{"id":7198,"date":"2026-11-11T14:18:52","date_gmt":"2026-11-11T14:18:52","guid":{"rendered":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-54140-openhuman-mcp-tool-description-injection"},"modified":"2026-11-11T14:18:52","modified_gmt":"2026-11-11T14:18:52","slug":"cve-2026-54140-openhuman-mcp-tool-description-injection","status":"publish","type":"post","link":"https:\/\/i10x.ai\/news\/cve-2026-54140-openhuman-mcp-tool-description-injection","title":{"rendered":"CVE-2026-54140: OpenHuman MCP Tool Description Injection Allows Silent Agent Hijacking"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">CRITICAL: Malicious MCP Servers Can Hijack OpenHuman Agents via Tool Descriptions<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A high-severity vulnerability tracked as **CVE-2026-54140** has been disclosed in OpenHuman, an open-source agent harness available as a desktop application and Rust library. The flaw allows malicious or compromised Model Context Protocol (MCP) servers to inject arbitrary instructions into the agent&#8217;s large language model (LLM) context through unsanitized tool descriptions, enabling silent data exfiltration and unauthorized actions.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Vulnerability Details<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">OpenHuman connects to external MCP servers and incorporates their tool definitions\u2014including names, descriptions, titles, and parameter schemas\u2014directly into the agent LLM context. According to the GitHub security advisory GHSA-g6j9-89xv-v752, versions before 0.57.13 placed this remote content into the `McpRemoteTool` struct without any neutralization, escaping, or validation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The vulnerability exists because:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Tool `description` and `title` fields from remote MCP servers are passed verbatim to the agent&#8217;s tool-use context<\/li><li>The existing prompt injection detector in `src\/openhuman\/prompt_injection\/detector.rs` only screens user-supplied messages, never tool definitions<\/li><li>Tool filtering logic in `filter_allowed_tools()` operates solely on tool names, not content<\/li><li>No length bounds are enforced on description fields<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">As stated in the advisory, &#8220;A malicious or compromised MCP server can embed arbitrary LLM instructions in a tool description that execute silently on every agent turn, bypassing the prompt injection detector entirely because the detector only scans user input\u2014not tool definitions.&#8221;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Attack Scenario<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The advisory provides a concrete proof-of-concept showing how an attacker controlling or compromising an MCP server can embed instructions in a tool description. The malicious description could direct the LLM to:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Silently invoke other available tools (such as email or file access functions)<\/li><li>Exfiltrate credentials from `~\/.aws\/credentials`, `~\/.ssh\/id_rsa`, or environment files<\/li><li>Perform unauthorized actions without user awareness<\/li><li>Execute on every agent turn for the session lifetime<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The attack payload lives in the `description` field, which enters the LLM with &#8220;system-prompt-level trust&#8221; according to the advisory. Users see normal responses while data exfiltration occurs in the background.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Affected Versions and Scope<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">All OpenHuman versions before 0.57.13 are affected. The vulnerability impacts any user who has configured at least one MCP server, including popular community servers from registries such as Smithery or mcp.run. The advisory notes that a single compromised popular community MCP server simultaneously affects all OpenHuman users who installed it.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Patch and Mitigation<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Version 0.57.13, released on June 3, 2026, addresses the vulnerability through pull request #3215. The fix implements multiple defensive layers:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>**Sanitization pipeline**: New module `mcp_client\/sanitize.rs` strips ASCII control characters and known LLM instruction-fence markers (such as `|im_start|`, `### Instructions:`, `SYS`)<\/li><li>**Length caps**: Tool descriptions are limited to 1024 bytes with UTF-8-safe truncation<\/li><li>**Prompt injection scanning**: Tool definitions are now scanned through the existing detector at registration time<\/li><li>**Tool rejection**: Any tool whose description or title matches a high-confidence injection rule is refused registration<\/li><li>**Audit events**: A new `DomainEvent::McpToolRejected` event logs rejected tools with server name, tool name, and pattern reason (without echoing the malicious payload)<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The patch introduces `display_description()` and `display_title()` accessor methods on `McpRemoteTool` that route raw fields through the sanitization pipeline. According to commit 00b8a66, LLM-context call sites MUST read through the display accessors\u2014enforced by code review + doc-comment contract on the type.