Supply Chain · Watch Friday · 11 September 2026 End-of-day synthesis 4 watches · 12 items

From the watchtower — what crossed the wire today.

A four-times-a-day standing watch on the open-source supply chain. Each pass pulls newly disclosed CVEs, freshly catalogued KEV adds, and active attacks reported in the wild — then ranks them by severity for the day.

The story of the day — CISA confirms the JFrog Artifactory campaign and adds ConnectWise ScreenConnect and GitLab CE/EE to KEV, a CVSS-10 MCP server bug and a hardcoded Central Dogma secret round out the evening, and a late CVSS-9.1 prototype-pollution bug in npm's yayson pushes the day past bedtime.

This morning's JFrog Artifactory active-exploitation report from Wiz got government confirmation today: CISA added both underlying CVEs to KEV and catalogued two more products in the same update — ConnectWise ScreenConnect and GitLab CE/EE, both due September 14. The day's other disclosures were narrower but sharp — Prowler shipped a CVSS 9.6 SAML bug letting one tenant assert another's email domain and pivot into their cloud audit data, complete with a working PoC and a same-day fix, while LINE's Central Dogma fell back to a hardcoded ZooKeeper secret ('ch4n63m3') whenever replication.secret is left unset, and a MySQL MCP server shipped with the MCP SDK's DNS-rebinding protection silently disabled — a flat CVSS 10.0.

Late escalation at 21:00 ET: a CVSS 9.1 prototype-pollution bug in yayson, a small JSON:API deserialization library, landed just before bed — a document with type: "__proto__" pollutes Object.prototype for the life of the process, and the poisoned key can arrive through an included relationship, bypassing a naive type allow-list. It arrived alongside a wave of narrower but still-serious disclosures within the same hour: an unauthenticated, CORS-wildcarded admin API in Mockoon, an SSRF-fix bypass in FrontMCP's OpenAPI adapter, and six authorization bugs patched at once in the Shopper e-commerce framework — all patched, none known exploited yet, but five serious disclosures inside one hour is not a coincidence worth ignoring.

→ Operational priority for the night patch ConnectWise ScreenConnect and GitLab CE/EE ahead of Sunday's KEV deadline, and if yayson is anywhere in your JSON:API stack, pin to 4.3.0 before Monday — prototype-pollution bugs are exactly the kind that get rediscovered as an RCE gadget once someone goes looking.

21:00 ET · Last Watch

Critical · GHSA ·added 21:00 ET

yayson ships a CVSS 9.1 prototype-pollution bug in its JSON:API deserializer

yayson's Store/LegacyStore keys its internal lookup tables by the type, id, and relationship names pulled straight out of a JSON:API document; because those tables are plain objects, a document with type: "__proto__" writes onto Object.prototype and pollutes every object in the process (CVE-2026-61534, CVSS 9.1). The poisoned key can arrive via an included resource referenced by a relationship, so a naive allow-list on the top-level data.type doesn't help — guaranteed impact is process-wide DoS/logic corruption, and escalation to auth bypass or RCE depends on gadgets already present in your app. Patch to 4.3.0; if you can't yet, run Node with --disable-proto=throw or reject documents whose type/relationship names are __proto__, constructor, or prototype.

High · GHSA ·added 21:00 ET

Mockoon's admin API ships unauthenticated and CORS-wildcarded by default, plus a path-traversal escape from the same release

Mockoon's admin API is mounted on the same listener as your mock routes, enabled by default in the CLI/serverless/commons-server runtimes, has zero authentication, and answers every endpoint with Access-Control-Allow-Origin: * — so any page a developer visits while mockoon-cli is running can read env vars templated into mock responses, overwrite arbitrary process env (including non-MOCKOON_* secrets like AWS keys), and rewrite every route's body/status/headers at runtime (CVE-2026-59148, CVSS 8.8 local / 9.4 if network-exposed). A second bug in the same release lets a FILE response with a templated filePath escape the served directory, because the safety check is a bare string-prefix test with no path-separator boundary (CVE-2026-59149, CVSS 6.5) — ../public_backup/.env passes because it string-prefixes /srv/public. Patch to 9.7.0, or at minimum pass --disable-admin-api and stop binding admin ports to 0.0.0.0.

