October’s 18 publication packages contain 146 advisories. Four areas need priority checks: agent/MCP authentication and isolation, network device management and diagnostic interfaces, query and URL validation, and malicious payloads executed by dependencies. Statistics include only Simplified Chinese packages whose date starts with 2026-10; the 2026-11-01 range file covering 10-30–11-01 is excluded. Combined ranges and counting rules are listed at the end.
Statistics
Poisoning accounts for 73 records; 71 vulnerability records meet the critical threshold.
CSSA alerts: 34; CVE analyses: 39; poisoning samples: 73. The registry field splits poisoning into npm 62, PyPI 10 and gem 1. Critical counts only non-poisoning records with Number(score) ≥ 9.
Only published Simplified Chinese intelligence files for the month are counted. Each publication package counts once, including files with a range; records are not deduplicated across packages. These numbers therefore do not count distinct vulnerabilities or affected devices.
Trending
Unauthenticated MCP and agent endpoints, bypassable approval, and leaked sandbox credentials become remote execution surfaces.
openclaw’s macOS client can still auto-resolve unauthorized commands as allow-once even when a whitelist and human confirmation are configured. agentscope-java DataAgent falls back to a public default key when DATAAGENT_JWT_SECRET is unset, so role claims in tokens can forge administrator access. Kiro Crew (CVE-2026-112380) lacked authorization on the WhatsApp group channel before 0.7.2; a group member’s message can control other agent sessions and run commands on the host.
x64dbg-MCP Server (CVE-2026-107824) listens on 0.0.0.0 without authentication by default; fixed in 1.1. Google OSS Agent Mesh (CVE-2026-102503) lets the /libp2p-http ingress bypass Biscuit capability checks to call registered backends—upgrade to 0.1.0-alpha.3; the related CVE-2026-103091 opens OIDC registration by default and needs 0.1.0-alpha.9. NVIDIA NeMo Agent Toolkit (CVE-2026-65145) likewise allows remote execution when critical functions lack authentication.
Isolation also needs review: OpenSandbox Go SDK places the tenant API key into forwardable headers under proxy mode; the network isolation component can open all ports after DNS dynamic allowlisting. SGLang treats management endpoints as authorized when only a normal API key is set; the multimodal loader can read arbitrary local files. ogx does not validate private destinations for MCP server_url, so unauthenticated SSRF is possible by default; ComfyUI management APIs can install custom nodes without authentication when listening off loopback.
Also this month: AgentWorkforce Relay runs sensitive workflows from untrusted branch refs via workflow_dispatch; open-lovable APIs lack authorization and share global sandbox state; dspy Local binds 0.0.0.0 by default; deep-searcher can read files and change Provider config without auth; Appium Execute Driver escapes the sandbox to the host child_process.
Management and diagnostic interfaces on home and enterprise gateways, license platforms and messaging middleware remain the most direct takeover paths this month.
TOZED X300 (CVE-2026-108576) allows command injection via the Host parameter; TRENDnet TEW-751DR / 752DRU / 733GR (CVE-2026-108804) likewise allows remote injection through pigwidgeon.cgi, and the bulletin recommends retiring EOL models. Linksys E1700 (CVE-2026-108892) and Netcore NR268 (CVE-2026-108907) are a Mac Filter stack overflow and CGI authentication bypass; vendors did not respond early.
Wavlink WL-WN592AX6 (CVE-2026-109110) enables remote command injection in wmapd; WL-WN530BE2-A (CVE-2026-110957) should move to firmware 2026-09-24-841a51c6d5_tclinux.bin. Oray Pgyer X5 Pro (CVE-2026-116232) has CRLF injection in SNMP info.community; FireCluster Sync (CVE-2026-90465) lacks authentication on the cluster interconnect and can run firewall management as root.
Enterprise entry points also need lockdown: Cisco License On-Prem (CVE-2026-76482), HPE (CVE-2026-79844) and CVE-2026-79847 are critical remote-execution issues. Nacos silently allows @Secured APIs when the auth plugin is missing; RocketMQ ACL migration maps unknown permission strings to Action.ALL; gost middleware fails open without credentials, and Websoft9 proxy APIs can change reverse-proxy rules without authorization.
Expression engines, SQL assembly, proxy forwarding and URL host checks decide whether attacks reach the intranet or the database.
OpenTSDB’s /api/query/exp can drive JEXL expressions into Runtime.exec; the next day’s /q chart renderer can inject newlines into gnuplot scripts via double URL decoding. eladmin batch-executes uploaded .sql files; YesWiki (CVE-2026-116207) allows backtick injection on the public search API—fixed in 4.7.0 / 5.0.0-alpha4; Futurum Software (CVE-2026-14571) is blind SQL injection for database reads.
