agent-threat-rules 3.5.4 → 3.5.6

package/rules/privilege-escalation/ATR-2026-01933-litellm-user-role-privilege-escalation-cve-2026-47102.yaml

@@ -0,0 +1,160 @@
+title: "LiteLLM User-Role Privilege Escalation (CVE-2026-47102)"
+id: ATR-2026-01933
+rule_version: 1
+status: draft
+description: >
+  Detects CVE-2026-47102 (CVSS 9.9 chain, CWE-269): LiteLLM's user-management
+  endpoints /user/update and /user/bulk_update modify security-sensitive
+  fields without field-level authorization. A low-privilege authenticated
+  caller (e.g. internal_user) can write the user_role field directly and
+  self-promote to proxy_admin, gaining full administrative control of the
+  LiteLLM proxy. Affected: LiteLLM before 1.83.10.
+
+  Detection covers:
+  (a) /user/update or /user/bulk_update payload that sets user_role to an
+      administrative role (proxy_admin / admin);
+  (b) the bulk_update array form where a user object escalates user_role;
+  (c) explicit CVE-2026-47102 exploitation framing.
+
+  The detection target is the request shape — an admin-role write at the
+  user-update endpoint — which is the exact privilege-escalation primitive,
+  caught before the proxy applies the role change.
+author: "ATR Community"
+date: "2026/06/26"
+schema_version: "0.1"
+detection_tier: pattern
+maturity: test
+severity: critical
+
+references:
+  owasp_llm:
+    - "LLM06:2025 - Excessive Agency"
+  owasp_agentic:
+    - "ASI06:2026 - Tool Misuse"
+    - "ASI03:2026 - Privilege Compromise"
+  mitre_atlas:
+    - "AML.T0049 - Exploit Public-Facing Application"
+  mitre_attack:
+    - "T1068 - Exploitation for Privilege Escalation"
+    - "T1078 - Valid Accounts"
+  cve:
+    - "CVE-2026-47102"
+
+metadata_provenance:
+  mitre_atlas: human-reviewed
+  owasp_llm: human-reviewed
+  owasp_agentic: human-reviewed
+
+compliance:
+  eu_ai_act:
+    - article: "15"
+      context: >
+        CVE-2026-47102 lets a low-privilege caller write user_role directly
+        at the LiteLLM user-update endpoint and self-promote to proxy_admin;
+        Article 15 cybersecurity requirements mandate field-level
+        authorization on AI proxy account-management APIs.
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the privilege-escalation technique (LiteLLM User-Role Privilege Escalation (CVE-2026-47102))."
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: "MP.5.1"
+      context: >
+        An attacker-controlled user_role write reaching the proxy is an
+        adversarial input; MP.5.1 requires scanning user-management payloads
+        for unauthorized administrative role escalation.
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 is supported where this rule detects the privilege-escalation technique (LiteLLM User-Role Privilege Escalation (CVE-2026-47102))."
+      strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: >
+        Operational controls must detect user-management payloads that set an
+        administrative user_role at the LiteLLM update endpoint before the
+        proxy applies the role change.
+      strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the privilege-escalation technique (LiteLLM User-Role Privilege Escalation (CVE-2026-47102)) as a treatment control."
+      strength: secondary
+
+tags:
+  category: privilege-escalation
+  subcategory: role-write-bypass
+  scan_target: llm_io
+  confidence: high
+  source: cve-disclosure
+  vendor_sources: litellm-cve-2026-47102
+
+agent_source:
+  type: llm_io
+  framework:
+    - litellm
+    - any
+  provider:
+    - any
+
+detection:
+  condition: any
+  false_positives:
+    - "Legitimate proxy_admin provisioning a new administrator through /user/update — expected to match; review confirms intent."
+    - "Security advisory or PR text quoting the CVE-2026-47102 payload."
+    - "User updates that set a non-administrative role (internal_user, internal_user_viewer)."
+  conditions:
+    - field: content
+      operator: regex
+      value: '(?i)/user/(?:update|bulk_update)[\s\S]{0,400}["\x27]?user_role["\x27]?\s*[:=]\s*["\x27]?(?:proxy_admin|proxy[_-]admin)\b'
+      description: >
+        /user/update or /user/bulk_update payload writing user_role to an
+        administrative proxy_admin value — direct CVE-2026-47102 escalation.
+    - field: content
+      operator: regex
+      value: '(?i)["\x27]user_role["\x27]\s*:\s*["\x27]proxy_admin["\x27][\s\S]{0,300}["\x27]user_id["\x27]\s*:|["\x27]user_id["\x27]\s*:[\s\S]{0,300}["\x27]user_role["\x27]\s*:\s*["\x27]proxy_admin["\x27]'
+      description: >
+        A user object pairing a user_id with a user_role of proxy_admin in an
+        update body — the bulk_update self-promotion shape.
+    - field: content
+      operator: regex
+      value: '(?i)CVE-2026-47102[\s\S]{0,200}(?:litellm|user_role|proxy_admin|privileg|escalat)'
+      description: >
+        Explicit CVE-2026-47102 reference combined with LiteLLM role-escalation
+        language — attack framing in a skill or tool description.
+
+response:
+  actions:
+    - alert
+    - block_input
+  message_template: >
+    [ATR-2026-01933] CRITICAL: LiteLLM user_role privilege escalation detected
+    (CVE-2026-47102, CWE-269). A user-update payload writes an administrative
+    proxy_admin role; LiteLLM before 1.83.10 applies this without field-level
+    authorization. Block the request and upgrade LiteLLM to >= 1.83.10.
+
+confidence: 80
+
+wild_fp_rate: 0
+
+test_cases:
+  true_positives:
+    - input: "POST /user/update {\"user_id\": \"u_self\", \"user_role\": \"proxy_admin\"}"
+      expected: triggered
+      description: "Low-priv user self-promotes to proxy_admin via /user/update"
+    - input: "POST /user/bulk_update {\"users\": [{\"user_id\": \"u_self\", \"user_role\": \"proxy_admin\"}]}"
+      expected: triggered
+      description: "bulk_update array escalates a user to proxy_admin"
+    - input: "Exploiting CVE-2026-47102 on LiteLLM: set user_role to proxy_admin via /user/update to escalate privilege."
+      expected: triggered
+      description: "Explicit CVE-2026-47102 LiteLLM escalation framing"
+  true_negatives:
+    - input: "POST /user/update {\"user_id\": \"u_123\", \"max_budget\": 100}"
+      expected: not_triggered
+      description: "Legitimate budget update, no user_role field"
+    - input: "POST /user/update {\"user_id\": \"u_123\", \"user_role\": \"internal_user\"}"
+      expected: not_triggered
+      description: "Setting a non-administrative role"
+    - input: "How do I update a user's role in the LiteLLM proxy?"
+      expected: not_triggered
+      description: "General question, not an update payload writing proxy_admin"
+    - input: "GET /user/info?user_id=u_123"
+      expected: not_triggered
+      description: "Read-only user lookup"

