CVE-2026-73554

Hi PWN Community,

I’m Ariel Fogel, an AI security researcher in the Office of the CTO at Pillar Security. I focus on the places AI systems break once they touch real systems: MCP servers, model repositories, developer machines, credentials, and production infrastructure.

One of my most recent disclosures is “Valid, But Never Issued: Session Spoofing and SSRF in Grafana MCP” .

In affected Grafana MCP deployments, a caller could use a made-up session ID to run tools with the server’s Grafana credentials. Separately, the HTTP-request tool let callers send requests to destinations of their choosing ( CVE-2026-19516 , CVSS 9.1).

The lesson: session IDs track state; they don’t establish identity. An MCP server brings its own credentials and network access, so you need to control both who can invoke its tools and where those tools can connect.

Other recent work includes:

DoltHub’s Dolt MCP : a missing return let requests with invalid JWTs receive a 401 but still execute database operations under the server’s credentials (CVE-2026-73554, CVSS 10). Unsloth Studio model-inspection RCE : selecting a model caused the Studio backend to execute repository-provided Python code during metadata inspection, before model weights were loaded or inference ran. The Week of Sandbox Escapes : we examined escapes and boundary bypasses across Antigravity, Codex, Cursor, and Gemini CLI. The recurring pattern was a trusted host component later running, loading, or trusting something the agent had written. BadEngram : we discovered a novel way to backdoor state-of-the-art models, like Qwen 3.8-Next and DeepSeek V4.1-Flash, without impacting any of the model's backbone weights.

Ask me anything about:

how the Grafana MCP session spoofing and SSRF chain worked what SSRF buys an attacker once an MCP server can reach internal services or cloud metadata whether MCP is genuinely harder to secure, or just new how to secure MCP servers as identity and network brokers what disclosure looks like when the vendor ships weekly -- or don't respond how we approach vulnerability hunting where agentic AI security goes from here anything else on AI application security, or the scene generally

I’ll be here live on Monday, October 19, from 12:00–1:00 PM EST time (9:00–10:00 AM PT). You can leave questions in advance, and I’ll answer them when I go live.