Post cover image

August 22, 2026

Client-Controlled Launch, Redirect, Session, Header: Missing Bind, Pin, Cap, Allow-List, and…

One missing control at the launch, redirect, session, or header seam is the bug.

By FengNing_Architect

6 min read

THIRD-PARTY ANALYSIS

I did not find these records. We re-fetched the primaries on 22 August 2026. A version conflict stays a conflict.

The product treats a client-, document-, or session-controlled launch, redirect, session, or header as an already-authorized boundary.

01 | Overview

CVE-2026–72848 — langchain-community SitemapLoader.parse_sitemap applies restrict_to_same_domain only to leaf <url> entries; nested <sitemap> loc passes to scrape_all / aiohttp GET with no domain compare, no private/loopback/link-local check. geo-chen.

CVE-2026–54449 — LangBot Extensions MCP StdioServerParameters starts a logged-in user's STDIO command/args as a server-side subprocess. No who-may-change boundary, no command allow-list. Table CWE-77; GHSA prose also CWE-78. Already on @Innora_sg 21 August — not a new Innora find.

CVE-2026–77068 — @n8n/workflow-sdk turns an authenticated global:member node-type string into a schema module path with no traversal reject, executing in the n8n MAIN process. PR:L, not unauthenticated. GHSA this fetch: "No known CVE" / no CWE; VulnCheck later assigned both. Pulse, not a new Alert.

CVE-2026–77776 / CVE-2026–77775 — Headroom LLM proxy. x-headroom-user-id is the memory owner with nothing binding the header to the caller. x-headroom-base-url chooses upstream after http/https + hostname parse; no loopback, link-local, or RFC 1918 reject; Authorization forwarded unchanged. pip binds 127.0.0.1; reference compose ships --host 0.0.0.0, no required HEADROOM_PROXY_TOKEN.

CVE-2026–59279 — Spring AI MCP Streamable HTTP (WebFlux and WebMvc) retains sessions with no cap and, by default, no client authentication. Repeat initialize → memory exhaustion for every client. CWE-770.

CVE-2026–64849 — MLflow unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test validates the original URL, then follows redirects with no address pin; /test returns response_status and response_body. @freeman-bb (12 June), independently @AUTHENSOR (26 June). CISA KEV 19 August, due 2 September.

Hugging Face timm checkpoint pickle (CVE-2026–15679) does not share this class. Appendix only.

02 | Root Cause

The missing control is not "MCP" and not "agents." It is the decision to treat a caller-named next hop as already authorized.

# conceptual seam — not a working exploit
next_hop = client_or_document_value   # command, loc, node-type, header, session
dispatch(next_hop)
# - missing: bind next_hop to the caller
# - missing: allow-list / pin / cap / traversal reject / re-validate after redirect

Every record in Section 01 is one instance of that seam. The existing control — domain restrict, login, role, header, initialize, URL validation — sits on the wrong side of the dispatch, or is not carried to the next hop.

Context7 Custom AI Instructions (CVE-2026–75130, Eli Ainhorn, Noma Security; through 2.1.2; CWE-1427; CNA 9.0 v3.1 and 6.4 v4.0; Noma production sanitization 23 February 2026) is the instruction-channel case we already posted on @Innora_sg. Adjacent, not a restatement, and not our find.

03 | Attack Path

Prerequisite: reach the data plane that accepts the named value — ingested sitemap, Extensions MCP form, global:member session, Headroom on a compose 0.0.0.0 bind, unauthenticated Spring AI Streamable HTTP, or default MLflow with no webhook auth.

  1. Name the hop — nested sitemap loc, STDIO command, node-type string, user-id or base-url header, new session, or public HTTPS webhook URL.
  2. Cross the seam — the product dispatches that value as launch, fetch, load, identity, or session retain.
  3. Skip the second check — no allow-list, no pin, no traversal reject, no session cap, no re-validate of the redirect target.
  4. Collect the impact — internal response in Documents; RCE as LangBot service or n8n MAIN process; another user's memory read or written; upstream fetch of internal data; memory exhaustion across all clients; /test reflecting response_body.

