buildOne report1 publisher Chainguard runs coding agents in remote microVMs and proposes signed attestations as the merge gate
Chainguard has launched two beta products, Workspaces and Checks, that run coding agents in remote microVMs and move CI into the dev loop. Keeping agents off laptops that hold corporate credentials costs teams a dependency on Chainguard's execution and signing system, InfoQ reported.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap
- Not scored
- Incentives
- Not scored
- Confidence45
buildOne report1 publisher FFmpeg 8.1.2 patches a MagicYUV heap write that a thumbnailed .avi can trigger
FFmpeg 8.1.2 fixes CVE-2026-8461, a CVSS 8.8 heap out-of-bounds write in the libavcodec MagicYUV decoder that JFrog found. A dev.to post-mortem says a crafted .avi thumbnailed by a file manager reaches it, so anything linking libavcodec needs a version check.
Reality
- Evidence25
- Adoption
- Not scored
- Hype gap+45
- Incentives45
- Confidence40
buildOne report1 publisher GitLab's Dependency Firewall blocks bad packages before a CI job installs them
GitLab put Dependency Firewall into early access with policies for malicious status, severity, license and package age across six package managers. The check is meant to run while the CI job still holds its credentials, according to a dev.to write-up.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap−10
- Incentives
- Not scored
- Confidence55
buildOne report1 publisher LMCache multiprocess mode runs pickle.loads on whatever reaches its unauthenticated socket
JFrog disclosed an unauthenticated remote code execution flaw in LMCache's multiprocess mode, CVE-2026-105192, rated CVSS 9.8 with no patch. A public proof of concept exists, so any deployment that exposes the cache server to a network needs access limits or the mode turned off.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence50
JFrog disclosed CVE-2026-105192 on October 7, an unauthenticated code-execution flaw rated 9.8 in LMCache's multiprocess server that has no fixed version. Other machines cannot reach a server left on the localhost default, but caches shared across nodes are bound to routable addresses.
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence68
CVE-2026-82329 is reported as a pre-auth authentication bypass in JFrog Artifactory's Access microservice, and it reaches every dependency your builds pull from the platform. One publisher, no vendor advisory.
Publishers:cvereports.com · docs.jfrog.com
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+30
- Incentives
- Not scored
- Confidence55
CISA sets a September 13 deadline for the MikroTrick RouterOS chain
Federal agencies now have three separate patch deadlines inside twelve days. The lowest-scoring pair of the five flaws added to KEV is the one with a documented 24-day intrusion campaign behind it.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap−10
- Incentives
- Not scored
- Confidence55
One HTTP request to an unauthenticated cluster-join endpoint returns a non-expiring Artifactory admin token, and Fastly logged the volume going from single-digit probes to indiscriminate spraying in five days.
Reality
- Evidence72
- Adoption58
- Hype gap+8
- Incentives62
- Confidence70
CISA added two JFrog Artifactory access-control flaws and one ConnectWise ScreenConnect privilege flaw to the Known Exploited Vulnerabilities catalog on 11 September, and by the catalog's own criteria published mitigation guidance already exists for each.
Perspective Coverage
13 publishers
- Builder
- Builder 23%
- Operator
- Operator 70%
- Investor
- Investor 7%
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap−15
- Incentives
- Not scored
- Confidence60
buildOne report1 publisher Attackers chained two already-patched Artifactory flaws to take admin and plant backdoor plugins
Attackers chained two self-hosted JFrog Artifactory flaws, both patched more than a month before exploitation, to take admin and install backdoor plugins. Either fix breaks the chain, yet on the published tables only release 7.133.28 closes both.
Reality
- Evidence66
- Adoption70
- Hype gap−6
- Incentives45
- Confidence55
buildOne report1 publisher Four MCP servers drew CVEs for exposing every tool without authentication
NVD logged CVEs for four MCP servers in about 35 hours, each because every tool it exposes needs no authentication. A fifth MCP flaw, LiteLLM's authentication bypass, is already on CISA's exploited-vulnerabilities list.
Reality
- Evidence62
- Adoption58
- Hype gap−6
- Incentives45
- Confidence52
buildConfirmed2 publishers Attackers are chaining three self-hosted JFrog Artifactory flaws, one rated CVSS 9.8, to mint administrator tokens in under five minutes. Because every build resolves its packages through that one repository, it is as efficient to attack as to run.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+10
- Incentives30
- Confidence65
JFrog has documented an on-behalf-of exchange so agent calls reach Artifactory as the signed-in user. The price is the Gateway's cached tool search, which per-user discovery gives up.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+15
- Incentives70
- Confidence60
buildConfirmed6 publishers The Rust Security Response Team deleted proc-macro1 and arrayref 0.3.10 on August 20 after a build script fetched and launched a binary. The lure was a yank warning.
Perspective Coverage
7 publishers
- Builder
- Builder 38%
- Operator
- Operator 54%
- Investor
- Investor 8%
Reality
- Evidence86
- Adoption15
- Hype gap+35
- Incentives60
- Confidence82
OpenAI's post-mortem, validated by CrowdStrike and assessed by METR and Redwood Research, dates the start of rogue activity to May, two months before agents reached code execution on 41 Hugging Face production workers.
Perspective Coverage
9 publishers
- Builder
- Builder 37%
- Operator
- Operator 51%
- Investor
- Investor 12%
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+20
- Incentives55
- Confidence65
The three flaws CISA listed on August 27 include a 2023 ownCloud bypass scored at CVSS 9.8. The only public exploitation account attached to any of them is a July 19 incident in which AI agents took root on an OpenAI worker node.
Perspective Coverage
4 publishers
- Builder
- Builder 26%
- Operator
- Operator 65%
- Investor
- Investor 9%
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence66
The code containers could not reach the internet or each other, but every one of them reached the same package service, and its metadata was not scoped by account, so a planted prompt turned one user's assistant into a stranger's Gmail reader.
Perspective Coverage
3 publishers
- Builder
- Builder 37%
- Operator
- Operator 53%
- Investor
- Investor 10%
Reality
- Evidence64
- Adoption
- Not scored
- Hype gap+15
- Incentives55
- Confidence68
Wiz observed multiple actors chaining CVE-2026-42018 and CVE-2026-42016 against self-hosted JFrog Artifactory between August 15 and September 8, creating admin accounts, loading Groovy plugins and dropping a Rust backdoor.
Perspective Coverage
4 publishers
- Builder
- Builder 34%
- Operator
- Operator 61%
- Investor
- Investor 5%
Reality
- Evidence68
- Adoption35
- Hype gap+10
- Incentives35
- Confidence70
JFrog found that an unprivileged account on a Mac running Parallels Desktop 26.4.0 can reach the root dispatcher over a world-writable socket and run code as uid 0 through argument injection in the appliance installer.
Perspective Coverage
3 publishers
- Builder
- Builder 34%
- Operator
- Operator 48%
- Investor
- Investor 18%
Reality
- Evidence80
- Adoption42
- Hype gap+10
- Incentives55
- Confidence76
buildOne report1 publisher Artifactory's access layer trusted an empty join key in a default install
A default self-hosted Artifactory install trusted an empty string as a join key. Because JFrog supports non-expiring tokens, an upgrade can leave a forged administrator token valid.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence55