AAK coverage — v0.3.23

Static matrix. Generated nightly. Source manifests under agent_audit_kit/data/.

OX-disclosed CVEs (19/19 = 100.0%)

CVE / disclosureTitleStatusCovering rule(s)
CVE-2025-66335apache-doris-mcp-server SQL injectioncoveredAAK-DORIS-001
CVE-2025-66414MCP Python SDK StreamableHTTP DNS rebindingcoveredAAK-DNS-REBIND-001, AAK-DNS-REBIND-002
CVE-2025-66416MCP Python SDK StreamableHTTP DNS rebinding (companion)coveredAAK-DNS-REBIND-001, AAK-DNS-REBIND-002
CVE-2026-20205splunk-mcp-server token-cleartext loggingcoveredAAK-SPLUNK-TOKLOG-001, AAK-LOG-TOKEN-LEAK-001
CVE-2026-23744MCPJam Inspector vendored forkcoveredAAK-MCP-INSPECTOR-CVE-2026-23744-001
CVE-2026-27825Atlassian MCP RCE chaincoveredAAK-MCP-ATLASSIAN-CVE-2026-27825-001
CVE-2026-32211Azure MCP server-author missing authcoveredAAK-MCP-SERVER-AUTH-001
CVE-2026-33032MCPwn twin-route middleware asymmetrycoveredAAK-MCPWN-001
CVE-2026-35402mcp-neo4j-cypher Cypher-injectioncoveredAAK-NEO4J-001
CVE-2026-35568MCP Java SDK StreamableHTTP DNS rebindingcoveredAAK-DNS-REBIND-001, AAK-DNS-REBIND-002
CVE-2026-35577Apollo MCP server StreamableHTTP DNS rebindingcoveredAAK-DNS-REBIND-001, AAK-DNS-REBIND-002
CVE-2026-39313mcp-framework HTTP-body DoScoveredAAK-MCPFRAME-001
CVE-2026-40576excel-mcp-server path traversalcoveredAAK-EXCEL-MCP-001
CVE-2026-40608next-ai-draw-io body-accumulation DoScoveredAAK-NEXT-AI-DRAW-001
CVE-2026-41481langchain-text-splitters validate-then-fetch SSRFcoveredAAK-LANGCHAIN-SSRF-REDIR-001
CVE-2026-41488validate-then-fetch DNS-rebind / TOCTOU SSRFcoveredAAK-LANGCHAIN-SSRF-TOCTOU-001
CVE-2026-6494MCP tool log-injectioncoveredAAK-LOGINJ-001
OX-MCP-2026-04-15Upstream MCP SDK STDIO command-injection inheritancecoveredAAK-ANTHROPIC-SDK-001, AAK-STDIO-001, AAK-MCPWN-001
OX-MCP-2026-04-25MCP StdioServerParameters config-to-spawn taintcoveredAAK-MCP-STDIO-PARAMS-001, AAK-MCP-MARKETPLACE-FETCH-001

Prisma AIRS attack catalog (20/20 static-relevant = 100.0%)

Attack IDTitleStatusCovering rule(s)
PA-AIRS-001Prompt injection via tool descriptioncoveredAAK-MCP-FHI-001, AAK-DEEPSEEK-V4-MOE-TOOL-INJ-001
PA-AIRS-002Prompt injection via document loadercoveredAAK-IPI-WILD-CORPUS-001
PA-AIRS-003Tool-call SSRF via untrusted URLcoveredAAK-SSRF-001, AAK-SSRF-002, AAK-CREWAI-CVE-2026-2286-001
PA-AIRS-004Tool-call command injectioncoveredAAK-TAINT-001, AAK-MCP-002, AAK-MCPWN-001
PA-AIRS-005Sandbox escape via unsafe interpreter modecoveredAAK-CREWAI-CVE-2026-2275-001
PA-AIRS-006JSON / YAML loader path traversalcoveredAAK-CREWAI-CVE-2026-2285-001, AAK-LANGCHAIN-PROMPT-LOADER-PATH-001, AAK-EXCEL-MCP-001
PA-AIRS-007MCP STDIO config-to-spawn taintcoveredAAK-MCP-STDIO-PARAMS-001, AAK-STDIO-001
PA-AIRS-008MCP transport DNS rebindingcoveredAAK-DNS-REBIND-001, AAK-DNS-REBIND-002
PA-AIRS-009Token logging in cleartextcoveredAAK-SPLUNK-TOKLOG-001, AAK-LOG-TOKEN-LEAK-001
PA-AIRS-010Cross-tenant agent role escalationcoveredAAK-OPENCLAW-PRIVESC-001, AAK-A2A-002
PA-AIRS-011Indirect prompt injection via PR title / commit metadatacoveredAAK-PRTITLE-IPI-001
PA-AIRS-012Tool-poisoning via adversarial description suffixcoveredAAK-MCP-FHI-001
PA-AIRS-013Validate-then-fetch SSRF (redirect bypass)coveredAAK-LANGCHAIN-SSRF-REDIR-001, AAK-LANGCHAIN-SSRF-TOCTOU-001
PA-AIRS-014MoE-routed tool description injectioncoveredAAK-DEEPSEEK-V4-MOE-TOOL-INJ-001
PA-AIRS-015Social-agent auto-reply hijackcoveredAAK-TIKTOK-AGENT-HIJACK-001
PA-AIRS-016Cross-tier economic drift in multi-model pricingcoveredAAK-PROJECT-DEAL-DRIFT-001
PA-AIRS-017OAuth scope creep via third-party agent SDKcoveredAAK-OAUTH-3P-001, AAK-OAUTH-3P-BROAD-001
PA-AIRS-018MCP marketplace fetch SSRF + spawncoveredAAK-MCP-MARKETPLACE-FETCH-001
PA-AIRS-019GitHub Actions tag-pinned third-party ActioncoveredAAK-GHA-IMMUTABLE-001
PA-AIRS-020Agent prompt-loader path traversalcoveredAAK-LANGCHAIN-PROMPT-LOADER-PATH-001, AAK-CREWAI-CVE-2026-2285-001
PA-AIRS-021Runtime DLP — agent egress without redactionruntime-only—
PA-AIRS-022Live attack-tree red-teamingruntime-only—
PA-AIRS-023Memory poisoning persistenceruntime-only—
PA-AIRS-024Live tool-call replay detectionruntime-only—
PA-AIRS-025Adversarial multimodal payloadcatalog-private—