CVE-2026-82526 (CVSS 9.8), CVE-2026-85695 (CVSS 9.4), and CVE-2026-85620 (CVSS 9.2) all shipped this week without default authentication. Add Microsoft’s September 3 batch – nine identity CVEs, two at CVSS 10.0 – and the picture stops looking like a series of isolated bugs. These are not incidental coding errors; they are structural failures in how AI middleware is architected, where authentication is treated as an optional component rather than a foundational requirement.
Retrieval Layer: SQL Injection That Should Not Exist
The R2R retrieval framework – covered here last week – is affected by two high-severity flaws. CVE-2026-82526 involves stacked SQL injection in the vector index creation endpoint: the index name is interpolated directly into a PostgreSQL CREATE INDEX statement without identifier quoting or allowlist validation. The service defaults to require_authentication=false with superuser privileges. CVE-2026-82527 allows filter key injection via the retrieval search endpoint, where filter values are parameterized but filter keys are not. The asymmetry is the tell: the safe-looking side is actually the attack surface.
These flaws are not theoretical. The LiteLLM Proxy CVE-2026-42208 – SQL injection via bearer token concatenation – saw first exploitation 36 hours after disclosure. CISA added it to the Known Exploited Vulnerabilities catalog in May.
Model Serving Layer: Unauthenticated Worker Registration
At the model serving layer, CVE-2026-85695 in FastChat (CVSS 9.4) exposes an unauthenticated /register_worker endpoint that accepts client-supplied worker names and performs outbound requests without address validation or shared secrets. An attacker can register arbitrary worker addresses under legitimate model names, intercepting user prompts and responses while using the controller as an SSRF primitive against internal hosts. All versions through 0.2.36 are affected. No patch exists.
Database Layer: The Restricted Mode That Isn’t
Postgres MCP Pro‘s restricted mode – the configuration operators are told makes agent-database interaction safe – contains CVE-2026-85620 (CVSS 9.2). The SQL safety validator checks function calls against an allowlist only when they appear as FuncCall AST nodes. Functions placed in a FROM clause parse as RangeFunction nodes – a type the validator permits without checking. SELECT pg_read_file('/etc/passwd') is blocked; SELECT * FROM pg_read_file('/etc/passwd') executes and returns the file contents. The bypass escalates from database queries to host filesystem access: system configurations, credentials, TLS keys. All versions through 0.3.0. No patch.
Identity Infrastructure: Microsoft’s Own Stack
Microsoft’s September 3 early security update included nine CVEs, eight critical. Two carry CVSS 10.0: CVE-2026-83711, an authorization bypass through a user-controlled key in Azure AD B2C, and CVE-2026-70352, missing authentication for a critical function in Azure AI Language. CVE-2026-83941 in Entra ID scored 9.9. CVE-2026-80098 in Copilot Studio scored 9.3. All were mitigated server-side by Microsoft – no customer action required. But the presence of fundamental identity flaws across Azure’s AI and identity stack, disclosed the same week as the open-source cluster, signals that even mature providers are struggling with the same structural gap.
The Pattern Is Architectural
The common thread across all four layers is a functionality-first bias. Developers are deploying application-layer safety controls – AST validators, allowlists, read-only transaction modes – as if they were database-level security boundaries. They are not. When the enforcement point sits in middleware that an attacker can influence, the trust model collapses at the first parser gap.
The Model Context Protocol ecosystem has grown to 97 million monthly SDK downloads and more than 10,000 active public servers, with 28 percent of Fortune 500 companies running MCP servers in production, according to a 2026 industry report. The Department of Defense flagged in June that MCP proliferation has outpaced security model maturity. Fifty percent of MCP server builders cite security and access control complexity as their biggest challenge.
Market Signal: Pricing the Gap
The market is not waiting for the pattern to resolve itself. Over $275 million has been invested across three companies – AIR Security ($50M seed), Noma Security ($100M), and Zenity ($125M) – focused on the AI agent firewall category. AIR Security reports filtering approximately 27 percent of the 17,800 public AI add-ons it monitors.
Operational Reality
For teams running AI infrastructure in production, the implication is concrete: treat every AI-native endpoint as public-facing, regardless of intended internal use. The middleware layer – where agents interact with vector stores, knowledge graphs, retrieval endpoints, and model-serving controllers – is where security debt is accumulating fastest. SQL injection is a solved problem in mature web frameworks. Its reappearance across AI infrastructure middleware says more about the pace of development than the sophistication of attackers.