REPORTED DEVELOPMENT
CVE publication window: 21-22 October; earlier disclosure between July and September.
CVE-2026-114612, CVSS 9.9 Critical, allows an authenticated internal user to gain administrative privileges through reuse of cryptographic material between credentials and sessions. Affected versions can also permit command execution through MCP. Corrected branches include 1.100.4, 1.101.3, 1.102.2 and 1.103.1.
The original disclosure occurred between July and September; CVE publication on 21-22 October is the new development. This is distinct from the software-distribution compromise.
WHY IT MATTERS TO THE MARKET
Credential separation and the privileges exercised through MCP are critical controls.