Supply Chain · Watch Tuesday · 15 September 2026 End-of-day synthesis 4 watches · 7 items

From the watchtower — what crossed the wire today.

A four-times-a-day standing watch on the open-source supply chain. Each pass pulls newly disclosed CVEs, freshly catalogued KEV adds, and active attacks reported in the wild — then ranks them by severity for the day.

The story of the day — A same-day GHSA publish run hit two very different corners of the stack at once: an MCP server used for agent-assisted GitLab access got a token-stealing SSRF pair, and http4s's Ember backend took its second HTTP-smuggling/DoS batch in three weeks.

Today's GHSA feed fired two unrelated but equally operational batches within about an hour of each other, plus a CISA KEV add that's a clean, unambiguous perimeter fix. Cisco's Secure Email Gateway got an unauthenticated SQL injection that ends in root command execution — no exploitation confirmed yet, but KEV adds get scanned fast, and a mail gateway is exactly the kind of appliance that sits exposed at the edge.

The more interesting split is between the two batches. @zereight/mcp-gitlab — an MCP server that puts an LLM agent in front of your GitLab — picked up an SSRF and a DNS-rebinding hole that both end in token theft, plus a set of read-only bypasses that defeat the safety controls the package exists to provide; if you've wired an agent up to GitLab through this server, the controls you thought you had aren't there yet. Separately, http4s's Ember backend took its second major batch in three weeks — a CL.TE smuggling primitive plus eleven siblings — on top of the HPACK-bomb DoS it got on August 26, which makes Ember's HTTP/1.1 parser look less like bad luck and more like a stack that needs a from-scratch conformance pass. On the brighter side, the day's only confirmed active-exploitation item, the WooCommerce Wholesale Lead Capture backdoor from this afternoon, is a seven-month-old bug with a known fix — patching coverage, not a new hole, is the gap.

→ Operational priority for the night if you run @zereight/mcp-gitlab for agent access to GitLab, disable ENABLE_DYNAMIC_API_URL and pull the Streamable HTTP transport off any browser-reachable network before you do anything else — that's live token exposure, not a theoretical one.

18:00 ET · First Watch

Critical · CISA KEV ·added 18:00 ET

CISA adds Cisco Secure Email Gateway SQL injection (CVE-2026-76461) to KEV — remediate by Sept 17

CISA catalogued CVE-2026-76461 today: an unauthenticated SQL injection in Cisco AsyncOS for Secure Email Gateway that lets a remote attacker run arbitrary commands as root on the underlying OS, not just pull data out of a database. Federal agencies have a September 17 remediation deadline under BOD 26-04, and any internet-facing SEG appliance is a full host compromise away from being a foothold on your mail path. Check AsyncOS build numbers against Cisco's advisory now — perimeter mail appliances get scanned within hours of a KEV add.

Critical · GHSA ·added 18:00 ET

@zereight/mcp-gitlab (npm) — SSRF token theft + DNS-rebinding pair let any caller drain a victim's GitLab token

Three advisories dropped together against the widely-used @zereight/mcp-gitlab MCP server: a header-controlled SSRF (GHSA-2h44, CVSS 9.6) where the optional X-GitLab-API-URL override has no hostname allowlist, so any caller can redirect the server's outbound GitLab calls — Private-Token attached — to an attacker host in a single request; a DNS-rebinding hole (GHSA-vmp7, CVSS 9.6) that reaches the same loopback Streamable-HTTP transport from a malicious web page; and a bundle of read-only/allow-list bypasses (GHSA-5648, CVSS 8.1), including a GraphQL mutation smuggled past the read-only filter with a leading comma. None are patched yet. If you run this MCP server for agent-assisted GitLab access, disable ENABLE_DYNAMIC_API_URL, keep the Streamable HTTP transport off any browser-reachable network, and rotate any GitLab token it's held until a fix ships.

