MCP Server and LangGraph Advisory Batch: AWS API MCP Accepts Other Apps' Tokens, GitLab MCP Sends Credentials to a Repo-Chosen Registry, and Cross-Tenant Store Reads (CVE-2026-115413, CVE-2026-115883)

`awslabs.aws-api-mcp-server` 1.3.0 to before 1.6.0, `zereight/gitlab-mcp`, Basic Memory before 0.24.0, the official MCP reference servers (filesystem, fetch, everything), and LangGraph Postgres and SQLite stores

Advisories published October 21-27, 2026. AWS API MCP Server (CVE-2026-115413, CVSS v4 7.3): in streamable-http OAuth mode it checked a token's signature, issuer, and expiry but not its audience, so a token issued to another app in the same tenant (such as a second Cognito app client) could run AWS API calls with the host's credentials. gitlab-mcp (GHSA-rr94-3mff-76gg, High): a startup version check sent GitLab credentials from the environment to whatever registry the working directory's `.npmrc` named; three more advisories let tools bypass the per-session project allowlist. Basic Memory (GHSA-4gfv-c2mm-mvj2, High): DNS rebinding let any web page find, exfiltrate, and delete private notes through the unauthenticated SSE transport. Eight advisories hit the reference servers, including filesystem writes outside allowed directories, cross-origin environment variable exfiltration from `server-everything`, and fetch SSRF guard bypasses via NAT64 and IDNA hostnames. LangGraph (CVE-2026-115883): dotted namespace labels on read, search, delete, and list calls resolved to another tenant's namespace

Token audience, network origin, filesystem paths, and tenant namespaces were each checked incompletely or only on some code paths