Impact. Confidentiality on the three CWE-918 SSRF records and the Headroom memory swap (CWE-639). Integrity and availability join on process launch (LangBot, n8n) or unbounded sessions (Spring AI).

04 | Affected & Fixed

CVEComponentAffected (this fetch)Fixed / noteScoreFinderCVE-2026–72848SitemapLoader.parse_sitemap≤ 0.4.2No official fix. NVD unsupported-when-assigned8.6 v3.1 / 7.7 v4.0geo-chenCVE-2026-54449LangBot mcp.py StdioServerParametersNVD ≤ 4.10.7; GHSA All / patched None; OX up to 4.10.0No official fix this review8.8OX SecurityCVE-2026-77068@n8n/workflow-sdk MCP node-schemabefore 2.33.4 / 2.34.x before 2.34.1 (NVD CPE 2.0.0–<2.33.4, 2.34.0–<2.34.1)2.33.4 / 2.34.18.7 v4.0Haruna38CVE-2026-77776Headroom x-headroom-user-id< 0.36.10.36.19.1 v3.1 / 9.3 v4.0Gregory Tan (Grg0rry)CVE-2026-77775Headroom x-headroom-base-url< 0.36.10.36.18.6 v3.1 / 7.7 v4.0Gregory Tan (Grg0rry)CVE-2026-59279Spring AI Streamable HTTP sessions2.0.0 only2.0.1 OSS / 2.0.0.1 Enterprise7.5discovered internallyCVE-2026-64849MLflow webhooks /testNVD prior to 3.15.0; GHSA ≤ 3.13.0 / patched noneNVD: 3.15.0. GHSA: patched none9.3 v3.1freeman-bb / AUTHENSOR

05 | Class

Four named families, each grounded in a primary:

  • OX STDIO MCP. LangBot is one row in OX Security's STDIO command-injection family advisory; we do not restake OX siblings as this essay's lead.
  • Webhook redirect SSRF. MLflow validates the first hop; delivery follows the next. CISA KEV, 19 August.
  • Streamable-HTTP session. Spring AI 2.0.0 — no session cap, default no auth.
  • Header-as-identity / header-as-upstream. Headroom's two headers are one product decision: the client names the owner or the next host.

n8n's node-type string and SitemapLoader's nested loc belong in the class.

06 | Fix, mitigation, self-check

  • Upgrade path. Apply the fixed builds in Section 04. Where no primary names a fix — LangBot, langchain-community SitemapLoader — treat the component as still exposed. MLflow NVD 3.15.0 vs GHSA patched none stays a conflict.
  • Boundary controls. If the caller names a command, URL, module path, session, or identity header, that name is untrusted until a control binds it: allow-list, pin through redirects, cap and authenticate sessions, reject traversal, reject private destinations, bind identity to token or OS user.
  • Safety-net. Bind LLM proxies to loopback unless an explicit token is required. Disable STDIO MCP when it is not a product requirement. Do not ingest untrusted sitemaps into affected SitemapLoader.
  • KEV. MLflow CVE-2026–64849 entered CISA KEV 19 August 2026; due 2 September. CISA asserts active exploitation. We do not invent campaign detail.

07 | Disclosure / analysis

THIRD-PARTY ANALYSIS. Innora did not discover any ID in this pack.

We re-fetched NVD, GHSA, VulnCheck, spring.io, ZDI, and CISA KEV on 22 August 2026 (MYT). LangBot 8.8 is GitHub CNA; NVD has no independent score.

Conflicts we do not resolve: LangBot versions (NVD ≤4.10.7 no fix, GHSA All/patched None, OX up to v4.10.0) and CWE-77 table vs CWE-78 prose; score pairs where v3.1 and v4.0 disagree (77776 9.1/9.3, 77775 8.6/7.7, langchain 8.6/7.7, Context7 9.0/6.4); langchain unsupported-when-assigned; MLflow NVD 3.15.0 vs GHSA patched none / ≤3.13.0; n8n GHSA shipped without CVE/CWE, later assigned by VulnCheck (CVE-2026-77068, CWE-22); timm NVD 1.0.24 vs ZDI v1.0.26. We do not claim a campaign around KEV. Pulse items (n8n 77068, timm 15679) stay Pulse — not new Alerts. LangBot and Context7 were already on @Innora_sg. Context7 credit remains Eli Ainhorn, Noma Security.

