnCheck published a run of CVE records against Knowns, an open-source AI knowledge and coding agent distributed on npm as knowns and developed as knowns-dev/knowns. Every record carries vulnStatus of Received and the assigner [email protected]. Each one links a GitHub security advisory, a VulnCheck advisory, and — unusually for a batch this size — direct line-number links into the vulnerable Go source at a tagged release.

    The heaviest is CVE-2026-86542, published at 2026-09-07T23:16:54.020. Its description reads: “knowns before 0.30.0 fails to validate import names in the import routes, allowing unauthenticated attackers to write files outside the imports directory.” The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H for 9.1, Critical. The references point at internal/server/routes/imports.go at tag v0.29.1, lines 376–420 and 519–551, plus the fix commit and the 0.30.0 release tag.

    Alongside it: CVE-2026-86439, 8.8, “knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and delete files outside the project directory”; CVE-2026-86541, 8.3, path traversal in handleCodeReplace(); CVE-2026-86540, 7.8, failure to validate the settings.lsp.languages binary field in project configuration files; and CVE-2026-86538, 7.5, path traversal in POST /api/templates/preview. All five name 0.30.0 as the unaffected version.

    The sixth does not. CVE-2026-86539 reads: “knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to caller-supplied destinations without validation. Attackers can enumerate internal hosts and cloud metadata endpoints by observing transport error messages that reveal network reachability information.” Its affected range runs from 0 through 0.33.0, and no fixed or unaffected version is listed. Its source references point at internal/server/routes/embedding_models.go at tag v0.33.0 — not at 0.29.1 like the others, but at the newest release.

    So one batch, published in the same minute, splits along the fix line. Five flaws were closed three releases ago. One is described as reaching the current release with nowhere to upgrade to.

    The GitHub advisory behind the MCP path traversal, GHSA-9gfj-28hw-jchp, is titled “Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools.” It gives the same 8.8 vector, names 0.30.0 as patched, and credits two reporters, uziii2208 and hoanggxyuuki. It also carries detail the CVE description does not: the storage functions in doc_store.go and memory_store.go call filepath.Join() on caller-supplied paths without a containment check, and separately, the docs.update action with a newPath argument performs a delete while being classified as CapWrite rather than CapDelete — an authorization bypass filed under CWE-863 alongside the traversal. The advisory’s publication date is August 16, 2026. The CVE record landed three weeks later.

    There is prior history on the same tools. NVD already carries CVE-2026-30632 and CVE-2026-30633, both published July 21, 2026, both 7.5, both CWE-22: “Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted folder name value to the create_doc tool,” and the same via “crafted path value to the get_doc and update_doc tools.” Those are the July names for the doc tools that reappear in the August advisory as docs.create, docs.get, and docs.update. Neither July record names a fixed version.

    Why it matters

    Read the two severity systems on a single record and they do not agree. CVE-2026-86542 is 9.1 Critical under CVSS v3.1 and 8.8 High under CVSS v4.0 — same flaw, same record, two labels. CVE-2026-86539 is worse: 7.2 High under v3.1 and 6.9 Medium under v4.0. A triage rule that promotes anything labeled High and defers anything labeled Medium will produce opposite outcomes on the same record depending only on which metric block the tooling reads first. That is not a scoring error by VulnCheck — publishing both is good practice — but it is a real operational hazard for anyone whose pipeline reads one and ignores the other.

    The split fix line is the sharper problem. A team that sees six Knowns CVEs land at once will reach for the obvious remediation: upgrade past the version they all name. Five of these say 0.30.0. Doing exactly that leaves the SSRF open, because that record’s range runs through 0.33.0 and the maintainers are already on 0.33.0. The batch reads like a cleared backlog, and it isn’t one. This is the inverse of the pattern this site keeps finding in vendor bulletins, where a real fix hides behind a record that understates it. Here the record is accurate and the shape of the batch is misleading — a majority of fixed items lends borrowed credibility to the one item that is not fixed.

    The recurrence matters too. The same doc tools produced directory traversal CVEs at 0.11.4 in July and again at 0.29.1 in August, under renamed but recognizably identical operations. That is not a single missed bounds check; it is a storage layer whose contract does not include containment, being fixed one caller at a time. The August advisory’s authorization finding says the same thing from another angle: a delete operation reached through docs.update was gated as a write, so the capability model and the code disagreed about what the operation actually was. This publication has now documented that exact disagreement in three unrelated codebases in two weeks.

    Finally, the category. MCP tool arguments are attacker-adjacent input by construction — the whole point of the protocol is that a model, steered by content it reads, chooses the arguments. A path field in an MCP tool call is closer to a URL parameter than to a config value, and it needs the same containment discipline. Knowns is not a large deployment, and nothing here is exploited. What makes it worth writing down is that the failure is generic: an agent runtime with a document store, a memory store, an import route, a template preview, and an embedding-model tester managed to leak path or destination control out of five of them at once.

    What to do

    • Upgrade Knowns to 0.33.0 or later. 0.30.0 closes CVE-2026-86439, CVE-2026-86538, CVE-2026-86540, CVE-2026-86541, and CVE-2026-86542; there is no reason to stop there.
    • Do not treat the upgrade as closing CVE-2026-86539. As published, that record names no fixed version and its range includes 0.33.0. Track it separately and watch GHSA-qx9v-m9gg-p5jg for a patched release.
    • Until the SSRF is fixed, do not expose POST /api/embedding-models/test. It requires no authentication under its own vector (PR:N) and the described leak is transport error text, so blocking egress alone is not enough — restrict who can reach the endpoint. On cloud hosts, enforce IMDSv2 or equivalent.
    • If you run the Knowns MCP server, check what it can reach. The path traversal escapes the project directory; the process’s own filesystem permissions are the only remaining boundary. Run it unprivileged, in a container, with the document root mounted and nothing else.
    • Read the CVSS v4.0 block, not only v3.1. Two records in this batch carry different severity words in the two systems. Pick one system per pipeline and apply it consistently.

    Sourcing note

    Checked: NVD API records for CVE-2026-86439, CVE-2026-86538, CVE-2026-86539, CVE-2026-86540, CVE-2026-86541, and CVE-2026-86542, each retrieved individually or from the September 7, 2026 publication window; the NVD keyword query for knowns-dev, which returned CVE-2026-30632 and CVE-2026-30633 from July 21, 2026; and GitHub security advisory GHSA-9gfj-28hw-jchp. Version data, CVSS vectors, and descriptions are quoted from those records.

    Not verified independently: the source line ranges named in the CVE references were not read; this page reports that the records point at them. The VulnCheck advisory pages were not retrieved separately from the CVE records that cite them, and GHSA-qx9v-m9gg-p5jg, the advisory behind the SSRF, was not retrieved — the “no fixed version” statement for CVE-2026-86539 comes from the NVD record’s own version data, and if a patched release exists that the record does not reflect, this page will need a dated correction.

    Unresolved: whether CVE-2026-86539 is genuinely unfixed at 0.33.0 or whether the record simply predates a fix. Its reference set points at v0.33.0 source, which is consistent with unfixed, but the maintainers were not contacted. No exploitation of any of these flaws is reported by any source reviewed here, and none of them carries CISA KEV fields.