ACVE-2026-0420

In the wild

exploited-itw · dfir

Description

What

The n4d mesh campaign used Shodan-driven discovery across ComfyUI, Ollama, n8n, Open WebUI, Langflow, Gradio, and MCP infrastructure. The reported chain included MCP JSON-RPC execute_command loops and harvesting of cloud, Kubernetes, Bedrock, and GPT-4 credentials. Victim counts were not published.

Which configuration is exposed

The exposed configuration combines a non-loopback AI service with a reachable MCP server whose host is not loopback. The product surface may vary, so the matcher uses a named exposure feature and scopes the remote-host check to one MCP server element rather than combining fields from different servers.

How ACVE detects it

ACVE checks ai.surface.exposed and a remote-looking mcpServers.urlHost. It does not probe Shodan, execute JSON-RPC, or infer whether the remote service is actually public. Missing host data is possible.

Fix

Bind AI services to private interfaces, add authentication and network allowlists, disable execute_command-style tools, and rotate cloud, Kubernetes, Bedrock, and model-provider credentials after investigation. Review Docker and Redis exposure as part of containment.

Grounding needed

The public page should be checked against the underlying XLab source for campaign dates and impact. The actor claim is retained, but no victim count is invented.

This record is limited to the condition named in the public source: n4d mesh uses exposed AI services and MCP command loops. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.

Configuration

and
  features["ai.surface.exposed"] eq true
  some mcpServers where
    urlHost regex "^(?!localhost$|127\\.0\\.0\\.1$|::1$).+"

Fix

Remove public AI service exposure and disable untrusted MCP command tools.

• Reconfigure features["ai.surface.exposed"] to false. Close the public service boundary.
• Reconfigure mcpServers. Remove execute_command loops and require authentication.

Validation

No validation entries recorded.

Grounding

No grounding checks recorded.

References

No references recorded.