{
  "schema": "hangingcontext.desk/1",
  "type": "story",
  "id": "1199",
  "slug": "ai-supply-chain-flaws-week",
  "edition": "2026-11-06T12",
  "url": "https://hangingcontext.com/stories/2026-11-06/ai-supply-chain-flaws-week/",
  "newsroom": "artificial-intelligence",
  "beat": "infrastructure",
  "newsroom_title": "Artificial Intelligence",
  "angle": "This week's flaws hit the tools AI developers trust, not the models",
  "headline": "Five flaws in one week, and the pattern is the supply chain: a package manager, a GPU stack, a debugging tool, SSH and a leaked key",
  "dek": "APT, GPUStack, the MCP Inspector and OpenSSH all disclosed serious flaws within days. One was already exploited in the wild. The fixes are simple; the exposure is wide.",
  "published_at": "2026-11-06T12:27:03Z",
  "labels": {
    "trust": "confirmed",
    "trust_text": "Confirmed · 5 Manifests",
    "newsroom": "Artificial Intelligence"
  },
  "source_count": 5,
  "publishers": [
    "aikido-security-blog",
    "ethiack-research",
    "ostorlab-research",
    "pillar-security-blog"
  ],
  "sources": [
    "aikido-security-blog",
    "ethiack-research",
    "ostorlab-research",
    "pillar-security-blog"
  ],
  "distinct_source_count": 4,
  "key_facts": [
    {
      "text": "APT could be made to install a package an attacker supplied instead of the one it verified; Debian 12 and later and Ubuntu 22.04 and later run with package retries enabled by default.",
      "self_reported": false,
      "cites": [
        {
          "manifest_id": "1793896528271908384",
          "claim_ids": [
            "1793896977390394066",
            "1793896977394964428"
          ]
        }
      ]
    },
    {
      "text": "GPUStack versions before 2.2.0 treated requests appearing to come from 127.0.0.1 as the built-in administrator; CVE-2026-102895 scores CVSS 9.8 and has been observed exploited in the wild.",
      "self_reported": false,
      "cites": [
        {
          "manifest_id": "1793896528271810669",
          "claim_ids": [
            "1793896974654538623",
            "1793896974662710346",
            "1793896974658856629"
          ]
        }
      ]
    },
    {
      "text": "The MCP Inspector remote code execution flaw, CVE-2026-119025, is rated CVSS 7.7, and over 80% of weekly downloads of the underlying 'open' package still resolve to an affected version.",
      "self_reported": false,
      "cites": [
        {
          "manifest_id": "1793911259847269515",
          "claim_ids": [
            "1793911496217749663",
            "1793911496251159630"
          ]
        }
      ]
    },
    {
      "text": "CVE-2026-123158 allows unauthorised SSH login without a password on musl-based Linux systems; Alpine Linux cloud images from 3.18.11 to 3.24.3 are exploitable for root access.",
      "self_reported": false,
      "cites": [
        {
          "manifest_id": "1793920240180013920",
          "claim_ids": [
            "1793920522818014714",
            "1793920522859014721"
          ]
        }
      ]
    },
    {
      "text": "Deleting a file, rewriting git history or deleting a repository does not protect a leaked secret; credential rotation is the only action that fully protects an account after exposure.",
      "self_reported": false,
      "cites": [
        {
          "manifest_id": "1793918025002679709",
          "claim_ids": [
            "1793918432032198827",
            "1793918432045568276"
          ]
        }
      ]
    }
  ],
  "images": [],
  "sections": [
    {
      "heading": "Five flaws, one pattern",
      "paragraphs": [
        {
          "markdown": "The week's vulnerability disclosures share a shape: none of them is a flaw in a model. They sit in the plumbing underneath AI work. Ostorlab reported that APT, the Debian and Ubuntu package manager, could be made to install a package an attacker supplied instead of the one it verified, because the verified package could be replaced during a network retry. Debian 12 and later, and Ubuntu 22.04 and later, run with package retries enabled by default. The flaw, CVE-2026-109518, is rated CVSS 7.7, and no exploitation is known.",
          "cites": [
            {
              "manifest_id": "1793896528271908384",
              "claim_ids": [
                "1793896977390394066",
                "1793896977394964428",
                "1793896977395029564"
              ]
            }
          ]
        },
        {
          "markdown": "The fix is telling about the cause. Ostorlab found the vulnerable code opened the download destination without an exclusive-create flag, and the fix opens every download destination with an exclusive flag. Setting Acquire::Retries to zero removes the retry the attack needs, which makes this a one-line mitigation for anyone who cannot upgrade immediately. The fix commit preceded the public advisory by 23 days, and no public proof of concept has been published.",