package/rules/privilege-escalation/ATR-2026-01934-litellm-allowed-routes-authz-bypass-cve-2026-47101.yaml

@@ -0,0 +1,161 @@
+title: "LiteLLM allowed_routes Authorization Bypass (CVE-2026-47101)"
+id: ATR-2026-01934
+rule_version: 1
+status: draft
+description: >
+  Detects CVE-2026-47101 (CVSS 9.9 chain, CWE-285): LiteLLM's virtual-key
+  endpoints /key/generate, /key/update, /key/regenerate and
+  /key/service-account/generate accept an allowed_routes parameter without
+  validating it against the caller's own role. A low-privilege internal_user
+  can mint or update a key whose allowed_routes reach administrative routes
+  (user/key/team/global management), bypassing route authorization and
+  pivoting toward proxy_admin functionality. Affected: LiteLLM before 1.83.14.
+
+  Detection covers:
+  (a) a /key/* generation or update payload whose allowed_routes include
+      administrative/management routes or a wildcard;
+  (b) explicit CVE-2026-47101 exploitation framing.
+
+  The detection target is the request shape — a key-mint that grants itself
+  admin routes via allowed_routes — i.e. the authorization-bypass primitive.
+author: "ATR Community"
+date: "2026/06/26"
+schema_version: "0.1"
+detection_tier: pattern
+maturity: test
+severity: critical
+
+references:
+  owasp_llm:
+    - "LLM06:2025 - Excessive Agency"
+  owasp_agentic:
+    - "ASI06:2026 - Tool Misuse"
+    - "ASI03:2026 - Privilege Compromise"
+  mitre_atlas:
+    - "AML.T0049 - Exploit Public-Facing Application"
+  mitre_attack:
+    - "T1068 - Exploitation for Privilege Escalation"
+    - "T1078 - Valid Accounts"
+  cve:
+    - "CVE-2026-47101"
+
+metadata_provenance:
+  mitre_atlas: human-reviewed
+  owasp_llm: human-reviewed
+  owasp_agentic: human-reviewed
+
+compliance:
+  eu_ai_act:
+    - article: "15"
+      context: >
+        CVE-2026-47101 lets a low-privilege caller mint a LiteLLM key whose
+        allowed_routes reach administrative routes; Article 15 cybersecurity
+        requirements mandate that route grants on AI proxy key-management APIs
+        be validated against the caller's own role.
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the privilege-escalation technique (LiteLLM allowed_routes Authorization Bypass (CVE-2026-47101))."
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: "MP.5.1"
+      context: >
+        An attacker-controlled allowed_routes grant reaching the proxy is an
+        adversarial input; MP.5.1 requires scanning key-management payloads for
+        unauthorized administrative route grants.
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 is supported where this rule detects the privilege-escalation technique (LiteLLM allowed_routes Authorization Bypass (CVE-2026-47101))."
+      strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: >
+        Operational controls must detect key-management payloads that grant
+        administrative allowed_routes at the LiteLLM key endpoints before the
+        proxy issues the over-privileged key.
+      strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the privilege-escalation technique (LiteLLM allowed_routes Authorization Bypass (CVE-2026-47101)) as a treatment control."
+      strength: secondary
+
+tags:
+  category: privilege-escalation
+  subcategory: route-grant-bypass
+  scan_target: llm_io
+  confidence: high
+  source: cve-disclosure
+  vendor_sources: litellm-cve-2026-47101
+
+agent_source:
+  type: llm_io
+  framework:
+    - litellm
