SECURITY INTEL · MONTHLY

2026-07 CleanSource Community Monthly Security Intelligence Digest

Based on Sectrend's CSSA vulnerability intelligence system and open source registry poisoning monitoring, this report aggregates 200 security advisories published in July 2026, covering AI agent frameworks, the MCP ecosystem, enterprise applications, developer toolchains, databases and cloud services, presenting the month's software supply chain risk landscape and remediation guidance.

200Advisories

28CSSA exclusive

39CVE highlights

133Poisoning alerts

01Monthly Overview

Monthly Overview

July saw 200 advisories, a 45% increase over June (138). Three key findings: the AI agent ecosystem is now the dominant vulnerability battleground, MCP has emerged as a distinct attack surface, and dependency confusion targeting enterprise internal package names has scaled up sharply.

CSSA exclusive · 14.0%

Deserialization / missing auth / command injection / agent privilege abuse

CVE highlights · 19.5%

RCE / authentication bypass / unauthenticated MCP / privilege escalation

133

Supply chain poisoning · 66.5%

Dependency confusion / C2 communication / credential theft / internal package impersonation

Poisoning rose from 51.4% of advisories in June to 66.5%, an 87% increase in absolute terms (71→133) — the most pronounced shift this month.

02Key Trends

Key Trends

T1AI agent frameworks are now the dominant vulnerability battleground

17 of 28 CSSA exclusive advisories (61%) originate in the AI/agent ecosystem, up from 40% in June. The attack surface spans deserialization, plugin auto-loading, sandbox escape, prompt injection and credential leakage; 21 scored a perfect CVSS 10.0, concentrated in projects with tens of thousands of stars.

hermes-agentclaude-codebrowser-usecrewAILocalAInanobotsglangDeepSeek-ReasonixKotaemonQwenPawadk-pythonelizaOSDB-GPTCamelopen-swe+2

T2MCP emerges as a distinct attack surface for the first time

July brought three MCP-specific CVEs, all scoring 10.0, marking the Model Context Protocol's transition from concept to real target. Poisoning monitoring also surfaced impersonating components such as sidecar-mcp and mcp-notes-server-poc. All three CVEs point to the same structural defect: no authentication by default combined with high-privilege credentials.

CVE-2026-59726RufloMCP 端点默认无认证 · 10.0

CVE-2026-66012SiYuanMCP 接口未授权访问 · 10.0

CVE-2026-16498terraform-mcp-server跨租户凭证重用 · 10.0

T3Dependency confusion against enterprise internal package names scales up

The most distinctive new pattern this month is bulk registration of names matching specific companies' internal packages, with attackers using abnormally high version numbers (99999.0.0, 999.0.0, 99.9.1) to win dependency resolution priority. This attack does not rely on typos — it precisely targets the namespace of private enterprise registries, and a misconfigured internal mirror or wrong resolution order lets the malicious package straight into the build environment.

Game engine toolchain impersonation

robomergeue-automation-scriptsue-jenkins-buildkiteunreal-horde-dashboardepic-internal-tools

E-commerce and cloud platform internal components

aone-kitaone-kit-cliaone-sandboxaone-cloud-clilib-mtoplzd-unified-station-sdk

Financial service impersonation

commonweb-cardcommonweb-walletcommonweb-moneymovementconsumerweb-calurlsidentityauthorizationservriskunifiedgatewayservstargateproxyserv

Web3 / crypto ecosystem disguise

polymarket-toolkiteth-wallet-helpersethereum-lib-utilschain-sdk-jsabi-encodedefi-kittronwe

T495% of CVE highlights are critical, with AI/ML infrastructure near 40%

37 of 39 selected CVEs score CVSS ≥9.0 (94.9%), including 7 at a perfect 10.0. AI/ML accounts for 15 (38%), spanning LLaMA-Factory, Crawl4AI, mem0, Langroid, Flowise, LightRAG, ktransformers and NVIDIA AIStore. Traditional enterprise software is under equal pressure: Oracle Platform Security for Java (10.0), Microsoft Entra Provisioning Service (9.9), WebPros Plesk (9.9), the Apache family (Kylin / Thrift / Fory / Gravitino), SQLite, Firefox and Zoom.

03Deep Dive

Deep Dive

CSSA exclusive advisories · type distribution

Missing authorization and authentication (CWE-862/306/285)17.9%

Deserialization of untrusted data (CWE-502)14.3%

Command and code injection (CWE-78/94)14.3%

Path traversal (CWE-22)7.1%

Credential and session defects (CWE-522/613)7.1%

Other (TOCTOU / XXE / missing integrity check)39.3%

By component type, AI agent frameworks account for 61% (infrastructure and gateways 18%, enterprise applications 11%, other 10%). Deserialization returning to the top reflects a clear trend — AI frameworks routinely enable unsafe object reconstruction paths to support dynamic model and plugin loading. Affected projects include hermes-agent (215K★), claude-code (139K★), browser-use (103K★) and crewAI (56K★).