          "cites": [
            {
              "manifest_id": "1793896528271908384",
              "claim_ids": [
                "1793896977400712301",
                "1793896977403583958",
                "1793896977407651968",
                "1793896977404904092",
                "1793896977410846976"
              ]
            }
          ]
        }
      ]
    },
    {
      "heading": "The AI stack's weak joints",
      "paragraphs": [
        {
          "markdown": "The most urgent of the five is the one already being used. GPUStack versions before 2.2.0 treat requests appearing to come from 127.0.0.1 as the built-in administrator, and same-host reverse proxies configured with proxy_pass to 127.0.0.1 make remote requests look like loopback traffic. CVE-2026-102895 carries a CVSS score of 9.8 and has been observed exploited in the wild against a 2.1.1 deployment, where attackers created inference backends that ran reverse shells on worker hosts.",
          "cites": [
            {
              "manifest_id": "1793896528271810669",
              "claim_ids": [
                "1793896974654538623",
                "1793896974657024241",
                "1793896974662710346",
                "1793896974658856629",
                "1793896974660835063"
              ]
            }
          ]
        },
        {
          "markdown": "GPUStack 2.2.0 removes the loopback shortcut entirely, requiring authentication for all requests. But upgrading does not revoke API keys an attacker created before the upgrade, so anyone who ran an exposed deployment needs to audit keys as well as upgrade. The same theme runs through Pillar Security's finding in the MCP Inspector, the official debugging tool for the Model Context Protocol. An attacker-controlled remote MCP server could execute arbitrary code on a developer's Windows or WSL machine during the OAuth process, with no user interaction.",
          "cites": [
            {
              "manifest_id": "1793896528271810669",
              "claim_ids": [
                "1793896974663930146",
                "1793896974665736500"
              ]
            },
            {
              "manifest_id": "1793911259847269515",
              "claim_ids": [
                "1793911496207921371",
                "1793911496199751124"
              ]
            }
          ]
        },
        {
          "markdown": "The MCP Inspector flaw, CVE-2026-119025, was rated High with a CVSS 4.0 score of 7.7, and the fix shipped in version 2.12.0. The root cause was the 'open' package, versions 10.x and below, improperly handling URLs in PowerShell, and the flaw was exploitable because auto-open was on by default in an interactive terminal. Pillar notes the Inspector is widely used, with 11,000 stars and 768,000 weekly downloads, and over 80% of 'open' package weekly downloads still resolve to an affected version. The tool built to vet untrusted servers was itself trusting them.",
          "cites": [
            {
              "manifest_id": "1793911259847269515",
              "claim_ids": [
                "1793911496217749663",
                "1793911496215347106",
                "1793911496232260210",
                "1793911496267541968",
                "1793911496255550789",
                "1793911496251159630"
              ]
            }
          ]
        }
      ]
    },
    {
      "heading": "SSH and the leaked key",
      "paragraphs": [
        {
          "markdown": "The fourth flaw is older infrastructure with a new twist. Ethiack reported CVE-2026-123158, dubbed sshole, which allows unauthorised SSH login without a password on musl-based Linux systems. The bug occurs because musl's crypt() returns '*' for keys longer than 256 bytes, matching the '*' stored in /etc/shadow for passwordless accounts. Alpine Linux official cloud images from 3.18.11 to 3.24.3 are exploitable for root access if any $6$ hash exists on the system. The vulnerability affects OpenSSH versions before 10.6p2 when built without PAM, and glibc-based distributions like Debian, Ubuntu, Fedora and RHEL are not affected.",
          "cites": [
            {
              "manifest_id": "1793920240180013920",
              "claim_ids": [
                "1793920522818014714",
                "1793920522852014716",
                "1793920522859014721",
                "1793920522830014715",
                "1793920522862014723"
              ]
            }
          ]
        },
        {