+    - any
+  provider:
+    - any
+
+detection:
+  condition: any
+  false_positives:
+    - "A proxy_admin generating a key with broad allowed_routes intentionally — expected to match; review confirms intent."
+    - "Security advisory or PR text quoting the CVE-2026-47101 payload."
+    - "Key generation scoped to inference routes only (/chat/completions, /embeddings, /v1/models)."
+  conditions:
+    - field: content
+      operator: regex
+      value: '(?i)/key/(?:generate|update|regenerate|service-account/generate)[\s\S]{0,400}["\x27]?allowed_routes["\x27]?\s*[:=][\s\S]{0,200}(?:["\x27]/(?:user|key|team|global|organization|customer)/|["\x27]/?\*["\x27]|management_routes|admin_only_routes)'
+      description: >
+        A /key/* generation or update payload whose allowed_routes reach
+        administrative/management routes or a wildcard — CVE-2026-47101
+        authorization bypass shape.
+    - field: content
+      operator: regex
+      value: '(?i)["\x27]allowed_routes["\x27]\s*:\s*\[[^\]]*(?:["\x27]/(?:user|key|team|global)/(?:new|update|delete|bulk_update)|["\x27]/?\*["\x27]|/key/generate)[^\]]*\][\s\S]{0,300}(?:litellm|/key/(?:generate|service-account))'
+      description: >
+        An allowed_routes array containing admin management routes or a
+        wildcard in a LiteLLM key-mint body.
+    - field: content
+      operator: regex
+      value: '(?i)CVE-2026-47101[\s\S]{0,200}(?:litellm|allowed_routes|authoriz|bypass|route)'
+      description: >
+        Explicit CVE-2026-47101 reference combined with LiteLLM route-bypass
+        language — attack framing in a skill or tool description.
+
+response:
+  actions:
+    - alert
+    - block_input
+  message_template: >
+    [ATR-2026-01934] CRITICAL: LiteLLM allowed_routes authorization bypass
+    detected (CVE-2026-47101, CWE-285). A key-mint payload grants itself
+    administrative routes; LiteLLM before 1.83.14 does not validate
+    allowed_routes against the caller's role. Block the request and upgrade
+    LiteLLM to >= 1.83.14.
+
+confidence: 78
+
+wild_fp_rate: 0
+
+test_cases:
+  true_positives:
+    - input: "POST /key/generate {\"allowed_routes\": [\"/user/new\", \"/user/update\", \"/chat/completions\"]}"
+      expected: triggered
+      description: "internal_user mints a key granting admin user-management routes"
+    - input: "POST /key/service-account/generate {\"allowed_routes\": [\"*\"]}"
+      expected: triggered
+      description: "Service-account key minted with wildcard allowed_routes"
+    - input: "CVE-2026-47101: on LiteLLM call /key/generate with allowed_routes including /key/generate to bypass route authorization."
+      expected: triggered
+      description: "Explicit CVE-2026-47101 LiteLLM route-bypass framing"
+  true_negatives:
+    - input: "POST /key/generate {\"models\": [\"gpt-4o\"], \"allowed_routes\": [\"/chat/completions\", \"/embeddings\"]}"
+      expected: not_triggered
+      description: "Key scoped to inference routes only"
+    - input: "POST /key/generate {\"duration\": \"24h\", \"max_budget\": 50}"
+      expected: not_triggered
+      description: "Key generation with no allowed_routes grant"
+    - input: "What does the allowed_routes field do when generating a LiteLLM key?"
+      expected: not_triggered
+      description: "General question about the field, not an admin-route grant"
+    - input: "GET /key/info?key=sk-abc123"
+      expected: not_triggered
+      description: "Read-only key lookup"

