{"metadata": {"vulnerability": "CVE-2026-25536", "count": 64, "kinds": {"milestone": 6, "sighting": 1, "kev": 0, "other": 57}}, "data": [{"timestamp": "2025-06-16T14:50:40.906Z", "date_only": false, "value": "2025-06-16T14:50:40.906000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2025-06-16T15:00:59.960Z", "date_only": false, "value": "2025-06-16T15:00:59.960924+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "vulnerabilities.0.discovery_date"}, {"timestamp": "2025-07-14T20:17:18.247Z", "date_only": false, "value": "2025-07-14T20:17:18.247000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "vulnerabilities.2.release_date"}, {"timestamp": "2025-07-14T21:00:57.122Z", "date_only": false, "value": "2025-07-14T21:00:57.122280+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "vulnerabilities.2.discovery_date"}, {"timestamp": "2025-12-05T16:06:08.531Z", "date_only": false, "value": "2025-12-05T16:06:08.531000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "vulnerabilities.6.release_date"}, {"timestamp": "2025-12-05T17:02:21.597Z", "date_only": false, "value": "2025-12-05T17:02:21.597728+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "vulnerabilities.6.discovery_date"}, {"timestamp": "2026-01-05T22:00:17.715Z", "date_only": false, "value": "2026-01-05T22:00:17.715000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "vulnerabilities.7.release_date"}, {"timestamp": "2026-01-06T20:01:19.831Z", "date_only": false, "value": "2026-01-06T20:01:19.831548+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "vulnerabilities.7.discovery_date"}, {"timestamp": "2026-01-07T22:09:01.936Z", "date_only": false, "value": "2026-01-07T22:09:01.936000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "vulnerabilities.11.release_date"}, {"timestamp": "2026-01-07T23:01:59.422Z", "date_only": false, "value": "2026-01-07T23:01:59.422078+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "vulnerabilities.11.discovery_date"}, {"timestamp": "2026-01-10T02:40:25.142Z", "date_only": false, "value": "2026-01-10T02:40:25.142000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "vulnerabilities.3.release_date"}, {"timestamp": "2026-01-10T02:41:44.944Z", "date_only": false, "value": "2026-01-10T02:41:44.944000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "vulnerabilities.12.release_date"}, {"timestamp": "2026-01-10T02:42:32.736Z", "date_only": false, "value": "2026-01-10T02:42:32.736000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "vulnerabilities.13.release_date"}, {"timestamp": "2026-01-10T04:01:03.694Z", "date_only": false, "value": "2026-01-10T04:01:03.694749+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "vulnerabilities.13.discovery_date"}, {"timestamp": "2026-01-10T04:01:46.246Z", "date_only": false, "value": "2026-01-10T04:01:46.246119+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "vulnerabilities.12.discovery_date"}, {"timestamp": "2026-01-10T04:02:14.375Z", "date_only": false, "value": "2026-01-10T04:02:14.375674+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "vulnerabilities.3.discovery_date"}, {"timestamp": "2026-01-21T19:05:28.846Z", "date_only": false, "value": "2026-01-21T19:05:28.846000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "vulnerabilities.1.release_date"}, {"timestamp": "2026-01-21T20:01:28.774Z", "date_only": false, "value": "2026-01-21T20:01:28.774829+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "vulnerabilities.1.discovery_date"}, {"timestamp": "2026-01-22T04:02:08.706Z", "date_only": false, "value": "2026-01-22T04:02:08.706000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "vulnerabilities.14.release_date"}, {"timestamp": "2026-01-22T05:00:54.709Z", "date_only": false, "value": "2026-01-22T05:00:54.709179+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "vulnerabilities.14.discovery_date"}, {"timestamp": "2026-01-27T00:34:06.229Z", "date_only": false, "value": "2026-01-27T00:34:06.229000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "vulnerabilities.15.release_date"}, {"timestamp": "2026-01-27T01:00:58.032Z", "date_only": false, "value": "2026-01-27T01:00:58.032530+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "vulnerabilities.15.discovery_date"}, {"timestamp": "2026-01-28T00:00:00Z", "date_only": false, "value": "2026-01-28T00:00:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "vulnerabilities.4.release_date"}, {"timestamp": "2026-01-28T17:00:46.678Z", "date_only": false, "value": "2026-01-28T17:00:46.678419+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "vulnerabilities.4.discovery_date"}, {"timestamp": "2026-01-28T19:30:31.215Z", "date_only": false, "value": "2026-01-28T19:30:31.215000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "vulnerabilities.5.release_date"}, {"timestamp": "2026-01-28T20:01:42.791Z", "date_only": false, "value": "2026-01-28T20:01:42.791305+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "vulnerabilities.5.discovery_date"}, {"timestamp": "2026-02-02T19:59:47.374Z", "date_only": false, "value": "2026-02-02T19:59:47.374Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-25536", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-02-03T14:35:33.721Z", "date_only": false, "value": "2026-02-03T14:35:33.721000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "vulnerabilities.8.release_date"}, {"timestamp": "2026-02-03T14:36:03.630Z", "date_only": false, "value": "2026-02-03T14:36:03.630000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "vulnerabilities.9.release_date"}, {"timestamp": "2026-02-03T14:36:23.257Z", "date_only": false, "value": "2026-02-03T14:36:23.257000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "vulnerabilities.10.release_date"}, {"timestamp": "2026-02-03T15:00:58.388Z", "date_only": false, "value": "2026-02-03T15:00:58.388707+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "vulnerabilities.8.discovery_date"}, {"timestamp": "2026-02-03T15:01:03.441Z", "date_only": false, "value": "2026-02-03T15:01:03.441713+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "vulnerabilities.9.discovery_date"}, {"timestamp": "2026-02-03T15:01:18.274Z", "date_only": false, "value": "2026-02-03T15:01:18.274166+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "vulnerabilities.10.discovery_date"}, {"timestamp": "2026-02-04T20:04:16Z", "date_only": false, "value": "2026-02-04T20:04:16Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-345P-7CG4-V4C7", "record": "GHSA-345P-7CG4-V4C7", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-02-04T21:29:38.276Z", "date_only": false, "value": "2026-02-04T21:29:38.276Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / redhat-SADP", "record": "CVE-2026-25536", "field": "containers.adp.1.datePublic"}, {"timestamp": "2026-02-04T21:29:38.276Z", "date_only": false, "value": "2026-02-04T21:29:38.276Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-25536", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-02-04T21:29:38.276Z", "date_only": false, "value": "2026-02-04T21:29:38.276000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "vulnerabilities.16.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-02-04T21:29:38.276Z", "date_only": false, "value": "2026-02-04T21:29:38.276Z", "kind": "other", "label": "Time", "source": "cvelistv5 / redhat-SADP", "record": "CVE-2026-25536", "field": "containers.adp.1.timeline.1.time"}, {"timestamp": "2026-02-04T21:29:38.276Z", "date_only": false, "value": "2026-02-04T21:29:38.276Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-25536", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-02-04T22:00:54.864Z", "date_only": false, "value": "2026-02-04T22:00:54.864280+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "vulnerabilities.16.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event"}, {"timestamp": "2026-02-04T22:00:54.864Z", "date_only": false, "value": "2026-02-04T22:00:54.864Z", "kind": "other", "label": "Time", "source": "cvelistv5 / redhat-SADP", "record": "CVE-2026-25536", "field": "containers.adp.1.timeline.0.time"}, {"timestamp": "2026-02-04T22:15:59Z", "date_only": false, "value": "2026-02-04T22:15:59Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-345P-7CG4-V4C7", "record": "GHSA-345P-7CG4-V4C7", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-02-04T22:15:59.663Z", "date_only": false, "value": "2026-02-04T22:15:59.663", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-25536", "record": "FKIE_CVE-2026-25536", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-02-05T20:58:06.900Z", "date_only": false, "value": "2026-02-05T20:58:06.900713Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-25536", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-02-05T20:58:06.900Z", "date_only": false, "value": "2026-02-05T20:58:06.900713Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-25536", "record": "FKIE_CVE-2026-25536", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-02-05T20:58:17.103Z", "date_only": false, "value": "2026-02-05T20:58:17.103Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-25536", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-02-09T14:52:39Z", "date_only": false, "value": "2026-02-09T14:52:39Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-345P-7CG4-V4C7", "record": "GHSA-345P-7CG4-V4C7", "field": "modified"}, {"timestamp": "2026-03-02T23:00:00Z", "date_only": false, "value": "2026-03-02T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0574", "record": "WID-SEC-W-2026-0574", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-03-02T23:00:00Z", "date_only": false, "value": "2026-03-02T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0574", "record": "WID-SEC-W-2026-0574", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-03-02T23:00:00Z", "date_only": false, "value": "2026-03-02T23:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0574", "record": "WID-SEC-W-2026-0574", "field": "vulnerabilities.6.