232-323

The library fails to validate the `tokenUrl` field within remote OpenAPI specifications. This allows an attacker to redirect the submission of credentials to arbitrary endpoints. If a user registers an attacker-controlled OpenAPI specification and invokes a generated OAuth2-protected tool, the library sends the `client id` and `client secret` via a POST request to the attacker-supplied token endpoint.

The software fails to verify if tool URLs in a hand-written UTCP manual point to the agent's own loopback interface when the manual is retrieved from a remote, non-loopback origin. This occurs because the `ensure secure url` function permits loopback HTTP for local development, and native manuals bypassed the loopback check used by the OpenAPI converter. An attacker providing a malicious UTCP manual can trigger server-side request forgery (SSRF), causing the client to send requests to services bound to 127.0.0.1 on the victim host and return the response bodies to the attacker. This issue affects the http, sse, and streamable http protocols. Exploitation requires a loopback service that responds to unauthenticated requests.

An issue exists in the OpenCypher LOAD CSV implementation that fails to validate HTTP/HTTPS URLs. Authenticated attackers can craft LOAD CSV queries pointing to internal network addresses or cloud metadata endpoints, causing the server to fetch and return sensitive data from restricted services. This is a server-side request forgery, which occurs when a server is tricked into making requests to an unintended location.

The dashboard HTTP server lacks authentication middleware for the '/api/session-summary' and '/api/session-events' endpoints, allowing any network-accessible client to access them without credentials. These handlers use the `sessionId` query parameter to construct a filesystem path via `path.join`. Because Node.js normalizes directory traversal sequences (..), an unauthenticated attacker can read any .jsonl file reachable from the server's filesystem. This allows for the exfiltration of session logs containing tool invocations, hook outputs, and token usage data.

The `get diagnostics` MCP tool loads and executes all DiagnosticAnalyzer assemblies referenced by the target solution without an allowlist, signature check, or user confirmation. Because the `includeAnalyzers` variable defaults to true, no explicit opt-in is required. An attacker can achieve arbitrary code execution in the server process with the server's OS privileges by placing a malicious `.csproj` file that references an attacker-controlled DLL in a location opened by the victim using the MCP server.

The MCP HTTP transport accepts JSON-RPC `tools/call` requests without requiring authentication, sessions, origins, or token checks, dispatching them directly to the orchestrator's tool registry. Because the service binds to `0.0.0.0` by default, any party with network reachability can enumerate and invoke privileged management tools. This allows unauthorized users to read and mutate live orchestrator configurations, list and dispatch agents, create or revoke security tokens, and adjust global budget ceilings. The issue is specifically present in the ` handlePost()` function, which fails to perform authentication checks before calling `handleRPC()`, and the `handleRPC()` function, which dispatches requests to the `call(toolName, toolArgs)` function.

A SQL Injection vulnerability was discovered in the WeGIA application, "salvar tag.php" endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to or deletion of sensitive information.