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Both static configuration (`[[mcp_client.servers]]`) and dynamic Smithery installs are covered by the new filtering logic in `mcp_client\/registry.rs::apply_safety_filter`.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">CVSS Score and Classification<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The vulnerability has been assigned a CVSS v3.1 score of **8.3 (High)** with vector string `CVSS:3.1\/AV:N\/AC:H\/PR:N\/UI:R\/S:C\/C:H\/I:H\/A:H`. The advisory notes the attack requires network access, high complexity, no privileges, user interaction (installing the malicious server), and results in scope change with high impact to confidentiality, integrity, and availability.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The flaw is classified under CWE-1427 (Improper Neutralization of Input Used for LLM Prompting).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Recommendations<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Users of OpenHuman should immediately upgrade to version 0.57.13 or later. The release notes confirm that existing installed servers are re-probed on next connect, and any tool whose description trips the new scan is dropped from the agent surface and reported via the audit event.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The advisory states there is no migration burden: Legitimate descriptions register unchanged. Oversized descriptions (>1024 bytes) truncated with a marker and the tool still registers.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Organizations using OpenHuman should review their configured MCP servers and monitor `McpToolRejected` events for signs of attempted exploitation.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Sources<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-54140\" target=\"_blank\" rel=\"noreferrer noopener\">NVD &#8211; CVE-2026-54140<\/a><\/li><li><a href=\"https:\/\/github.com\/tinyhumansai\/openhuman\/security\/advisories\/GHSA-g6j9-89xv-v752\" target=\"_blank\" rel=\"noreferrer noopener\">GitHub Security Advisory GHSA-g6j9-89xv-v752<\/a><\/li><li><a href=\"https:\/\/github.com\/tinyhumansai\/openhuman\/pull\/3215\" target=\"_blank\" rel=\"noreferrer noopener\">Pull Request #3215: feat(mcp): sanitize remote tool descriptions + length caps<\/a><\/li><li><a href=\"https:\/\/github.com\/tinyhumansai\/openhuman\/commit\/00b8a669c6e6391a1be9f724bd9c8f755ee3c43e\" target=\"_blank\" rel=\"noreferrer noopener\">Commit 00b8a66: Sanitization implementation<\/a><\/li><li><a href=\"https:\/\/github.com\/tinyhumansai\/openhuman\/releases\/tag\/v0.57.13\" target=\"_blank\" rel=\"noreferrer noopener\">OpenHuman v0.57.13 Release Notes<\/a><\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>A high-severity vulnerability in OpenHuman versions before 0.57.13 allows malicious MCP servers to inject arbitrary LLM instructions through unsanitized tool descriptions, bypassing prompt injection defenses and executing silently on every agent turn.<\/p>\n","protected":false},"author":2,"featured_media":7197,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"paper_title":"","paper_url":"","pdf_url":"","doi":"","arxiv_id":"","authors":"","institutions":"","paper_date":"","venue":"","peer_reviewed":false,"code_url":"","data_url":"","funding_coi":"","figure_license":"","paper_license":"","replication":"","study_models":"","study_sample":"","footnotes":"","_yoast_wpseo_primary_category":"65","_nx_sec_severity":"high","_nx_sec_affected":"OpenHuman versions before 0.57.13","_nx_sec_status":"patch-available","_nx_sec_kicker":"CRITICAL: Agent Hijacking via MCP Tool Injection"},"categories":[14,65,12,28],"tags":[],"companies":[],"products":[],"class_list":["post-7198","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-agents","category-ai-security","category-policy-safety","category-security-defense"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>CVE-2026-54140: OpenHuman MCP Injection Vulnerability<\/title>\n<meta name=\"description\" content=\"CVE-2026-54140 exposes OpenHuman agent harness to MCP tool description injection, allowing malicious servers to execute LLM instructions silently.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/i10xnews.kinsta.cloud\/cve-2026-54140-openhuman-mcp-tool-description-injection\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CVE-2026-54140: OpenHuman MCP Injection Vulnerability\" \/>\n<meta property=\"og:description\" content=\"CVE-2026-54140 exposes OpenHuman agent harness to MCP tool description injection, allowing malicious servers to execute LLM instructions silently.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/i10xnews.kinsta.cloud\/cve-2026-54140-openhuman-mcp-tool-description-injection\" \/>\n<meta property=\"og:site_name\" content=\"i10X News\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-11T14:18:52+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/cve-2026-54140-openhuman-mcp-tool-description-injection-title.