JunoClaw CVE-2026-43992

Exploitation requires that blockchain write operations (send_tokens, execute_contract, instantiate_contract, upload_wasm, ibc_transfer) are invoked by the AI agent or operator in a vulnerable JunoClaw instance prior to v0.x.y-security-1, causing the mnemonic parameter to appear in MCP tool-call JSON. The attacker must then gain access to at least one observation point in the data path: LLM provider API request/response logs (OpenAI, Anthropic, Azure OpenAI Service), local MCP server application logs if logging middleware captures tool parameters, telemetry or APM systems ingesting conversation traces (Datadog, Sentry, Honeycomb), network traffic if HTTPS interception or debugging proxies are active, or any intermediate caching/queuing layer between the LLM and MCP process. Default JunoClaw configurations that route tool calls through cloud LLM providers satisfy these conditions automatically. Deployments using localhost-only Ollama models with no external network logging face dramatically reduced exposure but remain vulnerable to local log file compromise or memory forensics. No user interaction or non-default configuration is required for mnemonic exposure-AV:N/AC:L/PR:N/UI:N indicates the leakage occurs in normal operation whenever write tools are used. What LIMITS exploitation: attackers without access to logs/telemetry cannot recover mnemonics; agents configured for read-only queries (query_balance, get_block) do not trigger mnemonic parameters; wallets with zero on-chain balance or no contract admin roles reduce financial impact but still expose the seed for future funded operations.

CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) accurately reflects network-based exploitation with no authentication barriers, but real-world severity depends heavily on deployment architecture. The 'network attack vector' designation applies because MCP tool calls transit network APIs to cloud LLM providers (OpenAI, Anthropic) where mnemonics land in request logs, rate-limit caches, and training data pipelines outside operator control. However, exploitation requires that an attacker gain access to one of these observation points: LLM provider infrastructure logs, compromised API middleware, or telemetry aggregation systems (Datadog, Sentry, CloudWatch). The vulnerability does NOT enable unauthenticated remote code execution against the JunoClaw server itself-the exposure is passive leakage rather than active exploitation. Confidentiality impact is TOTAL (C:H): a recovered mnemonic grants permanent control over all on-chain assets and contract admin privileges. Integrity and Availability impacts (I:H, A:H) stem from the attacker's ability to drain funds and destroy smart contracts once the mnemonic is obtained. No EPSS score or CISA KEV listing exists for this 2026 CVE, indicating no confirmed mass exploitation. The primary risk population is AI agent operators using cloud LLM APIs in production with funded wallets-self-hosted Ollama deployments with localhost-only MCP transport have dramatically lower exposure. Commit 339701e demonstrates the vendor's immediate response with cryptographic controls, reducing residual risk for patched deployments to the strength of the AES-256-GCM envelope and passphrase/keychain protection.

An AI security researcher deploys JunoClaw with GPT-4 to automate Juno Network airdrops, funding the agent wallet with 50,000 JUNO tokens. The agent's conversation logs flow to OpenAI's API infrastructure where a compromised employee or data breach exposes the tool-call JSON containing the 24-word mnemonic. Within hours, the attacker derives the private key, drains the wallet, and uploads a malicious governance proposal contract using the same admin credentials, achieving both immediate financial theft and long-term supply-chain positioning for future attacks against contracts instantiated by that wallet.