High · GHSA ·added 21:00 ET

FrontMCP's fix for its OpenAPI $ref SSRF bug can be bypassed with DNS-to-loopback names and redirects

The hostname denylist that patched last month's SSRF in mcp-from-openapi checks the literal string in a $ref URL, not the address it actually resolves to, so http://127.0.0.1.nip.io, IPv4-mapped IPv6 loopback forms, and redirect chains through an allowed host all still land backend-origin requests on localhost (CVE-2026-59973, CVSS 8.5). Any hosted or multi-user FrontMCP deployment that lets users import an OpenAPI spec is exposed to internal admin APIs and metadata services through this path. Update to mcp-from-openapi ≥2.5.0 / frontmcp ≥1.5.0, and don't rely on hostname-string checks — resolve before you validate, and revalidate every redirect target.

High · GHSA ·added 21:00 ET

Shopper's 2.9.2 release fixes six missing-authorization bugs at once across its Livewire admin components

Six separate advisories landed simultaneously for shopper/framework, all patched in 2.9.2: unauthenticated product removal, unauthorized inventory-stock edits via an unlocked Livewire property, privilege escalation through improperly-gated admin components, an incomplete fix to a prior media sub-form authorization bug, missing authorization in Settings components, and unvalidated negative discount values propagating through order calculation (CVE-2026-56825/56826/56828/56829/56830/56831). The pattern across all six is the same — Livewire component properties and actions that should require an authorization check but don't, a common failure mode for Laravel apps built on component frameworks. If you run Shopper, upgrade to 2.9.2 now rather than patching piecemeal; a partial upgrade likely still leaves some of these open.

Medium · GHSA ·added 21:00 ET

ZITADEL patches an email auto-linking gap and a missing JWT expiration check in its IdP provider, both in 4.15.3

ZITADEL's auto-link-by-email feature doesn't verify that an external IdP actually confirmed the email it's asserting, so an admin who enables auto-linking against a permissive provider can be tricked into letting an attacker register a matching email there and get auto-linked into a victim's local account (CVE-2026-56666, CVSS 4.8). A separate bug in the JWT IdP provider skips exp validation on incoming tokens entirely (CVE-2026-56665). Both are fixed in 4.15.3 — the auto-linking issue is otherwise mitigated by disabling auto-linking or restricting it to trusted directories.

18:00 ET · First Watch

Critical · GHSA ·added 18:00 ET

Prowler ships a CVSS 9.6 SAML cross-tenant account takeover with a working PoC

Prowler's SAML login derived the destination tenant from the email domain asserted inside the SAMLResponse instead of from the SAML configuration validated for that ACS route, so any tenant that stands up its own SAML IdP can assert someone else's email domain and get handed a token for that victim tenant (CVE-2026-59151, CVSS 9.6). The published PoC walks the full chain — register a SAML config for an unclaimed domain, sign a SAMLResponse asserting a victim's real domain, exchange the resulting SAML token for a JWT, then use the token-switch endpoint to pivot into the victim's tenant — and it's Prowler itself, the open-source cloud security scanner teams run against their own AWS/GCP/Azure accounts, so a compromised tenant gets read/write access to every connected cloud's audit findings and integration secrets. Patch to 5.30.3, and if SAML is enabled, check for `reject_idp_initiated_sso` being anything other than true and for SAML configurations your org didn't create.

Critical · GHSA ·added 18:00 ET

LINE's Central Dogma falls back to a hardcoded ZooKeeper secret literally named 'change me'

Central Dogma's embedded ZooKeeper replication defaults to the constant `ch4n63m3` whenever an operator leaves `replication.secret` unset, and that same string authenticates both the client-facing SASL context and the inter-node quorum context (CVE-2026-11746) — the constant sits in the OSS source on GitHub, so it isn't a secret an attacker has to find, only one they have to try. Anyone who can reach the ZooKeeper port on a default-configured cluster can join as a peer and take over replication, which for a config-management system means rewriting the configs every downstream service trusts. Grep your deployment for an explicit `replication.secret` — if it's missing, you're running on the well-known default right now.