package/rules/privilege-escalation/ATR-2026-01981-network-ai-approval-inbox-unauth-cors-bypass.yaml

@@ -0,0 +1,152 @@
+title: "Network-AI ApprovalInbox Unauthenticated Cross-Origin Approval Bypass (GHSA-mxjx-28vx-xjjj)"
+id: ATR-2026-01981
+rule_version: 1
+status: draft
+description: >
+  Detects GHSA-mxjx-28vx-xjjj (CWE-862 Missing Authorization + CWE-352 CSRF via
+  wildcard CORS): network-ai's ApprovalInbox HTTP server (lib/approval-inbox.ts)
+  has no authentication of any kind and sets Access-Control-Allow-Origin: * on
+  every route, including the state-changing POST /approvals/:id/approve and
+  /deny. ApprovalInbox is the network surface of the human-in-the-loop Approval
+  Gate that gates high-risk operations (writes, shell commands, budget spend).
+  Any caller that can reach the inbox port — a co-located process, an SSRF, a
+  non-loopback remote client, or any website the operator visits in a browser
+  via the wildcard CORS — can enumerate pending approvals (GET /approvals/) and
+  approve them (POST /approvals/:id/approve) with no Authorization header,
+  defeating the Approval Gate so a gated shell command executes without
+  consent. Affected: network-ai <= 5.11.0.
+
+  Detection covers:
+  (a) a state-changing request to the approval control plane
+      (/approvals/<id>/approve or /deny) with no auth context, matching the
+      unauthenticated-client PoC shape;
+  (b) an enumeration request to the approval queue (GET /approvals/) paired
+      with the wildcard-CORS marker on the approval control plane;
+  (c) explicit GHSA-mxjx-28vx-xjjj / ApprovalInbox exploitation framing.
+
+  The detection target is the request shape at the approval control plane —
+  an unauthenticated approve/deny or enumerate call combined with the
+  wildcard-CORS marker — which is the exact bypass primitive, caught before
+  the gated action is released.
+author: "ATR Community"
+date: "2026/07/04"
+schema_version: "0.1"
+detection_tier: pattern
+maturity: test
+severity: high
+
+references:
+  owasp_llm:
+    - "LLM06:2025 - Excessive Agency"
+  owasp_agentic:
+    - "ASI03:2026 - Privilege Compromise"
+    - "ASI06:2026 - Tool Misuse"
+  mitre_atlas:
+    - "AML.T0049 - Exploit Public-Facing Application"
+  mitre_attack:
+    - "T1068 - Exploitation for Privilege Escalation"
+    - "T1190 - Exploit Public-Facing Application"
+  ghsa:
+    - "GHSA-mxjx-28vx-xjjj"
+
+metadata_provenance:
+  mitre_atlas: human-reviewed
+  owasp_llm: human-reviewed
+  owasp_agentic: human-reviewed
+
+compliance:
+  eu_ai_act:
+    - { article: "15", context: "Article 15 cybersecurity — runtime detection of unauthenticated cross-origin approval-gate bypass on network-ai's ApprovalInbox control plane.", strength: primary }
+    - { article: "9",  context: "Article 9 risk management — runtime risk-treatment control for unauthenticated cross-origin approval-gate bypass.", strength: secondary }
+  nist_ai_rmf:
+    - { subcategory: "MP.5.1", context: "MAP 5.1 — adversarial input characterised/detected for unauthenticated cross-origin approval-gate bypass.", strength: primary }
+    - { subcategory: "MG.3.2", context: "MANAGE 3.2 — runtime monitoring control for unauthenticated cross-origin approval-gate bypass.", strength: secondary }
+  iso_42001:
+    - { clause: "8.1", context: "Clause 8.1 operational control — detection of unauthenticated cross-origin approval-gate bypass payload.", strength: primary }
+    - { clause: "8.3", context: "Clause 8.3 AI risk treatment — runtime detection as treatment control.", strength: secondary }
+
+tags:
+  category: privilege-escalation
+  subcategory: unauth-approval-gate-bypass
+  scan_target: tool_call
+  confidence: high
+  source: ghsa-disclosure
+  vendor_sources: network-ai-ghsa-mxjx-28vx-xjjj
+
+agent_source:
+  type: tool_call
+  framework:
+    - network-ai
+    - any
+  provider:
+    - any
+
+detection:
+  condition: any
+  false_positives:
