Wiz
Vulnerability DatabaseGHSA-8pqq-224h-x875

GHSA-8pqq-224h-x875: 
Python vulnerability analysis and mitigation

Summary

Between 2026-02 and 2026-04-24 a total of 22 public PyPI sdists of ogham-mcp contained development credentials embedded in source files. All credentials have since been rotated on the respective providers. No known exploitation. Upgrade to v0.11.1 to get a clean release.

What was leaked

CredentialLocation in sdistVulnerable rangeCount
3x Neon postgres URLs with passwords (US / EU / AP development databases)top-level Makefile (NEON_US, NEON_EU, NEON_AP vars)>=0.6.5, <0.11.021 sdists
1x Voyage AI API key (pa-...)tests/test_hooks.py::test_mask_secrets_key_value -- test fixture that fed a real key into the redaction-function tester>=0.6.3, <0.11.122 sdists

Impact

  • Primary risk: any consumer of the affected sdists could have extracted the credentials and used them. The Neon URLs pointed at development databases; the Voyage key was a rate-limited API key.
  • Observed exploitation: none detected. Audit logs on both providers were reviewed post-rotation.
  • Remediation on our side:
    • Neon passwords for all three regions rotated.
    • Voyage API key rotated.
    • All affected versions yanked from PyPI (v0.3.0 through v0.10.4 yanked on 2026-04-24; v0.11.0 pending yank after this advisory).
    • v0.11.0 removed the Neon URLs and introduced make publish-check which scans every sdist for credential patterns before upload.
    • v0.11.1 scrubs the Voyage key from the test fixture and excludes benchmarks/, docs/, research/, extras/, and **/*.env* from all future sdists via explicit hatchling sdist include/exclude in pyproject.toml.

Action for users

  • If users installed any version from v0.3.0 through v0.11.0, upgrade to v0.11.1 immediately:
    pip install --upgrade "ogham-mcp>=0.11.1"
  • Users do not need to rotate anything on their end. The leaked credentials were owned by the project maintainer, not by users.

Credit

Discovered during an internal pre-release audit on 2026-04-24 while preparing v0.11.1.

Source: NVD

Related Python vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2026-70646HIGH7.5
  • Python logoPython
  • aiosend
NoYesAug 06, 2026
CVE-2026-71554MEDIUM5.3
  • Python logoPython
  • python-h2
NoYesAug 06, 2026
CVE-2026-71433MEDIUM5.3
  • Python logoPython
  • langgraph-checkpoint-postgres
NoYesAug 06, 2026
CVE-2026-61632MEDIUM5.3
  • Python logoPython
  • pymdown-extensions
NoYesAug 06, 2026
CVE-2026-64640MEDIUM5.3
  • Python logoPython
  • polaris
NoYesAug 06, 2026

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Additional Wiz resources

Cloud Vulnerability DB

Cloud Vulnerability DB

A community-led vulnerabilities database

Cloud Threat Landscape

Cloud Threat Landscape

A threat intelligence database

PEACH

PEACH

A tenant isolation framework

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management
Get a demo