Critical · GHSA ·added 18:00 ET

mysql_mcp_server ships with the MCP SDK's DNS-rebinding protection disabled by default (CVSS 10.0)

mysql_mcp_server constructs its SSE transport without passing `security_settings`, which silently turns off the MCP Python SDK's built-in Origin/Host validation, and the Starlette app underneath adds no CORS or TrustedHost middleware of its own — combined with a default bind to 0.0.0.0 and no authentication on any route, a malicious webpage can DNS-rebind into a victim's local network and run arbitrary SQL against whatever database the MCP server is proxying (CVE-2026-59971, CVSS 10.0). This is the same 'localhost dev server with no origin check' shape that's bitten Electron apps and browser extensions for years, just wearing MCP's clothes now — expect more of these as agent-tooling servers ship fast and skip the SDK's guardrails. If you run an MCP server in SSE/HTTP mode, verify `security_settings` is actually wired up and don't trust a bind-to-0.0.0.0 default to protect you.

Critical · CISA KEV ·added 18:00 ET

CISA adds ConnectWise ScreenConnect and GitLab CE/EE to KEV, both due September 14

CISA catalogued two new actively-exploited bugs today: an improper-privilege-management/missing-authorization flaw in ConnectWise ScreenConnect that lets an attacker ride an active remote session to transfer and execute files without authorization or host confirmation (CVE-2026-84869), and a GitLab CE/EE path traversal in the repository-commits API that lets an unauthenticated caller read arbitrary files off the server (CVE-2026-85706). ScreenConnect is a favorite RMM tool for both legitimate IT and ransomware affiliates who've already gained a foothold, and GitLab sits at the center of source control and CI for a huge number of orgs — an unauthenticated arbitrary-file-read there can leak CI secrets, SSH keys, or `.git-credentials` outright. Both carry a September 14 remediation deadline under CISA's BOD 26-04; patch this week regardless of federal-agency status.

Critical · CISA KEV ·added 18:00 ET

CISA formally catalogues the JFrog Artifactory bugs from this morning's Wiz report

The two JFrog Artifactory flaws Wiz described this morning — the incorrect-authorization token-scope bug and the improper-authentication anonymous-token leak that together chain to full admin control — are now both on the CISA KEV list (CVE-2026-42016, CVE-2026-42018), confirming the active-exploitation window Wiz traced between August 15 and September 8 wasn't an isolated finding. This doesn't change the severity assessment from this morning's item, but it does move the remediation clock: KEV entries carry a federal patch deadline (September 25 here) and are the strongest signal in this pipeline that a bug is being used in the wild right now. If you haven't patched Artifactory yet today, this is the second call.

06:00 ET · Morning Watch

Critical · The Hacker News ·added 06:00 ET

Attackers chain three JFrog Artifactory flaws to full admin control and plant backdoors

Wiz traced active exploitation of JFrog Artifactory between Aug 15 and Sep 8 to three chained flaws: CVE-2026-42018 leaks the internal anonymous-user token even with anonymous access disabled, CVE-2026-42016's scope-validation gap lets that low-privilege token get elevated, and CVE-2026-82329 is an unauthenticated POST to /access/api/v1/registry/join that hands out an admin-scoped token outright on default configuration. Attackers used the admin access to create persistent accounts, deploy malicious Groovy plugins, run shell commands, and install Rust-based backdoors, then harvested cluster join keys — Artifactory sits at the center of CI/CD as the build-pipeline source of truth, so admin compromise there is the same blast-radius shape as a poisoned package registry. Patch to JFrog's fixed release now and audit self-hosted instances for unexpected admin accounts, unfamiliar Groovy plugins, or join-key rotations in that window.

Context · The Hacker News ·added 06:00 ET

China-linked UNC3569 exploits a Sogou Input Method flaw to drop the GRAYRABBIT backdoor

Gen Digital ties China-linked group UNC3569 to a flaw in Sogou Input Method — patched upstream in Tencent's 16.3.0.3498 — used via a crafted link to drop the group's long-running GRAYRABBIT backdoor, a lightweight implant built for file operations, recon, and a remote shell. Targeting stayed narrow (government, education, and financial orgs across East and Southeast Asia), so this reads as targeted espionage rather than a mass supply-chain compromise, but the vector — a widely-installed third-party input tool — is the same trusted-software angle worth remembering. No action needed beyond confirming Sogou IME is current if it's present in your environment.