Engineering Manager

Reachability watch: an identity-spoofing flaw in Alluxio's S3 proxy and 505 new CVEs this week. * Published: August 28, 2026 Last updated: * August 28, 2026 At A glance. * 505 new network-exploitable CVEs published August 21-27, 2026 * 96 cleared its severity bar (CVSS 8.6+), including 75 rated 9.0 or higher and 12 a perfect 10.0 * Featured vulnerability: CVE-2026-81096, an unauthenticated sandbox escape in ToolUniverse letting an attacker run arbitrary Python with no login required * Six of this edition's CVEs were AI-agent and MCP server tooling that defaults to reachable-by-default * A single package, openssl_encrypt, shipped four separate signature-verification failures in one disclosure Most CVEs NetFoundry has tracked so far come down to a service that shouldn't have been internet-facing in the first place. This week's standout goes a step further: a server that runs arbitrary code on request, sitting with no authentication in front of it at all. ToolUniverse lets an AI agent hand off code for execution inside a sandbox...but the sandbox can be escaped, and the server that hosts it requires no login. Put those two facts together and the "sandbox" is just a formality between an attacker's request and a shell on your infrastructure. The same root cause showed up five more times this week in tools built to let AI agents talk to each other, and a fourth time in a Python package built specifically to verify signatures and identity. Different products, same failure: something was trusted that shouldn't have been. Vulnerabilities by the numbers. For August 21-27, 2026, 505 new network-exploitable CVEs were published. 96 cleared its severity bar (CVSS 8.6+), including 75 rated 9.0 or higher and 12 rated a perfect 10.0. Running A few worth knowing about: * CVE-2026-81735 (10.0, CRITICAL): ToolUniverse's sibling story. UI-TARS-desktop's MCP HTTP server defaults its listen address to every network interface when no host is specified. It's one of five AI-agent and MCP tools that made the same mistake this week: CVE-2026-81094 and CVE-2026-81098 (mcp-router and the Telnyx MCP server, both binding to every interface and requiring a caller credential only if the operator remembered to turn it on), and CVE-2026-81091 and CVE-2026-81093 (an inspector proxy and a URL-fetching tool that forwards requests to any destination a caller names). Nobody has to misconfigure these; they have to actively remember to lock them down. * CVE-2026-81700 (9.8, CRITICAL): the first of four signature-verification failures disclosed the same day in the openssl_encrypt package. This one accepts revoked and expired signing keys because it only checks for a valid signature, not a revoked or expired one. The same disclosure covered CVE-2026-81701 (unsigned plugins bypass the denylist meant to block them), CVE-2026-81702 (public keys are never re-validated when loaded from disk), and CVE-2026-81707 (an attacker can forge the fingerprint line a user sees). * CVE-2026-79787 (9.8, CRITICAL): Alluxio's S3 REST proxy never verifies the AWS Signature Version 4 credentials on incoming requests, reading a username straight out of an unsigned header and treating the request as if that user sent it. Same failure as openssl_encrypt above, different product: an identity check that exists on paper but never runs. * CVE-2026-76195 (10.0, CRITICAL): one of three unauthenticated CRITICAL flaws Adobe Campaign Classic disclosed in a single day. This one and CVE-2026-76197 are both OS command injection at a perfect 10.0; CVE-2026-76193 is an SSRF flaw also rated 10.0. * CVE-2026-79911 (10.0, CRITICAL): a stack-based buffer overflow in TOTOLINK N600R routers with a public exploit already circulating, alongside CVE-2026-71921 (9.8, CRITICAL), a pre-authentication command injection across multiple DrayTek VigorSwitch models running as root. Consumer and SMB network gear keeps landing in this list for the same reason it did in Edition 2: built to be reachable from the internet by default. * CVE-2026-71513 (8.8, HIGH): an unsafe pickle deserialization in NLTK leading to remote code execution. NLTK had a bad week, also disclosing CVE-2026-79675, a JVM option injection flaw, in a library widely embedded in AI and NLP pipelines. Individually, each of these is a single team's oversight. Taken together, they're the same story the numbers above are telling: identity checks that exist on paper don't count for much if nothing enforces them. No sandbox required: this edition's Most dangerous vulnerability. CVE-2026-81096 sits in ToolUniverse, infrastructure built to let AI agents execute code as part of completing a task. Its python_code_executor