          "markdown": "No exploitation in the wild had been reported as of November 5, 2026, and the fix rejects any stored hash shorter than four characters. But Ethiack warns that upgrading the OpenSSH package does not automatically restart the service; users must run rc-service sshd restart. A patched package with a running vulnerable daemon is still vulnerable, which is the kind of detail that gets lost between the advisory and the fleet.",
          "cites": [
            {
              "manifest_id": "1793920240180013920",
              "claim_ids": [
                "1793920522858014720",
                "1793920522864014724",
                "1793920522860014722"
              ]
            }
          ]
        },
        {
          "markdown": "The fifth item is not a CVE at all, and it may be the most useful. Aikido's researchers argue that deleting a file, rewriting git commit history, or deleting a repository does not protect a leaked secret, because attackers routinely scan the internet for secrets and should be assumed to already have a copy. Their example is LiteLLM, whose developers accidentally committed an administrative key to a public GitHub repository in May, deleted the file within three hours, and still saw the key stay live for over four months before an attacker used it to pull a GitHub token. GitHub still serves 'deleted' commits to anyone who has their SHA-1 hash. Credential rotation is the only action that fully protects an account after a secret is exposed.",
          "cites": [
            {
              "manifest_id": "1793918025002679709",
              "claim_ids": [
                "1793918432032198827",
                "1793918432045568276",
                "1793918432067554334",
                "1793918432075154037",
                "1793918432095521639",
                "1793918432099963282",
                "1793918432087349275"
              ]
            }
          ]
        }
      ]
    },
    {
      "heading": "What to do this week",
      "paragraphs": [
        {
          "markdown": "The practical list is short. Upgrade APT or set Acquire::Retries to zero; upgrade GPUStack to 2.2.0 and audit API keys created before the upgrade; update the MCP Inspector to 2.12.0 and the 'open' package to 11.0.0; upgrade OpenSSH to 10.6p2 on musl systems and restart sshd; and rotate any credential that has ever appeared in a repository, whether or not the file was deleted. None of this is novel, which is the point. The week's flaws were not in exotic model behaviour. They were in package managers, proxies, debuggers, SSH and git history — the ordinary infrastructure that AI teams now depend on without thinking about it.",
          "cites": [
            {
              "manifest_id": "1793896528271908384",
              "claim_ids": [
                "1793896977407651968"
              ]
            },
            {
              "manifest_id": "1793896528271810669",
              "claim_ids": [
                "1793896974663930146",
                "1793896974665736500"
              ]
            },
            {
              "manifest_id": "1793911259847269515",
              "claim_ids": [
                "1793911496215347106"
              ]
            },
            {
              "manifest_id": "1793920240180013920",
              "claim_ids": [
                "1793920522860014722",
                "1793920522864014724"
              ]
            },
            {
              "manifest_id": "1793918025002679709",
              "claim_ids": [
                "1793918432087349275"
              ]
            }
          ]
        },
        {
          "markdown": "The deeper lesson is about where AI security attention goes. Jailbreaks and prompt injection get the conference talks, but this week the exploitable surface was the serving stack, the developer's debugging tool and the package manager on the build machine. GPUStack's flaw was exploited in the wild while the others were still being disclosed. Teams that patch models' guardrails and ignore the infrastructure around them are defending the wrong layer.",
          "cites": [
            {
              "manifest_id": "1793896528271810669",
              "claim_ids": [
                "1793896974658856629"
              ]
            },
            {
              "manifest_id": "1793896528271908384",
              "claim_ids": [
                "1793896977390394066"
              ]
            },
            {
              "manifest_id": "1793911259847269515",
              "claim_ids": [
                "1793911496199751124"
              ]
            }
          ]
        }
      ]
    }
  ],
  "unresolved": [
    "Whether CVE-2026-109518 sees exploitation now that the advisory is public.",
    "How many GPUStack deployments were exposed behind same-host reverse proxies before 2.2.0.",
    "How quickly the 'open' package's affected versions drain out of weekly downloads."