Critical · GHSA ·added 18:00 ET

http4s Ember backend — 12-advisory batch adds CL.TE/TE.CL/TE.TE smuggling on top of August's HTTP/2 DoS bugs

Twelve http4s advisories landed together, all in the Ember backend: a critical CL.TE smuggling primitive (GHSA-8h4c) where Ember accepts a request carrying both Transfer-Encoding and Content-Length instead of rejecting it per RFC 9112, plus TE.CL/TE.0 (GHSA-9998, CVSS 8.7) and TE.TE (GHSA-jrpm) variants, six HTTP/2 resource-exhaustion bugs (unbounded frame and continuation queues, uncapped concurrent streams, an unenforced SETTINGS_MAX_FRAME_SIZE check), and two CookieJar bugs that leak or accept cookies cross-origin via substring domain matching. This is the same Ember stack that took an HPACK-bomb DoS on August 26 and follows blaze's three-advisory smuggling batch in July — http4s's HTTP/1.1 parser conformance is a recurring theme, not a one-off. Patch the batch together: fixing only the critical still leaves the framing disagreements that make the rest of the smuggling chain work.

High · BleepingComputer ·added 18:00 ET

Compromised maintainer site pushes backdoored Admin Menu Editor Pro updates to WordPress installs

A threat actor compromised maintainer infrastructure for the WordPress plugin Admin Menu Editor Pro and shipped malicious updates that silently create a hidden admin account on install — BleepingComputer's headline cites 1,500 affected sites while the body says 200+ customers received the malicious build, so the confirmed scope is still shaking out. It's the same shape as this year's other plugin supply-chain hits: legitimate update channel, trusted signature, payload rides in on auto-update. If you manage WordPress sites, check the plugin list for Admin Menu Editor Pro and audit the admin-users table for accounts you don't recognize — a hidden account doesn't trigger an alert on its own.

Medium · GHSA ·added 18:00 ET

Netmaker (Go) — boolean-based SQL injection via DNS delete endpoint

Netmaker's SQLite backend builds DELETE statements by string-concatenating the {domain} path parameter straight into the query (database/sqlite.go), so an authenticated user can boolean-inject through DELETE /api/dns/{network}/{domain}. It's authenticated-only and limited to the SQLite backend, so exposure depends on your deployment, but Netmaker runs as a mesh-VPN control plane — database tampering there has a bigger blast radius than a typical app SQLi. Parameterize the query or move off the SQLite backend if you can't patch immediately.

12:00 ET · Forenoon Watch

Critical · BleepingComputer ·added 12:00 ET

Unauthenticated file-upload bug in WooCommerce Wholesale Lead Capture (CVE-2026-27540) under renewed active exploitation

CVE-2026-27540 is an unauthenticated arbitrary-file-upload flaw in the WooCommerce Wholesale Lead Capture premium plugin (≤2.0.3.1, CVSS 9.8): the plugin trusts an attacker-supplied allowed-extension list on upload, so a crafted request just adds .php to that list and drops a working backdoor with no login required. It was disclosed and patched (2.0.3.2) back in February, but Wordfence telemetry shows exploitation never really stopped — bursts in June, July, and again as recently as August 30 — so the roughly 6,000 sites still on vulnerable builds are still getting popped seven months out. If you run or support WooCommerce sites, check the plugin inventory specifically for Wholesale Lead Capture and force the update; 'patched months ago' isn't protecting anyone still on 2.0.3.1.

06:00 ET · Morning Watch

Context · The Hacker News ·added 06:00 ET

China-linked UTA0560 chains a Chrome/Windows zero-day pair to drop the GRIMWEDGE JS backdoor on NGOs

Volexity is tracking a spear-phishing cluster (UTA0560) that chained recently-patched Chrome and Windows flaws for initial access against multiple NGOs starting September 1, dropping a JavaScript backdoor dubbed GRIMWEDGE. It's a phishing-plus-browser-exploit chain rather than a package or build-pipeline compromise, but the pattern of pairing disclosed-but-not-yet-universally-patched bugs with a lightweight script implant for persistence is the same playbook supply-chain intrusions increasingly borrow post-compromise. No IOCs or specific CVE numbers were in the initial writeup; if you support any of the named NGO sectors, prioritize current Chrome/Windows patch levels and watch for the Volexity follow-up with hashes and CVEs.