On the SSRF side: Supabase Studio edge-functions test endpoints lack authentication and weak host checks; InsForge bypasses the original-host limit with %2F%2F double slashes and forwards Authorization. Coreruleset can miss LIKE (SELECT ...) variants at PL1; the bulletin recommends PL2 or a rule-set update.
Identity and sessions need the same scrutiny: SOGo (CVE-2026-74864) trusts client-controlled x-webobjects-remote-user—upgrade to 5.8.0~ynh9 and strip the header in Nginx; gofr still accepts empty BasicAuth credentials; ProxySQL session variables can leak across connection-pool clients; CockroachDB SECURITY DEFINER checks fail for composite types.
npm accounts for 62 records; malicious behavior clusters around postinstall hooks, Baileys impersonation side effects, and PyPI/gem stealers or reverse shells.
Packages that act at install time include ultimate-websocket (postinstall pulls code from a non-registry GitHub URL), @sudobility/wildduck_client (postinstall fetches payloads from S3 for a persistence agent or XMRig) and @walknpm/todo-cli (postinstall miner with persistence). serpacksven, serpacksven2 and node-telegram-sockets are marked fully compromised on install—rotate secrets from a trusted device.
Baileys / WhatsApp impersonation recurs: kiyoramarkets, ichigo-baileys and rubbydev-crash-baileys subscribe authenticated sessions to attacker channels; @kxafunc/xbails aliases libsignal to a floating latest and can enter the end-to-end crypto path. Cosmetic utility names such as tailwind-* and css-* also recur, for example tailwind-base-buttons and tailwindcss-theme-kit.
On PyPI, sysdiagd pretends to be system monitoring but runs a Discord-bot stealer; iterquarry pairs with libseal to decrypt and execute payloads; shellgrip acts as a remote-script loader; claudeopuseni pulls steganographic code from images and reaches C2 resolved from Polygon history. The gem zzhelloworld_socktest was recorded communicating with 66.78.40.218:32768 and opening a reverse shell.
Deep Dive
Prioritize by exposure, execution privilege and how dependencies trigger.
Of 73 poisoning samples, npm accounts for 62, PyPI for 10 and gem for 1. This is the observed distribution in this month’s packages, not evidence that other ecosystems are safer.
openclaw rewrites approval results on the client; agentscope-java’s default JWT key forges administrators; Agent Mesh ingress and registration policies fail open. Execution, token validation and mesh policy each need independent checks.
FireCluster requires presence on the cluster interconnect; Kiro Crew requires WhatsApp group membership; TRENDnet entries map to EOL firmware. Beyond scores, confirm component versions, whether features are enabled, and whether the entry point is reachable.
Summary
Confirm affected components and runtime configuration before patching and forensics.
0.1.0-alpha.3 (CVE-2026-102503) and 0.1.0-alpha.9 (CVE-2026-103091); upgrade Kiro Crew to 0.7.2 or later.server_url.5.8.0~ynh9 and strip x-webobjects-remote-user.ultimate-websocket, @sudobility/wildduck_client, @walknpm/todo-cli, kiyoramarkets, ichigo-baileys and @kxafunc/xbails; verify provenance and pinned versions.sysdiagd, iterquarry/libseal, shellgrip, claudeopuseni, and the gem zzhelloworld_socktest.serpacksven, serpacksven2 or node-telegram-sockets (marked fully compromised), isolate for forensics and rotate credentials from a trusted device; removing the package does not clear an intrusion.claudeopuseni on-chain C2 in investigations, along with postinstall child processes and leftovers.workflow_dispatch; restrict deep-searcher file paths and Provider-change APIs.66.78.40.218:32768) and Discord / on-chain C2 egress.Coverage note: October 01, 02, 03, 04, 05, 06, 10, 16, 17, 23, 24, 30 and 31 have no separate Simplified Chinese daily bulletin; the 10-07 package covers 10-01–10-07, 10-11 covers 10-10–10-11, 10-18 covers 10-16–10-18, and 10-25 covers 10-23–10-25. Entries covering 10-30–11-01 were published in the 2026-11-01 range file whose date field does not start with 2026-10, so they are excluded from this month’s totals. Other dates without a separate bulletin are not backfilled and do not imply that no security events occurred that day.
Publisher: CleanSource Community ｜ Publication date: 2026-11-03
Sources: Simplified Chinese CSSA, CVE and open-source repository poisoning intelligence published in the repository for October 2026 ｜ Please credit the source when reprinting
Business
Official account