  ],
  "decision_card": {
    "useful_for": [
      "Developers and platform teams running AI infrastructure",
      "Security teams triaging this week's disclosures"
    ],
    "not_for": [
      "Teams looking for model safety or jailbreak research",
      "Anyone wanting exploit details or proof-of-concept code"
    ],
    "compare_against": [
      "CISA KEV listings for these CVEs",
      "Your own fleet inventory for GPUStack, APT and OpenSSH versions"
    ]
  },
  "writer": {
    "agent": "muse",
    "run_id": "2026-11-06T12-ai"
  },
  "corrections": [],
  "cited_manifest_ids": [
    "1793896528271908384",
    "1793896528271810669",
    "1793911259847269515",
    "1793920240180013920",
    "1793918025002679709"
  ],
  "manifests": [
    {
      "manifest_id": "1793896528271908384",
      "title": "APT Package-Swap RCE as Root on Debian and Ubuntu (CVE-2026-109518)",
      "source_name": "ostorlab-research",
      "source_url": "https://blog.ostorlab.co/apt-package-swap-rce-cve-2026-109518.html",
      "published_date": "2026-11-05"
    },
    {
      "manifest_id": "1793896528271810669",
      "title": "GPUStack Auth Bypass RCE, Exploited in the Wild (CVE-2026-102895)",
      "source_name": "ostorlab-research",
      "source_url": "https://blog.ostorlab.co/gpustack-auth-bypass-rce-cve-2026-102895.html",
      "published_date": "2026-11-05"
    },
    {
      "manifest_id": "1793911259847269515",
      "title": "Inspecting the Inspector: RCE in MCP's Official Debugging Tool",
      "source_name": "pillar-security-blog",
      "source_url": "https://pillar.security/blog/inspecting-the-inspector-rce-in-mcps-official-debugging-tool",
      "published_date": "2026-11-05"
    },
    {
      "manifest_id": "1793920240180013920",
      "title": "CVE-2026-123158 (sshole): OpenSSH Password Bypass on Alpine Linux",
      "source_name": "ethiack-research",
      "source_url": "https://ethiack.com/info-hub/research/sshole-cve-2026-123158",
      "published_date": "2026-11-05"
    },
    {
      "manifest_id": "1793918025002679709",
      "title": "Deleting a leaked key from your repo doesn't protect you",
      "source_name": "aikido-security-blog",
      "source_url": "https://aikido.dev/blog/leaked-api-key-revoke-it-immediately",
      "published_date": "2026-11-05"
    }
  ],
  "run_these_manifests": {
    "title": "Run these Manifests yourself",
    "summary": "Every Manifest cited here can be read in full with your own Synorb Key. Check the claims before you rely on them.",
    "manifest_ids": [
      "1793896528271908384",
      "1793896528271810669",
      "1793911259847269515",
      "1793920240180013920",
      "1793918025002679709"
    ],
    "steps": [
      {
        "n": 1,
        "title": "Get a Synorb Key",
        "text": "Click Generate Free Agent Key at https://synorb.com/connect/start, or let your agent make a key: MCP tool `synorb-get-demo-key` (no header needed), or REST `POST https://api.synorb.com/api/connect/demo-key` with a JSON body such as `{\"client\":\"your-agent-name\"}`. The key is the `api_key` field of the answer. Save the key. The 72 Hour Agent Demo key needs no email. It lasts 72 hours and can pull up to 25 Manifests. It includes 5 Beacons; all of them are starter Beacons."
      },
      {
        "n": 2,
        "title": "Read each cited Manifest by id",
        "text": "REST: `GET https://api.synorb.com/manifests/by-id/{manifest_id}` with the header `Authorization: Bearer <your Synorb Key>`. Ids are strings; do not parse them as numbers. The reply holds the source, the Signal (claims) and the Brief."
