Tracking: CVE-2026-35029, CVE-2026-59821, CVE-2026-59822
Severity: Multi-vulnerability chain; impact depends on configuration
Who is affected
The reported issues have separate fixed versions:
| Issue | Identifier | First fixed release |
|---|---|---|
| Guardrail code execution | CVE-2026-59821 | 1.82.0 |
| Pass-through configuration authorization | CVE-2026-59822 | 1.83.0 |
| MCP authentication bypass | CVE-2026-35029 | 1.84.0 |
How the attack works
A fabricated bearer token can establish an MCP session. Separate guardrail and pass-through weaknesses can then expose execution or requests to internal and cloud metadata services under their documented access conditions. An unchanged default master key provides another route to privileged operations.
Root execution reflects the affected container configuration; cloud compromise depends on accessible credentials, metadata protection, and IAM privileges. Not every installation exposes every link in the chain.
What to do
- Upgrade to 1.84.0 or later to cover the listed fixes and replace any default master key.
- Audit MCP sessions, guardrails, pass-through destinations, and configuration permissions. Restrict metadata and internal-service access from the proxy.
- If compromise is suspected, investigate container execution and cloud activity, revoke exposed model-provider or cloud credentials, and rebuild affected workloads.
Scope and limits
Use the individual CVEs for remediation tracking rather than treating the chain as one unconditional exploit.