{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-23T18:42:33.457Z",
  "tag": {
    "id": "mcp",
    "label": "MCP",
    "isStack": false,
    "url": "https://pwn.watch/t/mcp",
    "feed": "https://pwn.watch/t/mcp/feed.xml"
  },
  "counts": {
    "incidents": 2,
    "live": 1,
    "notFullyPatched": 0,
    "patched": 2
  },
  "incidents": [
    {
      "slug": "opencode-mcp-oauth-rce-windows",
      "title": "OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)",
      "url": "https://pwn.watch/i/opencode-mcp-oauth-rce-windows",
      "json": "https://pwn.watch/i/opencode-mcp-oauth-rce-windows.json",
      "status": "live",
      "severity": "critical",
      "patchStatus": "patched",
      "category": "patch",
      "product": "OpenCode AI coding agent (Anomaly) on Windows and WSL",
      "tags": [
        "ai",
        "devtools",
        "windows",
        "opencode",
        "mcp"
      ],
      "cveIds": [],
      "affectedVersions": [
        "OpenCode 1.0.137 through 1.18.32 on Windows and WSL"
      ],
      "fixedVersions": [
        "OpenCode 1.18.33"
      ],
      "startedAt": "2026-10-19",
      "closedAt": null,
      "updatedAt": "2026-10-23T18:41:32Z",
      "summary": "A command-injection flaw in the OpenCode AI coding agent let a malicious or later-hijacked remote MCP server run PowerShell commands on a developer's Windows or WSL machine when they started the MCP OAuth sign-in. The server-supplied authorization endpoint was passed unescaped to an old version of the open package. Anomaly fixed it in 1.18.33 on Sep 28 without a CVE or advisory, so scanners won't flag 1.0.137 through 1.18.32. macOS and Linux are not affected. Pillar Security found it and rates it 9.8; no in-the-wild exploitation reported.",
      "xPost": null
    },
    {
      "slug": "berriai-litellm-cve-2026-59822",
      "title": "BerriAI LiteLLM: BerriAI LiteLLM Improper Authentication Vulnerability",
      "url": "https://pwn.watch/i/berriai-litellm-cve-2026-59822",
      "json": "https://pwn.watch/i/berriai-litellm-cve-2026-59822.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "category": "patch",
      "product": "BerriAI LiteLLM",
      "tags": [
        "python",
        "ai",
        "litellm",
        "mcp",
        "cisa-kev",
        "auth-bypass"
      ],
      "cveIds": [
        "CVE-2026-59822"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-09-02",
      "closedAt": "2026-09-02",
      "updatedAt": "2026-09-02",
      "summary": "BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token. Added to CISA KEV on 2026-09-02.",
      "xPost": null
    }
  ],
  "posts": [
    {
      "authorName": "The Hacker News",
      "handle": "TheHackersNews",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1597647879811657728/FLgHrLHy_bigger.jpg",
      "text": "🚨 OpenCode flaw lets malicious MCP servers execute code on Windows and WSL when developers initiate sign-in.\n\nFixed in v1.18.33, but there's no CVE or security advisory. Vulnerability scanners won't flag affected versions.\n\nWhat developers need to know: https://t.co/l6N4LCjhWt",
      "date": "2026-10-22T10:44:40.000Z",
      "url": "https://x.com/TheHackersNews/status/2113219984365359340",
      "media": [],
      "incident": "opencode-mcp-oauth-rce-windows"
    }
  ],
  "changes": [
    {
      "incident": "opencode-mcp-oauth-rce-windows",
      "incidentTitle": "OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)",
      "category": "patch",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "The Hacker News reports the flaw; upgrade to 1.18.33, run `opencode mcp list`, and remove unvetted remote MCP servers.",
      "body": null,
      "sourceUrl": "https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html",
      "url": "https://pwn.watch/i/opencode-mcp-oauth-rce-windows"
    },
    {
      "incident": "opencode-mcp-oauth-rce-windows",
      "incidentTitle": "OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)",
      "category": "patch",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-19",
      "title": "Pillar Security discloses the flaw publicly. Anomaly declined to request a CVE, saying user-configured MCP servers are outside its trust boundary.",
      "body": null,
      "sourceUrl": "https://x.com/Pillar_sec/status/2112166888985722937",
      "url": "https://pwn.watch/i/opencode-mcp-oauth-rce-windows"
    },
    {
      "incident": "opencode-mcp-oauth-rce-windows",
      "incidentTitle": "OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)",
      "category": "patch",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-09-28",
      "title": "OpenCode 1.18.33 ships the fix as a routine browser-launch refactor; release notes don't mention security.",
      "body": null,
      "sourceUrl": "https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html",
      "url": "https://pwn.watch/i/opencode-mcp-oauth-rce-windows"
    },
    {
      "incident": "berriai-litellm-cve-2026-59822",
      "incidentTitle": "BerriAI LiteLLM: BerriAI LiteLLM Improper Authentication Vulnerability",
      "category": "patch",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-09-02",
      "title": "CISA added CVE-2026-59822 to the KEV catalog (due 2026-09-16).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/berriai-litellm-cve-2026-59822"
    },
    {
      "incident": "opencode-mcp-oauth-rce-windows",
      "incidentTitle": "OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)",
      "category": "patch",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-08-29",
      "title": "Pillar Security privately reports the flaw to Anomaly.",
      "body": null,
      "sourceUrl": "https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html",
      "url": "https://pwn.watch/i/opencode-mcp-oauth-rce-windows"
    }
  ]
}