Analysis · DiggingBeagle record
The AI security bug may be in the gateway, not the model
Two JeecgBoot AI-RAG ownership bugs and a Docker MCP Gateway parser crash expose independent permission and metadata boundaries around agent systems.
- Published
- Oct 13, 2026
Overview
A failed boundary around an AI system need not involve the model following a malicious prompt. Two JeecgBoot AI-RAG advisories describe authenticated users reading another user's state; a separate Docker MCP Gateway advisory describes malformed metadata from an already enabled server crashing a gateway. The three weaknesses affect different resources and cannot be treated as one exploit chain.
Which input crosses which boundary?
| Finding | Attacker prerequisite | Boundary crossed | Established effect |
|---|---|---|---|
| JeecgBoot chat variables | A valid lower-privilege session and knowledge of variable inputs | A caller-selected username is treated as the Redis memory owner | Read access to another user's named AI-RAG chat variable |
| JeecgBoot app configuration | A valid lower-privilege session | Enumerated app IDs reach queryById without an ownership check |
Disclosure of prompts, model IDs, knowledge-base IDs and plugin settings |
| Docker MCP Gateway | Control of a downstream MCP server that is already enabled | Unvalidated resource URI reaches SDK capability registration | Gateway panic and possible availability loss |
All three findings concern software surrounding AI workflows, but only the Docker case requires control of an enabled downstream server. The Jeecg cases instead rely on a request authenticated to a user who does not own the requested AI state.
The two Jeecg reads are not the same vulnerability
For CVE-2026-108879, the /airag/api/getChatVariable path accepts a username along with an app ID and variable name. The advisory describes JeecgBoot versions through 3.9.5 trusting that supplied owner when retrieving a Redis chat variable. This does not establish access to every Redis key or to an entire conversation archive.
For CVE-2026-108878, /airag/app/listDict exposes possible application identifiers and queryById returns another user's configuration without adequate owner checks. The separate advisory lists prompts and plugin bindings among the exposed metadata. It does not demonstrate that the underlying knowledge documents, private provider tokens or the plugins' execution rights were obtained. Both advisories were published on October 11, 2026; their reviewed entries did not identify a verified patched release or observed victim campaign.
The two routes show why login status is only the first question. The decisive control is whether the authenticated principal can access that application and that memory variable. Enumeration can make bad ownership checks easier to use, but the read operations remain distinct.
A gateway can fail before any tool is called
Docker MCP Gateway versions 0.14.0 to those before 0.44.1 could panic while registering a malformed resources/list URI from an enabled downstream server. Initial configuration reloads and later capability refreshes both used the vulnerable path. Docker's security advisory documents version 0.44.1 validating capabilities against an isolated SDK server, recovering validation panics and omitting malformed entries rather than terminating the active gateway. The recorded consequence is availability loss; credential theft and content manipulation were not established.
That patch does not address JeecgBoot's ownership defects. Likewise, tightening Jeecg application permissions does nothing to validate malformed MCP capability metadata. These distinctions make an operational review testable: verify principal-to-object authorization for stored AI state, and separately verify that an enabled tool provider cannot crash a gateway by advertising invalid capabilities.
The unifying lesson is not that every AI connector is unsafe. It is that a model may be entirely uninvolved when a gateway trusts the wrong server metadata or an application trusts the wrong user's identifier. The software contracts on either side of the model still determine what can leak or fail.