tool runs caller-submitted Python inside a sandbox meant to contain it, and the escape route was already there: neither the sandbox nor the server sitting in front of it was actually containing anything. Strip away the sandbox language and this is about as bad as a vulnerability gets: an attacker sends a request, and the server executes their code, no credentials, no session, no login page to even attempt to bypass. The sandbox was the only thing standing between "AI agent tool" and "arbitrary remote code execution as a service," and it didn't hold. This is what happens when a team builds one strong control (the sandbox) and skips the more basic one (requiring identity before anyone can reach the sandbox at all). The sandbox is a second line of defense; it was never supposed to be the only one. How Identity-First Reachability closes this gap. Identity-First Reachability(TM) doesn't depend on a sandbox holding, a signature actually getting checked, or a server binding to the right interface. Every connection requires a cryptographically verified identity and an explicit policy before a service becomes reachable at all, enforced outside the application, not inside it. If ToolUniverse's server, or any of this week's wide-open MCP tools, had been sitting behind NetFoundry's Identity-First Reachability, the sandbox escape would still exist as a bug. It just wouldn't be reachable by anyone who hadn't already proven who they were. Same logic applies to Alluxio's unverified signatures and openssl_encrypt's unchecked keys: an unverified non-human identity never gets close enough to test whether the application's own checks work. Don't be the next Reachability watch headline. If there's one takeaway from this edition, it's that a control only counts if something is actually enforcing it, and this week produced eleven CVEs across AI agent infrastructure, a data platform's S3 proxy, and an encryption library, all because a check that existed on paper never ran in practice. Attackers only need one gap like that, and 505 new CVEs in a week is more than any team can manually audit for this class of mistake. No open ports for a scanner to find. No sandbox to test the edges of. No MCP server listening on every interface because nobody remembered to change the default. See how NetFoundry's Identity-First Reachability makes your AI agents, APIs, and service accounts invisible to anyone who hasn't already proven who they are. Frequently asked questions. What's the difference between a CVE and a KEV, and why doesn't this edition feature one? A CVE (Common Vulnerabilities and Exposures) is any publicly disclosed security flaw. A KEV (Known Exploited Vulnerability) is one CISA has confirmed is being actively used in real attacks. This edition's CVEs are all newly disclosed and, as of publication, none has been added to CISA's KEV catalog. That's not a reason to relax. Most KEVs spend time as an unremarkable CVE first. Why is an unsigned identity header worse than it sounds? Because it doesn't just fail open, it fails invisibly. A service that requires no authentication at all is obviously exposed. A service that asks for a signed identity header, but never checks the signature, looks secure in every log and every audit until someone tests it. At NetFoundry, NetFoundry treat identity verification as something that has to happen before a connection is possible, not as a check the destination application is trusted to perform correctly on its own. How do you secure AI agents and MCP servers with zero trust? Zero Trust for AI agents and MCP servers means neither the agent, the tool it calls, nor the server hosting it is reachable on the network until a verified identity and an explicit policy authorize that specific connection, regardless of what port the tool binds to by default. At NetFoundry, this is enforced outside the application itself, so a misconfigured or unauthenticated MCP server never becomes network-visible in the first place, even if it was shipped listening on every interface. How does Identity-First Reachability prevent this class of attack? Identity-First Reachability is a security model where every connection requires a verified identity and explicit policy before a service becomes visible on the network at all, rather than trusting the application to authenticate correctly once traffic reaches it. At NetFoundry, that means a vulnerable API, proxy, or AI agent server is never reachable by a caller who hasn't already been cryptographically verified, whether or not the application's own identity check works as intended.

Alluxio kicked off 2023 strong by being named one of the Best Open Source Projects.