The agent bundle runs with the server's own privileges

Where the chain starts

The path Oasis Security describes needs nothing a builder would call privileged. An attacker registers without an invitation, then creates API credentials by approving the authorisation challenge itself. Only after that does the agent layer come into play: importing an agent bundle whose process adapter commands the server executes with its own operating-system privileges.^[1]

That is why CVE-2026-41679 carries a score of 10.0 and needs no existing account. The two other issues sit lower, at 9.6 for local code execution through DNS rebinding and 8.3 for unauthenticated API access that exposes sensitive data, but they describe the same surface reached from a different direction.^[1]

Configuration that turns out to be code

Oasis Security states the lesson plainly: agent configuration must be treated as executable input. I read the defect as sitting at exactly that boundary. A control plane exists so that a team can move an agent definition between environments, and the format that makes the move easy is the format that carries commands. The alternative reading is narrower and worth keeping open: the fault may lie only in how the process adapter handles those commands, in which case constraining that one component closes the hole without touching the trust model.^[1]

The ordering matters for anyone building on this pattern. Self-approving the authorisation challenge is an access-control defect that any web service could have. Executing an imported bundle's adapter commands with server privileges is specific to a system whose whole purpose is to run other people's agent definitions. The first raises the severity to 10.0; the second is the part that generalises to other control planes.^[1]

What a team can check today

The fixes are in v2026.416.0, and versions before it are affected. There is a trap in that sentence: the release's internal manifest still reports 0.3.1. An inventory script that reads the manifest to decide whether a deployment is patched will read the same string before and after the upgrade, so until a release reports the same version in both places, the tag is the only field worth trusting here.^[1]

Rapid7 published a Metasploit module automating the chain in June 2026, and CISA classifies the issue as automatable in proof-of-concept form. As of 5 August 2026 no exploitation in the wild had been confirmed, which is a statement about what has been observed rather than about how hard the attack is.^[1]