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-03-03T23:00:00Z", "date_only": false, "value": "2026-03-03T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0574", "record": "WID-SEC-W-2026-0574", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-03-03T23:00:00Z", "date_only": false, "value": "2026-03-03T23:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0574", "record": "WID-SEC-W-2026-0574", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-03-04T10:42:23.672Z", "date_only": false, "value": "2026-03-04T10:42:23.672+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0574", "record": "WID-SEC-W-2026-0574", "field": "document.tracking.generator.date"}, {"timestamp": "2026-03-06T11:24:38Z", "date_only": false, "value": "2026-03-06T11:24:38+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-03-06T11:24:38Z", "date_only": false, "value": "2026-03-06T11:24:38+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-03-06T11:24:38Z", "date_only": false, "value": "2026-03-06T11:24:38+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "vulnerabilities.16.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-15T01:16:18.414Z", "date_only": false, "value": "2026-07-15T01:16:18.414Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-25536", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-07-15T01:16:18.414Z", "date_only": false, "value": "2026-07-15T01:16:18.414Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / redhat-SADP", "record": "CVE-2026-25536", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2026-07-15T02:18:54.340Z", "date_only": false, "value": "2026-07-15T02:18:54.340", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-25536", "record": "FKIE_CVE-2026-25536", "field": "lastModified"}, {"timestamp": "2026-08-04T06:51:03.257Z", "date_only": false, "value": "2026-08-04T06:51:03.257079Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/Correctover/36ce05054d457c4fb176b23f08f9962b", "record": "CVE-2026-25536", "field": "creation_timestamp", "uuid": "2a1dbcb1-6fa2-42f7-a8c6-9a057e91e705", "content": "# MCP Protocol Security in 2026: Why Patching Isn't Enough \u2014 And What Runtime Verification Solves\n\n> **Author**: Guigui Wang, Correctover  \n> **Date**: August 4, 2026  \n> **Relevance**: AI Agent infrastructure, MCP security, runtime verification standards\n\n---\n\n## TL;DR\n\nThe Model Context Protocol (MCP) has accumulated **at least 5 confirmed CVEs** in 2026 alone \u2014 DNS rebinding, session hijacking, session poisoning, cross-client data leaks, and Origin header bypass. Every single one follows the same pattern: the protocol trusts its environment without verifying it.\n\nI'm the author of **CCS (Correctover Computing Standard)**, the first IETF submission for AI Agent runtime verification (draft-correctover-ccs-00). This blog post shows how CCS's 7-dimensional runtime verification framework would have caught these vulnerabilities **systemically** \u2014 not as individual patches, but as a class of problems.\n\nIf you're running MCP-based AI agent infrastructure, you need to think about runtime verification, not just patching. Here's why.\n\n---\n\n## The MCP Vulnerability Catalog (2026)\n\n### CVE-2026-11624: DNS Rebinding Attack\n**Severity**: High  \n**Affected**: All MCP server implementations prior to v0.25  \n**Root Cause**: Missing `Origin` header validation\n\nAn attacker-controlled domain uses DNS rebinding to redirect a victim's browser to `127.0.0.1`, where a local MCP server is running. Because the server doesn't validate `Origin` headers, it accepts connections from the browser context \u2014 allowing arbitrary tool execution.\n\n**Impact**: Any website a developer visits while running an MCP server locally could weaponize this. File reads, command execution, database access \u2014 all through the agent's tool interface.\n\n### CVE-2026-67431: Session Poisoning (Ruby SDK)\n**CVSS**: 8.3 (High)  \n**Affected**: `mcp` Ruby gem < v0.23.0  \n**Root Cause**: Transport layer doesn't bind sessions to their owners\n\nThe stateful transport implementation failed to bind established sessions to their original owners or connection contexts. Any actor with access to a session ID can execute arbitrary tool calls.\n\n### CVE-2026-52869: Session Hijacking (Python SDK)\n**CVSS**: 7.1 (High)  \n**Affected**: MCP Python SDK < v1.27.2  \n**Root Cause**: JSON-RPC requests routed purely on user-controlled session IDs without ownership validation\n\nA bearer-token-authenticated attacker can hijack and inject JSON-RPC messages into another client's session by supplying their session ID. The transport layer accepts any valid token and routes to the target session.\n\n### CVE-2026-25536: Cross-Client Data Leak (TypeScript SDK)\n**CVSS**: 7.1 (High)  \n**Affected**: `@modelcontextprotocol/sdk` v1.10.0 through v1.25.3  \n**Root Cause**: Race condition in shared server/transport state\n\nWhen a single server or transport instance serves multiple clients, one client's tool results, notifications, and sampling requests can be delivered to another client. The trigger is ordinary concurrent load, not a crafted attack.\n\n### OX Security Findings: STDIO Transport Architecture\nThe MCP STDIO transport spawns a new process for every connection. This architectural choice means:\n- Each connection has its own process boundary (isolation?)\n- But also: each connection can access the full host system\n- No centralized verification of what the spawned process does\n\n---\n\n## The Pattern: Protocol Trust Without Runtime Verification\n\nLook at all five CVEs. They share a fundamental pattern:\n\n> **MCP trusts its environment. It assumes that if you have a valid connection, you're authorized. If you have a session ID, you own it. If you can reach localhost, you're a legitimate client.**\n\nThis is a **design-level assumption**, not a bug. And it's the same assumption that causes every new CVE.\n\nPatching one vulnerability doesn't fix the pattern:\n- Adding Origin validation fixes DNS rebinding but doesn't prevent the next spoofing attack\n- Binding sessions to owners prevents hijacking but doesn't validate what the session does\n- Isolating transport state prevents leaks but doesn't verify tool execution intent\n\nWhat MCP needs is not another patch. It needs **runtime verification** \u2014 continuous, systematic validation of every agent action against its authorization and intent.\n\n---\n\n## How CCS Solves This Systemically\n\nCCS (draft-correctover-ccs-00) is a 7-dimensional runtime verification framework submitted to IETF. Here's how each dimension addresses the MCP vulnerability pattern:\n\n### 1. Structure Verification\n**What it checks**: Is the incoming request structurally valid? Does it conform to the expected schema?\n\n**Catches**: Malformed JSON-RPC, unexpected tool call parameters, requests that don't match the server's capability declaration.\n\n### 2. Schema Verification  \n**What it checks**: Does the request match the declared tool/resource schema?\n\n**Catches**: Cross-client data leaks (responses with wrong schema), session poisoning (requests with wrong parameter types).\n\n### 3. Latency Verification\n**What it checks**: Is the response time within expected bounds?\n\n**Catches**: DNS rebinding attacks (abnormal latency patterns when browser proxies to localhost), replay attacks (timing anomalies).\n\n### 4. Cost Verification\n**What it checks**: Does the operation stay within declared resource bounds?\n\n**Catches**: Resource exhaustion through tool spam, unexpected computational costs from hijacked sessions.\n\n### 5. Identity Verification\n**What it checks**: Is the requesting entity who it claims to be? Is the session bound to the authenticated principal?\n\n**Catches**: Session hijacking (CVE-2026-52869), session poisoning (CVE-2026-67431). CCS binds session identity to the authenticated principal at the transport layer.\n\n### 6. Integrity Verification\n**What it checks**: Has the data been tampered with? Is the response from the expected source?\n\n**Catches**: Cross-client data leaks (CVE-2026-25536), response injection. CCS verifies data integrity at the byte level.\n\n### 7. Security Verification\n**What it checks**: Does the observed behavior match the declared authorization policy?\n\n**Catches**: DNS rebinding (CVE-2026-11624), STDIO process escape. CCS verifies that every tool execution stays within the declared authorization boundary, regardless of the transport mechanism.\n\n### Performance\n- **P50 latency**: ~133\u03bcs (out-of-process) / ~7.5\u03bcs (in-process)\n- **Verification mode**: Continuous, per-action\n- **False positive rate**: 0% across 28 audited projects\n\n---\n\n## The Self-Evolution Problem\n\nHere's what makes this worse: MCP is a **living protocol**. New transports are added. New SDKs are implemented. New tool patterns emerge. Every change introduces new attack surfaces.\n\nStatic patches can't keep up. You need a verification engine that **evolves** with the protocol.\n\nThat's why CCS includes a self-evolving detection engine (MCPFuzz):\n- **Layer 1**: Static analysis of known vulnerability patterns\n- **Layer 2**: Dynamic fuzzing with semantic-aware test generation\n- **Layer 3**: Behavioral analysis that discovers new bypass patterns autonomously\n\nThis isn't a rule engine. It's an agent that continuously learns what \"normal\" MCP behavior looks like and flags deviations. It achieved **0 false positives** across 28 production projects in the agent ecosystem.\n\n---\n\n## What This Means for You\n\n### If you're an MCP server operator:\n- Upgrade to the latest SDK versions (v0.25+ for Python, v0.23.0+ for Ruby, v1.26.0+ for TypeScript)\n- Implement Origin header validation\n- Bind sessions to authenticated principals\n- Isolate transport state per client\n\nBut also: **deploy runtime verification**. The patches fix known CVEs. CCS prevents the next class of vulnerabilities.\n\n### If you're building on MCP:\n- Don't assume the protocol is secure. It's a living standard with fundamental trust assumptions.\n- Add CCS verification to your agent pipeline. 133\u03bcs overhead is negligible compared to the risk.\n- Audit your tool execution policies. What is your agent authorized to do? CCS enforces that at runtime.\n\n### If you're an enterprise deploying AI agents:\n- MCP is the connective tissue between your LLM and your enterprise tools (databases, APIs, file systems).\n- A vulnerability in MCP is a vulnerability in your entire agent infrastructure.\n- Runtime verification is not optional. It's the difference between \"we patched the known CVEs\" and \"we systematically prevent the class of problems.\"\n\n---\n\n## The Standard Matters\n\nCCS is not just my project. It's submitted to IETF (draft-correctover-ccs-00, Submission #167254). This means:\n- It's a community standard, not a vendor lock-in\n- It's transparent, auditable, and open\n- It's designed to be adopted across the ecosystem\n\nThe DOI (10.5281/zenodo.21783723) provides timestamped proof of priority. The ccs-verifier SDK is on PyPI (v0.4.1). The code is open source.\n\nI'm not selling anything. I'm establishing a standard and proving it works. The question is whether the ecosystem adopts it before or after the next major MCP vulnerability makes headlines.\n\n---\n\n## Resources\n\n- **CCS IETF Draft**: https://datatracker.ietf.org/submit/status/167254/\n- **CCS DOI**: https://doi.org/10.5281/zenodo.21783723\n- **ccs-verifier SDK**: https://pypi.org/project/ccs-verifier/\n- **GitHub**: https://github.com/Correctover/ccs-verifier\n- **MCP CVE-2026-11624**: https://cvereports.com/reports/CVE-2026-11624\n- **MCP CVE-2026-52869**: https://cvereports.com/reports/CVE-2026-52869\n\n---\n\n*Guigui Wang is the author of CCS and founder of Correctover. Correctover's mission is to make AI Agent runtime verification a standard practice, not an afterthought.*\n", "url": "https://gist.github.com/Correctover/36ce05054d457c4fb176b23f08f9962b"}, {"timestamp": "2026-09-04T00:36:24Z", "date_only": false, "value": "2026-09-04T00:36:24+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-10-29T21:22:08Z", "date_only": false, "value": "2026-10-29T21:22:08+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-10-29T21:22:08Z", "date_only": false, "value": "2026-10-29T21:22:08+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-29T21:22:08Z", "date_only": false, "value": "2026-10-29T21:22:08+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "document.tracking.current_release_date"}], "metrics": {"as_of": "2026-10-29T23:32:00.958Z", "anchors": {"origin": {"timestamp": "2026-02-04T22:00:54.864Z", "date_only": false, "value": "2026-02-04T22:00:54.864280+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "vulnerabilities.16.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event"}, "discovery": {"timestamp": "2026-02-04T22:00:54.864Z", "date_only": false, "value": "2026-02-04T22:00:54.864280+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "vulnerabilities.16.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event"}, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-02-04T20:04:16Z", "date_only": false, "value": "2026-02-04T20:04:16Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-345P-7CG4-V4C7", "record": "GHSA-345P-7CG4-V4C7", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": {"timestamp": "2026-03-06T11:24:38Z", "date_only": false, "value": "2026-03-06T11:24:38+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "vulnerabilities.16.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event"}}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start"]}, "total_time_to_patch": {"available": true, "seconds": 2553823.136, "hours": 709.3953155555555, "days": 29.558138148148146, "min_seconds": 2553823.136, "max_seconds": 2553823.136, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-02-04T22:00:54.864Z", "date_only": false, "value": "2026-02-04T22:00:54.864280+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "vulnerabilities.16.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-03-06T11:24:38Z", "date_only": false, "value": "2026-03-06T11:24:38+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "vulnerabilities.16.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event"}}, "disclosure_to_patch": {"available": true, "seconds": 2560822.0, "hours": 711.3394444444444, "days": 29.63914351851852, "min_seconds": 2560822.0, "max_seconds": 2560822.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-02-04T20:04:16Z", "date_only": false, "value": "2026-02-04T20:04:16Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-345P-7CG4-V4C7", "record": "GHSA-345P-7CG4-V4C7", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-03-06T11:24:38Z", "date_only": false, "value": "2026-03-06T11:24:38+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "vulnerabilities.16.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event"}}, "time_unpatched": {"available": true, "seconds": 2553823.136, "hours": 709.3953155555555, "days": 29.558138148148146, "min_seconds": 2553823.136, "max_seconds": 2553823.136, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-02-04T22:00:54.864Z", "date_only": false, "value": "2026-02-04T22:00:54.864280+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "vulnerabilities.16.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-03-06T11:24:38Z", "date_only": false, "value": "2026-03-06T11:24:38+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:3960", "record": "RHSA-2026:3960", "field": "vulnerabilities.16.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}