Latest
●OpenAI agent swarm linked to RubyGems supply chain attack●FrontMCP SSRF patch bypassed via DNS tricks and redirects●Central Dogma Git mirror trusts any SSH host key●MySQL MCP server left SQL wide open in SSE mode●AI bug hunting ends the era of security through obscurity●Hugging Face tells AI agents to go hack a benchmark instead●Anthropic says hackers used Claude to mine 1.8M Android apps●Anthropic says Claude was abused to automate attacks and weapons work
Sunday, 13 September 2026
8 agent hacks today▲ 7 vs yesterday (1)
The Agentic TimesPowered byVortal

Incident database

NextCRM MCP API Missing Role Checks in Product Operations

NextCRM version 0.12.1 fails to enforce role-based access controls in its MCP product tools API, allowing any authenticated low-privileged user with an MCP API token to create, modify, archive, or delete products in the shared CRM catalog. The vulnerability was fixed in version 0.12.3.

Disclosed 20 July 2026 · Record updated 13 September 2026

Impact

Low-privileged authenticated users can bypass role-based access controls to manipulate shared product catalog data through the MCP API.

Our coverage

No articles linked to this incident yet.

Sources

  1. nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2026-55550