Tools AI Risk Radar ai-incident-0208
Incident record
GenOffice MCP uploads can be read by local users
- Severity
- Medium
- Status
- Research
- Type
- Infra Vuln
- Target
- GenOffice through 0.11.505 on affected shared POSIX hosts
- Actor
- researcher
- CVE
- CVE-2026-108582
What happened
GenOffice’s HTTP MCP server creates temporary upload files with permissions that can let another local user read them.
The CVE was published on 10 October; the original researcher publication date is unconfirmed. The demonstrated conditions use a shared temporary directory and a permissive file-creation mask. The attacker needs a local account on the same host. The CNA gives CVSS 3.1 score 5.5. Patch status remains unconfirmed as of 11 October.
Sources
- CVE recordcveawg.mitre.org/api/cve/CVE-2026-108582
- Researcher disclosurehackmd.io/@haind/genoffice-http-mcp-temp-file-disclosure
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 13 October 2026