Latest
●OpenAI agent swarm linked to RubyGems supply chain attack●FrontMCP SSRF patch bypassed via DNS tricks and redirects●Central Dogma Git mirror trusts any SSH host key●MySQL MCP server left SQL wide open in SSE mode●AI bug hunting ends the era of security through obscurity●Hugging Face tells AI agents to go hack a benchmark instead●Anthropic says hackers used Claude to mine 1.8M Android apps●Anthropic says Claude was abused to automate attacks and weapons work
Sunday, 13 September 2026
8 agent hacks today▲ 7 vs yesterday (1)
The Agentic TimesPowered byVortal

Incident database

Splunk MCP Server app logs session and authorization tokens in clear text (CVE-2026-20205)

In Splunk MCP Server app versions below 1.0.3, session and authorization tokens were recorded in clear text where a user with access to the Splunk `_internal` index or the `mcp_tool_admin` capability could view them. Exploitation requires local access to log files or administrative access to internal indexes, and the issue is addressed in version 1.0.3.

Disclosed 15 April 2026 · Record updated 13 September 2026

Impact

Privileged or local users could read other users' session and authorization tokens in clear text, potentially enabling account or session takeover.

Our coverage

No articles linked to this incident yet.

Sources

  1. nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2026-20205