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1344\" \/>\n\t<meta property=\"og:image:height\" content=\"768\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Christopher Ort\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:site\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Christopher Ort\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"NewsArticle\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-54140-openhuman-mcp-tool-description-injection#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-54140-openhuman-mcp-tool-description-injection\"},\"author\":{\"name\":\"Christopher Ort\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\"},\"headline\":\"CVE-2026-54140: OpenHuman MCP Tool Description Injection Allows Silent Agent Hijacking\",\"datePublished\":\"2026-11-11T14:18:52+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-54140-openhuman-mcp-tool-description-injection\"},\"wordCount\":768,\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-54140-openhuman-mcp-tool-description-injection#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-54140-openhuman-mcp-tool-description-injection-title.webp\",\"articleSection\":[\"Agents\",\"AI Security\",\"Policy &amp; Safety\",\"Security &amp; Defense\"],\"inLanguage\":\"en-US\",\"dateModified\":\"2026-11-11T14:18:52+00:00\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-54140-openhuman-mcp-tool-description-injection\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-54140-openhuman-mcp-tool-description-injection\",\"name\":\"CVE-2026-54140: OpenHuman MCP Injection Vulnerability\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-54140-openhuman-mcp-tool-description-injection#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-54140-openhuman-mcp-tool-description-injection#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-54140-openhuman-mcp-tool-description-injection-title.webp\",\"datePublished\":\"2026-11-11T14:18:52+00:00\",\"description\":\"CVE-2026-54140 exposes OpenHuman agent harness to MCP tool description injection, allowing malicious servers to execute LLM instructions silently.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-54140-openhuman-mcp-tool-description-injection#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-54140-openhuman-mcp-tool-description-injection\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-54140-openhuman-mcp-tool-description-injection#primaryimage\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-54140-openhuman-mcp-tool-description-injection-title.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-54140-openhuman-mcp-tool-description-injection-title.webp\",\"width\":1344,\"height\":768,\"caption\":\"A security researcher examining code on a laptop screen in a dimly lit office, with network diagrams visible on a whiteboard in the background\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-54140-openhuman-mcp-tool-description-injection#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/i10x.ai\\\/news\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"CVE-2026-54140: OpenHuman MCP Tool Description Injection Allows Silent Agent Hijacking\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\",\"name\":\"i10X News\",\"description\":\"Stay updated with the latest news and announcements from i10X.\",\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/i10x.ai\\\/news?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\",\"name\":\"i10X\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"contentUrl\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"width\":180,\"height\":180,\"caption\":\"i10X\"},\"image\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/i10x_ai\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/i10x-ai\",\"https:\\\/\\\/instagram.com\\\/i10x.ai\",\"https:\\\/\\\/www.youtube.com\\\/@i10X_ai_official\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\",\"name\":\"Christopher Ort\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"caption\":\"Christopher Ort\"},\"description\":\"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/author\\\/christopher-ort\",\"sameAs\":[\"https:\\\/\\\/i10x.ai\\\/blog\\\/author\\\/christopher-ort\"],\"worksFor\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"alumniOf\":{\"@type\":\"EducationalOrganization\",\"name\":\"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)\",\"url\":\"https:\\\/\\\/www.fau.eu\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"CVE-2026-54140: OpenHuman MCP Injection Vulnerability","description":"CVE-2026-54140 exposes OpenHuman agent harness to MCP tool description injection, allowing malicious servers to execute LLM instructions silently.