CVE-2026-86775: knowns Path Traversal via the Document API
The same unsafe filepath.Join that produced one CVE through the MCP tools produced a second one through the HTTP Document API — this time with write, delete, and directory creation attached.
taxonomy / tag
#golang
CVE-2026-86543: knowns Unauthenticated Management API Exposure
A developer tool that binds 0.0.0.0, disables its own auth middleware when no password is set, and exposes an unauthenticated tunnel-start endpoint does not just have an exposure problem — it has a self-publishing one.
CVE-2026-86544: knowns Authorization Bypass via Misclassified Code Actions
The permission system worked exactly as designed. It just had the wrong answer to the only question that mattered: is code.replace a read or a write?
CVE-2026-86542: knowns Unauthenticated Arbitrary File Write via Import Name
Reading arbitrary files is bad. Writing them, with content you control, from an unauthenticated endpoint, is how a documentation import feature becomes a code execution chain.
CVE-2026-86541: knowns Path Traversal in the code.replace MCP Action
An editing tool that accepts an absolute path and uses it verbatim is not a code editor with a bug. It is a file-write API that happens to be pointed at code most of the time.
CVE-2026-86540: knowns Arbitrary Code Execution via the LSP Binary Override
Cloning a repository should not run its code. In knowns before 0.30.0, a project configuration file could name any binary — and opening the repository executed it twice.
CVE-2026-86538: knowns Unauthenticated Arbitrary File Read via templateFile
A template preview endpoint that reads whatever path you hand it and returns the contents in JSON is an arbitrary file read with a friendly name — and in knowns before 0.30.0 it needed no credentials.
CVE-2026-86439: knowns Path Traversal via MCP Doc and Memory Tools
When an MCP tool argument reaches filepath.Join unvalidated, the attacker does not need to touch the server at all — they only need to get one sentence into something the model reads.