August 30 Security Briefing: PaperCut, argocd-mcp, and BookStack

Today’s security changes

This August 30 briefing focuses on three developments that were formally published or materially updated on August 29. PaperCut added post-patch operational guidance for NG and MF after reports involving external Card/ID lookups and SAML. CVE-2026-82456 describes how argocd-mcp 0.8.0 can expose an HTTP listener without authenticating inbound callers while retaining an Argo CD API token. CVE-2026-82450 covers a BookStack portable-ZIP import path that could turn a crafted cover file into code execution from a public web directory.

The common lesson is that a version check alone is not enough. PaperCut operators need to validate authentication and lookup functions after deploying Release 2. argocd-mcp operators must separate listener exposure, inbound identity, and the privileges of the stored Argo CD token. BookStack operators need to review import permissions and the treatment of files placed under public paths after updating.

• PaperCut NG/MF: deploy Release 2 and test SAML plus external Card/ID lookup workflows
• argocd-mcp 0.8.0: inspect listener reachability, caller authentication, and stored-token privilege
• BookStack before 26.05.4: review import permissions, cover validation, extensions, and public paths

PaperCut post-patch checks

PaperCut updated its bulletin on August 29 after receiving reports that external database Card/ID number lookups and SAML were not working as expected in some patched environments. The bulletin also made CVE-2026-82078 and CVE-2026-81578 public. The first concerns unsafe dynamic class loading in database utilities and is rated CVSS 9.4. The second is an access-control weakness that can allow unauthenticated remote requests to trigger selected administrative backend actions under specific conditions; it is rated CVSS 8.8.

PaperCut’s immediate measure is to restrict public access to NG and MF web interfaces to trusted addresses. Release 2 is available for versions 24, 25, and 26 and adds hardening beyond the first emergency patch. Site Servers and secondary or print servers should also run a patched version. Print Deploy and Mobility Print are differentiated in the bulletin, so operators should inventory component roles before changing versions.

1. Restrict PaperCut web interfaces to trusted source addresses.
2. Align Application, Site, and secondary or print servers on Release 2-based builds.
3. Test SAML sign-in with representative users and privileges.
4. Check the required security property and live behavior for external Card/ID lookups.
5. Review missing or truncated server.log files, listed error strings, and alerts involving pc-app.exe.

If business functions fail after patching, keep exposure restrictions in place and troubleshoot through documented settings and vendor support rather than weakening the boundary. External Card/ID lookup requires an explicit security property and is disabled by default. Where compromise is suspected, preserve backups, activate incident response, rebuild the Application Server, and restore a known-clean backup.

argocd-mcp authentication boundary

CVE-2026-82456 affects argocd-mcp 0.8.0. The service retains an ARGOCD_API_TOKEN for outbound requests, while the vulnerable HTTP listener can bind to unrestricted interfaces without authenticating inbound callers. A user who reaches the listener may invoke MCP tools under the stored token’s privileges, including creating applications, requesting synchronization, or modifying Argo CD resources when authorized by that token.

The missing boundary is between the identity calling MCP and the credential used against Argo CD. Internal networks alone are weak evidence because port forwarding, proxy rules, temporary load balancers, and tunnels can widen reachability. A loopback listener is also insufficient if the stored token is excessively privileged. Listener scope and token scope require separate checks.

• Upgrade argocd-mcp to 0.9.0 or later and verify the running image.
• Bind to loopback or an explicit management interface and remove unintended ingress or tunnels.
• Use inbound credentials distinct from the Argo CD token and validate Host and Origin data.
• Reduce ARGOCD_API_TOKEN privileges to required projects and actions, then rotate it.
• Use MCP_READ_ONLY=true only as a temporary compensating control.

Validate the live process, not only a configuration file. Confirm the listening address and port, the networks reached through proxies, and whether unauthenticated requests can enumerate or invoke tools from a controlled management segment. Correlate unexpected create, modify, or sync events with MCP token use. After upgrading, retest that unauthenticated calls fail and authorized calls use least privilege.

BookStack portable-ZIP import boundary

CVE-2026-82450 affects BookStack versions before 26.05.4. An authenticated account with Import Content and Create Books permissions can use a crafted portable ZIP to place a PHP polyglot in the book-cover path by bypassing extension and MIME validation. Because the cover may reside under a public web root, a later unauthenticated request can cause PHP execution. Restricted content-management permissions can therefore cross into server code execution.

BookStack 26.05.4 strengthens imported-image inspection, forces safer extensions, and hardens storage handling. Organizations should identify every user, role, and service account that holds both import and book-creation capabilities, including migration accounts and external collaborators. Existing covers and attachments under public paths should be reviewed by actual MIME type and creation time, not filename alone.

1. Upgrade to BookStack 26.05.4 or later and verify that web and PHP processes loaded the new code.
2. List identities holding both Import Content and Create Books permissions.
3. Correlate imports with the initiating account, book creation time, and cover creation time.
4. Compare actual MIME types and extensions under public storage paths and disable PHP execution there.
5. Test in non-production that legitimate imports work while a PHP polyglot cover is rejected.

Web-server controls provide another boundary. User-generated covers and attachments should not execute as PHP, and application code should use separate handler rules. Comparing file inventories and access logs before and after imports helps narrow suspicious files without deleting valid content. Evaluate account privilege, import events, file type, and public requests together.

Priorities for operators

The products differ, but each update shows a boundary between connected functions: PaperCut patching versus authentication and lookup, argocd-mcp caller identity versus a stored deployment token, and BookStack import permission versus a public execution path. Start with externally reachable services and privileged accounts, preserve version and log evidence, deploy the supported fix, and then test representative business functions plus requests that should be blocked.

Asset searches should combine product and exposure conditions. Include PaperCut roles and secondary components, argocd-mcp 0.8.0 listener scope and token privilege, and BookStack pre-26.05.4 versions with the Import Content and Create Books permission pair. Record patch time, affected assets, functional tests, access changes, and follow-up work in one change record.