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-54140-openhuman-mcp-tool-description-injection","og_locale":"en_US","og_type":"article","og_title":"CVE-2026-54140: OpenHuman MCP Injection Vulnerability","og_description":"CVE-2026-54140 exposes OpenHuman agent harness to MCP tool description injection, allowing malicious servers to execute LLM instructions silently.","og_url":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-54140-openhuman-mcp-tool-description-injection","og_site_name":"i10X News","article_published_time":"2026-11-11T14:18:52+00:00","og_image":[{"width":1344,"height":768,"url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/cve-2026-54140-openhuman-mcp-tool-description-injection-title.webp","type":"image\/webp"}],"author":"Christopher Ort","twitter_card":"summary_large_image","twitter_creator":"@i10x_ai","twitter_site":"@i10x_ai","twitter_misc":{"Written by":"Christopher Ort","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-54140-openhuman-mcp-tool-description-injection#article","isPartOf":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-54140-openhuman-mcp-tool-description-injection"},"author":{"name":"Christopher Ort","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a"},"headline":"CVE-2026-54140: OpenHuman MCP Tool Description Injection Allows Silent Agent Hijacking","datePublished":"2026-11-11T14:18:52+00:00","mainEntityOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-54140-openhuman-mcp-tool-description-injection"},"wordCount":768,"publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-54140-openhuman-mcp-tool-description-injection#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-54140-openhuman-mcp-tool-description-injection-title.webp","articleSection":["Agents","AI Security","Policy &amp; Safety","Security &amp; Defense"],"inLanguage":"en-US","dateModified":"2026-11-11T14:18:52+00:00"},{"@type":"WebPage","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-54140-openhuman-mcp-tool-description-injection","url":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-54140-openhuman-mcp-tool-description-injection","name":"CVE-2026-54140: OpenHuman MCP Injection Vulnerability","isPartOf":{"@id":"https:\/\/i10x.ai\/news\/#website"},"primaryImageOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-54140-openhuman-mcp-tool-description-injection#primaryimage"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-54140-openhuman-mcp-tool-description-injection#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-54140-openhuman-mcp-tool-description-injection-title.webp","datePublished":"2026-11-11T14:18:52+00:00","description":"CVE-2026-54140 exposes OpenHuman agent harness to MCP tool description injection, allowing malicious servers to execute LLM instructions silently.","breadcrumb":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-54140-openhuman-mcp-tool-description-injection#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/i10xnews.kinsta.cloud\/cve-2026-54140-openhuman-mcp-tool-description-injection"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-54140-openhuman-mcp-tool-description-injection#primaryimage","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-54140-openhuman-mcp-tool-description-injection-title.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-54140-openhuman-mcp-tool-description-injection-title.webp","width":1344,"height":768,"caption":"A security researcher examining code on a laptop screen in a dimly lit office, with network diagrams visible on a whiteboard in the background"},{"@type":"BreadcrumbList","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-54140-openhuman-mcp-tool-description-injection#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/i10x.ai\/news"},{"@type":"ListItem","position":2,"name":"CVE-2026-54140: OpenHuman MCP Tool Description Injection Allows Silent Agent Hijacking"}]},{"@type":"WebSite","@id":"https:\/\/i10x.ai\/news\/#website","url":"https:\/\/i10x.ai\/news","name":"i10X News","description":"Stay updated with the latest news and announcements from i10X.","publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/i10x.ai\/news?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/i10x.ai\/news\/#organization","name":"i10X","url":"https:\/\/i10x.ai\/news\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/","url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","contentUrl":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","width":180,"height":180,"caption":"i10X"},"image":{"@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/i10x_ai","https:\/\/www.linkedin.com\/company\/i10x-ai","https:\/\/instagram.com\/i10x.ai","https:\/\/www.youtube.com\/@i10X_ai_official"]},{"@type":"Person","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a","name":"Christopher Ort","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","caption":"Christopher Ort"},"description":"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.","url":"https:\/\/i10x.ai\/news\/author\/christopher-ort","sameAs":["https:\/\/i10x.ai\/blog\/author\/christopher-ort"],"worksFor":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"alumniOf":{"@type":"EducationalOrganization","name":"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)","url":"https:\/\/www.fau.eu"}}]}},"_links":{"self":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/7198","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/comments?post=7198"}],"version-history":[{"count":0,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/7198\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media\/7197"}],"wp:attachment":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media?parent=7198"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/categories?post=7198"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/tags?post=7198"},{"taxonomy":"company","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/companies?post=7198"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/products?post=7198"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}