+    - "Legitimate operator approving a pending action through an authenticated ApprovalInbox deployment that has been hardened with a reverse-proxy auth layer — expected to match; review confirms intent."
+    - "Security advisory or PR text quoting the GHSA-mxjx-28vx-xjjj PoC."
+    - "A read-only status check against an endpoint that is not the approvals control plane."
+  conditions:
+    - field: content
+      operator: regex
+      value: '(?i)POST\s+/approvals/[a-f0-9]+/(?:approve|deny)\b[\s\S]{0,300}(?:approvedBy["\x27]?\s*[:=]\s*["\x27]?(?:anonymous|attacker)|no\s+auth|Authorization["\x27]?\s*:\s*(?:null|undefined|absent|none))'
+      description: >
+        Unauthenticated POST to the approval control plane's approve/deny
+        route — approvedBy defaults to anonymous/attacker with no
+        Authorization header, matching the GHSA-mxjx-28vx-xjjj PoC shape.
+    - field: content
+      operator: regex
+      value: '(?i)GET\s+/approvals/\??(?:status=pending)?\b[\s\S]{0,200}Access-Control-Allow-Origin["\x27]?\s*:\s*["\x27]?\*'
+      description: >
+        Enumeration of the pending-approvals queue paired with a wildcard
+        Access-Control-Allow-Origin marker on the approval control plane —
+        the cross-origin approval-inbox reconnaissance step.
+    - field: content
+      operator: regex
+      value: '(?i)GHSA-mxjx-28vx-xjjj[\s\S]{0,200}(?:approval[- ]?inbox|network-ai|approve|CORS)'
+      description: >
+        Explicit GHSA-mxjx-28vx-xjjj reference combined with ApprovalInbox
+        exploitation language — attack framing in a skill or tool
+        description.
+
+response:
+  actions:
+    - alert
+    - block_input
+  message_template: >
+    [ATR-2026-01981] HIGH: network-ai ApprovalInbox unauthenticated
+    cross-origin approval bypass detected (GHSA-mxjx-28vx-xjjj, CWE-862 +
+    CWE-352). A caller with no Authorization header reached the approval
+    control plane's approve/deny or enumeration route, defeating the
+    human-in-the-loop Approval Gate. Block the request and upgrade network-ai
+    past 5.11.0 / put ApprovalInbox behind an authenticated reverse proxy.
+
+confidence: 78
+
+wild_fp_rate: 0
+
+test_cases:
+  true_positives:
+    - tool_description: "POST /approvals/07d6f277efe35ac1/approve {\"approvedBy\": \"anonymous\"}"
+      expected: triggered
+      description: "Unauthenticated approve call defaults approvedBy to anonymous — GHSA-mxjx-28vx-xjjj PoC shape"
+    - tool_description: "GET /approvals/?status=pending -> 200, Access-Control-Allow-Origin: *"
+      expected: triggered
+      description: "Cross-origin enumeration of pending approvals via wildcard CORS marker"
+    - tool_description: "Exploiting GHSA-mxjx-28vx-xjjj: the network-ai ApprovalInbox has no auth, so I can approve any pending action via CORS."
+      expected: triggered
+      description: "Explicit GHSA-mxjx-28vx-xjjj ApprovalInbox exploitation framing"
+  true_negatives:
+    - tool_description: "POST /approvals/07d6f277efe35ac1/approve {\"approvedBy\": \"ops-lead\", \"Authorization\": \"Bearer sk_live_abc123\"}"
+      expected: not_triggered
+      description: "Authenticated operator approval with a Bearer token present"
+    - tool_description: "How does the ApprovalInbox approve/deny flow work in network-ai?"
+      expected: not_triggered
+      description: "General question about the feature, not an exploitation request"
+    - tool_description: "GET /approvals/health"
+      expected: not_triggered
+      description: "Read-only health check on an unrelated route, no wildcard CORS marker present"
+    - tool_description: "POST /approvals/07d6f277efe35ac1/approve {\"approvedBy\": \"ops-lead\"} behind an internal VPN with mTLS client cert required"
+      expected: not_triggered
+      description: "Approve call description explicitly noting mTLS-gated internal deployment, no anonymous/attacker/no-auth marker"