Appendix — CVE-2026–15679

Hugging Face timm checkpoint parsing deserializes untrusted data (CWE-502, UI:R). ZDI/CNA CVSS 3.0 7.8 HIGH. NVD lists affected 1.0.24 this fetch; ZDI-26–523 says fixed in v1.0.26. Credit: Michael DePlante (@izobashi), TrendAI Zero Day Initiative. Pickle deserialization, not a launch/redirect/session/header seam. Pulse only.

Sources

  1. NVD — CVE-2026–72848 — https://nvd.nist.gov/vuln/detail/CVE-2026-72848
  2. VulnCheck — SitemapLoader nested sitemap SSRF — https://www.vulncheck.com/advisories/langchain-community-sitemaploader-does-not-apply-restrict-to-same-domain-to-nested-sitemap-index-entries-allowing-server-side-request-forgery
  3. GitHub — langchain issue #38814 — https://github.com/langchain-ai/langchain/issues/38814
  4. NVD API — CVE-2026–54449 — https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-54449
  5. GHSA-3pvh-63gf-j9mw — https://github.com/langbot-app/LangBot/security/advisories/GHSA-3pvh-63gf-j9mw
  6. OX Security — MCP supply-chain advisory — https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem
  7. GHSA-6h4x-896x-fw5m — https://github.com/n8n-io/n8n/security/advisories/GHSA-6h4x-896x-fw5m
  8. NVD — CVE-2026–77068 — https://nvd.nist.gov/vuln/detail/CVE-2026-77068
  9. VulnCheck — n8n path traversal, credit Haruna38 — https://www.vulncheck.com/advisories/n8n-before-remote-code-execution-via-path-traversal
  10. NVD — CVE-2026–77776 — https://nvd.nist.gov/vuln/detail/CVE-2026-77776
  11. VulnCheck — Headroom user-id header, credit Gregory Tan (Grg0rry) — https://www.vulncheck.com/advisories/headroom-proxy-treats-the-client-supplied-x-headroom-user-id-header-as-an-authenticated-identity
  12. NVD — CVE-2026–77775 — https://nvd.nist.gov/vuln/detail/CVE-2026-77775
  13. VulnCheck — Headroom base-url SSRF, credit Gregory Tan (Grg0rry) — https://www.vulncheck.com/advisories/headroom-proxy-sends-upstream-requests-to-a-client-supplied-base-url-without-address-validation
  14. Headroom PR #2207 — https://github.com/headroomlabs-ai/headroom/pull/2207
  15. Spring — CVE-2026–59279 — https://spring.io/security/cve-2026-59279
  16. NVD — CVE-2026–59279 — https://nvd.nist.gov/vuln/detail/CVE-2026-59279
  17. GHSA-7gwp-5pfp-969j — https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j
  18. NVD — CVE-2026–64849 — https://nvd.nist.gov/vuln/detail/CVE-2026-64849
  19. CISA KEV alert 2026–08–19 — https://www.cisa.gov/news-events/alerts/2026/08/19/cisa-adds-one-known-exploited-vulnerability-catalog
  20. CISA KEV catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-64849
  21. MLflow v3.15.0 — https://github.com/mlflow/mlflow/releases/tag/v3.15.0
  22. NVD — CVE-2026–15679 — https://nvd.nist.gov/vuln/detail/CVE-2026-15679
  23. ZDI-26–523 — https://www.zerodayinitiative.com/advisories/ZDI-26-523/
  24. NVD — CVE-2026–75130 (mention only) — https://nvd.nist.gov/vuln/detail/CVE-2026-75130
  25. VulnCheck — Context7 (mention only) — https://www.vulncheck.com/advisories/context7-prompt-injection-via-custom-ai-instructions
  26. Noma — ContextCrush, Eli Ainhorn (mention only) — https://noma.security/blog/contextcrush-context7-the-mcp-server-vulnerability/
  27. Innora.ai — https://innora.ai

Defensive & educational use only.