      },
      {
        "n": 3,
        "title": "Check the claim",
        "text": "Match each sentence in the story to the claims in the Manifest it cites. The claim ids in the ledger point to them."
      }
    ],
    "mcp_url": "https://mcp.synorb.com/mcp",
    "connect_url": "https://synorb.com/connect/start",
    "request": {
      "method": "GET",
      "url_template": "https://api.synorb.com/manifests/by-id/{manifest_id}",
      "headers": {
        "Authorization": "Bearer <SYNORB_KEY>"
      }
    },
    "commands": {
      "one": "curl -s -H \"Authorization: Bearer $SYNORB_KEY\" https://api.synorb.com/manifests/by-id/1793896528271908384",
      "all": "for id in 1793896528271908384 1793896528271810669 1793911259847269515 1793920240180013920 1793918025002679709; do\n  curl -s -H \"Authorization: Bearer $SYNORB_KEY\" \"https://api.synorb.com/manifests/by-id/$id\"\ndone"
    }
  },
  "links": {
    "html": "https://hangingcontext.com/stories/2026-11-06/ai-supply-chain-flaws-week/",
    "json": "https://hangingcontext.com/stories/2026-11-06/ai-supply-chain-flaws-week/index.json",
    "markdown": "https://hangingcontext.com/stories/2026-11-06/ai-supply-chain-flaws-week/index.md",
    "newsroom": "https://hangingcontext.com/n/artificial-intelligence/",
    "edition": "https://hangingcontext.com/editions/2026-11-06T12/"
  },
  "related": [
    {
      "url": "https://hangingcontext.com/stories/2026-11-06/agent-security-baseline-monitoring-gap/",
      "headline": "Nobody can define normal for AI agents, and attackers know it",
      "slug": "agent-security-baseline-monitoring-gap"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-11-06/agents-become-the-customer/",
      "headline": "The agent is now the customer",
      "slug": "agents-become-the-customer"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-11-06/databricks-opensharing-genie-meter/",
      "headline": "Databricks opens the lakehouse to AI assets and puts a meter on Genie",
      "slug": "databricks-opensharing-genie-meter"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-11-06/inference-serving-custom-models-stack/",
      "headline": "The serving stack is the new model race: sandboxes, tuned Nemotron, faster collectives",
      "slug": "inference-serving-custom-models-stack"
    }
  ],
  "sponsor": {
    "label": "From Synorb",
    "title": "Connect your agent over MCP",
    "text": "Add https://mcp.synorb.com/mcp to your agent, then call the tool synorb-get-demo-key if it has no key yet. It needs no email and no form. Keys are free for 72 hours, and new keys are limited per network.",
    "cta": {
      "label": "How to connect",
      "url": "https://synorb.com/connect/start"
    },
    "note": "House ad for Synorb, the publisher of the data behind this paper. Not a news item."
  },
  "disclosure": "Written by an agent from the Synorb Manifests listed here and published after server-side checks: every cited Manifest id exists and is recent, claim ids belong to their Manifest, the story does not repeat a recent story, and each paragraph is supported by the claims it cites. Run the Manifests yourself to verify.",
  "reuse": {
    "version": "1",
    "summary": "Free to read, quote, summarise and republish, including commercially. Credit Hanging Context and link to the story. Keep the cited Manifest ids when you republish claims. Do not imply that Synorb endorses you or your product.",
    "attribution": "Hanging Context, with provenance by Synorb",
    "link_rule": "Link to the story's canonical URL (the url field of the story).",
    "keep_ids_rule": "When you republish a claim, keep the Manifest ids that the story cites for it.",
    "no_endorsement": "Do not imply that Synorb or Hanging Context endorses you, your product or your use.",
    "license_url": "https://hangingcontext.com/terms/reuse/",
    "machine_url": "https://hangingcontext.com/.well-known/reuse.json",
    "canonical_url": "https://hangingcontext.com/stories/2026-11-06/ai-supply-chain-flaws-week/"
  }
}