package/rules/privilege-escalation/ATR-2026-01986-windows-mcp-unauth-http-powershell-cors.yaml

@@ -0,0 +1,170 @@
+title: "Windows-MCP Unauthenticated HTTP PowerShell via Wildcard CORS (CVE-2026-48989)"
+id: ATR-2026-01986
+rule_version: 1
+status: draft
+description: >
+  Detects CVE-2026-48989 / GHSA-vrxg-gm77-7q5g (CWE-306 Missing Authentication
+  for Critical Function): Windows-MCP's SSE and Streamable HTTP transports
+  build the FastMCP control plane with no auth provider
+  (src/windows_mcp/__main__.py:75-113) and install blanket wildcard CORS
+  (allow_origins=*, allow_methods=*, allow_headers=*, __main__.py:37-42),
+  answering every OPTIONS preflight with the same wildcard headers regardless
+  of Origin. The same server registers the PowerShell tool
+  (src/windows_mcp/tools/shell.py:10-24), which executes caller-controlled
+  commands via PowerShell -EncodedCommand
+  (src/windows_mcp/desktop/powershell.py:176-204). A client that can reach
+  http://<host>:<port>/mcp — including a cross-origin browser page, since the
+  wildcard CORS grants it — can initialize an MCP session and call
+  tools/call for PowerShell with no credential of any kind, achieving
+  arbitrary PowerShell execution as the Windows user running Windows-MCP.
+  Affected: CursorTouch/Windows-MCP < 0.7.5; the default stdio transport is
+  not affected.
+
+  Detection covers:
+  (a) the OPTIONS preflight / control-plane response on the /mcp endpoint
+      carrying the wildcard access-control-allow-origin marker, which is the
+      structural precondition for the cross-origin bypass;
+  (b) a tools/call JSON-RPC request naming the PowerShell tool over the
+      HTTP/SSE control plane co-occurring with that wildcard-CORS marker;
+  (c) explicit CVE-2026-48989 / GHSA-vrxg-gm77-7q5g exploitation framing.
+
+  The detection target is the request/response shape at the MCP control
+  plane — a PowerShell tool invocation reachable through an unauthenticated,
+  wildcard-CORS-exposed /mcp endpoint — which is the exact remote-code-
+  execution primitive, caught before PowerShellExecutor.execute_command runs.
+  Bound to the PowerShell tool name plus the wildcard-CORS marker so a
+  legitimate, authenticated PowerShell call over a properly-scoped-CORS
+  deployment does not fire.
+author: "ATR Community"
+date: "2026/07/04"
+schema_version: "0.1"
+detection_tier: pattern
+maturity: test
+severity: critical
+
+references:
+  owasp_llm:
+    - "LLM06:2025 - Excessive Agency"
+  owasp_agentic:
+    - "ASI03:2026 - Privilege Compromise"
+    - "ASI06:2026 - Tool Misuse"
+  mitre_atlas:
+    - "AML.T0053 - LLM Plugin Compromise"
+  mitre_attack:
+    - "T1059 - Command and Scripting Interpreter"
+    - "T1190 - Exploit Public-Facing Application"
+  cve:
+    - "CVE-2026-48989"
+  ghsa:
+    - "GHSA-vrxg-gm77-7q5g"
+
+metadata_provenance:
+  mitre_atlas: human-reviewed
+  owasp_llm: human-reviewed
+  owasp_agentic: human-reviewed
+
+compliance:
+  eu_ai_act:
+    - { article: "15", context: "Article 15 cybersecurity — runtime detection of unauthenticated cross-origin PowerShell tool invocation on Windows-MCP's HTTP control plane.", strength: primary }
+    - { article: "9",  context: "Article 9 risk management — runtime risk-treatment control for unauthenticated cross-origin PowerShell tool invocation.", strength: secondary }
+  nist_ai_rmf:
