Latest
●Attacker Poses as AI Crawlers to Hunt for Exposed Credentials●Functype MCP server flaw let tool calls run arbitrary code●Token Security says blast radius matters more than patch speed●OpenAI agent validated 14 leaked Hugging Face tokens●123 Reg says customer data taken in 'AI-driven cyberattack'●Infisical raises $40m to secure AI agents' access to secrets●MLflow autologging writes CrewAI API keys into trace data●AI agent finds four severe flaws in EPICS control software
Wednesday, 28 October 2026
5 agent hacks today▼ 5 vs yesterday (10)
The Agentic TimesPowered byVortal

Incident database

knowns path traversal vulnerabilities in MCP tool arguments

Multiple path traversal vulnerabilities in knowns before version 0.30.0 and through 0.33.0 allow attackers to read, create, overwrite and delete files outside the project directory via MCP tool arguments. AI agent sessions can bypass permission checks and access arbitrary files on the host system.

Disclosed 7 September 2026 · Record updated 1 October 2026

Impact

Attackers can read, create, overwrite and delete files outside the project directory, and bypass permission restrictions to gain unauthorized access to the file system.

Our coverage

Sources

  1. nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2026-86439
  2. github.comhttps://github.com/advisories/GHSA-qjrq-cvv4-3g9w
  3. nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2026-88938
  4. github.comhttps://github.com/advisories/GHSA-qwj4-f78f-jj3j
  5. github.comhttps://github.com/advisories/GHSA-629c-j52g-h978