CVE highlights · domain distribution

AI / ML infrastructure and MCP38%

Enterprise applications and office suites23%

Databases and middleware18%

Developer tooling and CI/CD13%

Other (browsers / IoT / network devices)8%

Remote code execution dominates (around 55%), followed by authentication bypass and unauthorized access (around 30%). Worth noting is CVE-2026-44359 (Meshtastic CI workflow fork code execution, 10.0) — the attack surface has extended from runtime into the CI/CD pipeline itself.

Poisoning landscape · registry distribution

npm 121 · 91.0%PyPI 9.0%

Three staple malicious behaviors: C2 communication with malicious domains, unauthorized command execution on developer machines, and theft of environment variables, tokens and SSH keys. Technique evolution this month: abnormal version numbers to win resolution priority are now standard; some packages carry full-compromise warnings instructing immediate key rotation from a separate machine; and staged payloads appeared, where the first version is harmless and a later minor release introduces remote fetching.

04Recommendations

Recommendations

R1Urgent triage and remediation

Development

Audit dependency inventories, focusing on affected versions of hermes-agent / browser-use / crewAI / LocalAI / sglang / Kotaemon / DB-GPT / adk-python / elizaOS / QwenPaw
Prioritize upgrades: Orkes Conductor 3.30.2+, Crawl4AI 0.9.0+, terraform-mcp-server 1.1.0+, SiYuan v3.7.2+, Apache Fory C++ 1.4.0+, Apache Thrift 0.24.0+, node-tar 7.5.19+, Xlight FTP 3.9.5+, apache-airflow-providers-fab 3.7.3+
Scan dependency trees for the 133 poisoned packages, paying particular attention to public packages sharing names with your internal ones; remove on discovery and clear node_modules / venv caches
fastjson2 users should enable SafeMode (-Dfastjson2.parser.safeMode=true) or switch to the noneautotype build

Security

Run admission audits on every MCP server: provenance verification, tool description injection screening, declaration-implementation consistency, credential scope
Restrict internet-exposed AI inference and orchestration services (Flowise / LocalAI / DB-GPT / LLaMA-Factory / mem0) to trusted internal sources
Verify resolution order in internal registries so private packages take precedence over public sources
Monitor anomalous egress, DNS queries and shell execution logs on developer machines

R2Strengthen secure development practice

Development

Disable native deserialization (pickle and equivalents) in AI frameworks in favor of structured data formats; where object reconstruction is required, enforce a class allowlist
Secure defaults for MCP and agent tools: authentication on by default, least privilege, human confirmation for sensitive actions
Strict allowlist validation for path, command and SQL input; standardize parameterized queries and array-form subprocess invocation
Follow the OAuth 2.0 specification for session and token management, issuing server-side revocation on logout

Security

Integrate SAST / DAST into CI/CD with emphasis on CWE-22 / 78 / 94 / 306 / 434 / 502 / 862
Build a dedicated AI/agent audit checklist: deserialization paths, plugin loading integrity, prompt injection, sandbox escape, credential lifecycle
Audit CI/CD workflows: prohibit checking out and executing external fork code in pull_request_target events
Subscribe to CleanSource daily, weekly and monthly intelligence to shift the response window forward to community disclosure

R3Supply chain governance

Development

Pin exact dependency versions and prohibit floating ^ / ~ / latest ranges
Enable strict modes: npm ci, pip install --require-hashes, and lockfile integrity verification
Protect your internal namespace: pre-register the corporate prefix (such as @company/) on public registries to block dependency confusion
Impose an observation period on newly introduced dependencies and treat abnormally high version numbers as a warning sign

Security

Deploy SCA for continuous dependency scanning across source, binaries and container images
Establish an incident response plan for poisoned packages: takedown, notification, rollback and credential rotation
Configure internal mirrors for internal-first resolution so public sources cannot override same-named private packages
Apply EDR and egress traffic auditing on developer machines and build servers

R4Defense in depth

Development

Strictly sandbox agent runtimes: minimal container privileges, no host socket mounts, restricted network egress
Run external code in a dedicated sandbox (gVisor / Firecracker / E2B) with a read-only filesystem
Isolate agent credentials per task, minimize scope, keep them independently revocable
Layered encryption and minimal visibility for sensitive data, model artifacts and credentials

Security

Build four-layer defense across perimeter, host, application and data: WAF+IDS, EDR+HIDS, RASP+WAAP, DLP+encryption
Deploy an LLM firewall / AI gateway: prompt injection detection, unauthorized tool call interception, sensitive data masking
Full audit trails for MCP and agent tool invocations
Sign and verify CI/CD artifacts (Sigstore / Cosign)

Monthly digest · straight to your inbox

Subscribe to Sectrend's monthly security intelligence digest — one email a month with the full open source supply chain risk picture.

Subscribe →

Published by CleanSource Community ｜ Date: 2026-08-03
Sources: Sectrend CSSA vulnerability intelligence (270k+ advisories) · open source registry poisoning monitoring ｜ Please credit the source when redistributing