+    - { subcategory: "MP.5.1", context: "MAP 5.1 — adversarial input characterised/detected for unauthenticated cross-origin PowerShell tool invocation.", strength: primary }
+    - { subcategory: "MG.3.2", context: "MANAGE 3.2 — runtime monitoring control for unauthenticated cross-origin PowerShell tool invocation.", strength: secondary }
+  iso_42001:
+    - { clause: "8.1", context: "Clause 8.1 operational control — detection of unauthenticated cross-origin PowerShell tool invocation payload.", strength: primary }
+    - { clause: "8.3", context: "Clause 8.3 AI risk treatment — runtime detection as treatment control.", strength: secondary }
+
+tags:
+  category: privilege-escalation
+  subcategory: unauth-mcp-control-plane-rce
+  scan_target: mcp
+  confidence: high
+  source: cve-disclosure
+  vendor_sources: windows-mcp-cve-2026-48989
+
+agent_source:
+  type: tool_call
+  framework:
+    - windows-mcp
+    - any
+  provider:
+    - any
+
+detection:
+  condition: any
+  false_positives:
+    - "A legitimate, authenticated PowerShell tool call over stdio transport or an HTTP deployment with an auth provider and origin-scoped CORS configured — expected to match if wildcard CORS markers are also present; review confirms intent."
+    - "Security advisory or PR text quoting the GHSA-vrxg-gm77-7q5g / CVE-2026-48989 PoC for review purposes."
+    - "An OPTIONS preflight response that scopes Access-Control-Allow-Origin to a specific trusted origin rather than a wildcard."
+  conditions:
+    - field: content
+      operator: regex
+      value: '(?i)OPTIONS\s+.{0,40}/mcp/?[\s\S]{0,200}access-control-allow-origin["\x27]?\s*:\s*["\x27]?\*[\s\S]{0,200}access-control-allow-methods["\x27]?\s*:\s*["\x27]?\*'
+      description: >
+        OPTIONS preflight against the /mcp control plane answered with
+        wildcard Access-Control-Allow-Origin and Access-Control-Allow-Methods
+        — the structural CORS-bypass precondition from GHSA-vrxg-gm77-7q5g.
+    - field: content
+      operator: regex
+      value: '(?i)"method"\s*:\s*"tools/call"[\s\S]{0,150}"name"\s*:\s*"PowerShell"[\s\S]{0,300}access-control-allow-origin["\x27]?\s*:\s*["\x27]?\*'
+      description: >
+        A tools/call JSON-RPC request naming the PowerShell tool
+        co-occurring with a wildcard access-control-allow-origin marker on
+        the same MCP exchange — unauthenticated cross-origin PowerShell
+        invocation.
+    - field: content
+      operator: regex
+      value: '(?i)access-control-allow-origin["\x27]?\s*:\s*["\x27]?\*[\s\S]{0,300}\bPowerShell\b[\s\S]{0,150}(?:command|EncodedCommand)["\x27]?\s*[:=]'
+      description: >
+        Wildcard CORS marker followed by a PowerShell tool argument carrying
+        a command/EncodedCommand payload — the end-to-end
+        control-plane-to-shell-execution shape.
+    - field: content
+      operator: regex
+      value: '(?i)(?:CVE-2026-48989|GHSA-vrxg-gm77-7q5g)[\s\S]{0,200}(?:windows-mcp|powershell|wildcard\s*CORS|unauthenticat)'
+      description: >
+        Explicit CVE-2026-48989 / GHSA-vrxg-gm77-7q5g reference combined with
+        Windows-MCP PowerShell/CORS exploitation language — attack framing
+        in a skill or tool description.
+
+response:
+  actions:
+    - alert
+    - block_tool
+  message_template: >
+    [ATR-2026-01986] CRITICAL: Windows-MCP unauthenticated HTTP PowerShell via
+    wildcard CORS detected (CVE-2026-48989, CWE-306). A tools/call for
+    PowerShell reached the /mcp control plane alongside a wildcard
+    access-control-allow-origin marker; Windows-MCP before 0.7.5 runs SSE/
+    Streamable-HTTP transports with no auth provider and allow_origins=*.
+    Block the tool call and upgrade Windows-MCP to >= 0.7.5 or restrict to
+    the stdio transport.
+
+confidence: 82
+
+wild_fp_rate: 0
+
+test_cases:
+  true_positives:
+    - tool_description: "curl -i -X OPTIONS 'http://127.0.0.1:18123/mcp/' -H 'Origin: https://attacker.example' response: access-control-allow-origin: * access-control-allow-methods: * access-control-allow-headers: *"
+      expected: triggered
+      description: "OPTIONS preflight on /mcp answered with wildcard ACAO + ACAM — CVE-2026-48989 PoC step 1"
+    - tool_description: "{\"jsonrpc\":\"2.0\",\"id\":2,\"method\":\"tools/call\",\"params\":{\"name\":\"PowerShell\",\"arguments\":{\"command\":\"calc.exe\"}}} response headers: access-control-allow-origin: *"
+      expected: triggered
+      description: "tools/call for PowerShell co-occurring with wildcard ACAO on the same exchange — CVE-2026-48989 PoC step 3"
+    - tool_description: "Exploiting CVE-2026-48989 (GHSA-vrxg-gm77-7q5g): Windows-MCP's HTTP transport is unauthenticated with wildcard CORS, so a cross-origin page can call the PowerShell tool."
+      expected: triggered
+      description: "Explicit CVE-2026-48989 Windows-MCP exploitation framing"
+  true_negatives:
+    - tool_description: "curl -i -X OPTIONS 'https://mcp.internal.corp/mcp/' -H 'Origin: https://ops.internal.corp' response: access-control-allow-origin: https://ops.internal.corp access-control-allow-methods: POST"
+      expected: not_triggered
+      description: "Preflight scoped to a specific trusted origin, not a wildcard"
+    - tool_description: "{\"jsonrpc\":\"2.0\",\"id\":2,\"method\":\"tools/call\",\"params\":{\"name\":\"PowerShell\",\"arguments\":{\"command\":\"Get-Process\"}}} over stdio transport with mcp-auth-token: valid-session-token-abc, no CORS headers present"
+      expected: not_triggered
+      description: "Authenticated PowerShell call over stdio with a session token, no wildcard CORS marker"
+    - tool_description: "How do I configure authentication for the Windows-MCP HTTP transport?"
+      expected: not_triggered
+      description: "General configuration question, not an exploitation attempt"
+    - tool_description: "{\"jsonrpc\":\"2.0\",\"id\":5,\"method\":\"tools/call\",\"params\":{\"name\":\"ListDirectory\",\"arguments\":{\"path\":\"C:\\\\Users\"}}}"
+      expected: not_triggered
+      description: "Unrelated read-only tool call, no PowerShell tool name and no CORS marker"

package/rules/prompt-injection/ATR-2026-00003-jailbreak-attempt.yaml

@@ -16,7 +16,7 @@ author: "ATR Community"
 date: "2026/03/08"
 schema_version: "0.1"
 detection_tier: pattern
-maturity: "experimental"
+maturity: test
 severity: high
 
 references:

package/rules/prompt-injection/ATR-2026-00005-multi-turn-injection.yaml

@@ -15,7 +15,7 @@ author: "ATR Community"
 date: "2026/03/08"
 schema_version: "0.1"
 detection_tier: pattern
-maturity: experimental
+maturity: test
 severity: medium
 
 references:

package/rules/prompt-injection/ATR-2026-00203-context-pollution-skill-description.yaml

@@ -12,7 +12,7 @@ author: "TYSYS (Wind) — skill-sanitizer project"
 date: "2026/04/05"
 schema_version: "0.1"
 detection_tier: pattern
-maturity: test
+maturity: stable
 severity: high
 
 references: