JunoClaw Agentic AI Toolchain

All four CVEs are addressed in the v0.x.y-security-1 release, with @junoclaw/cosmos-mcp at version 0.3.0 or later as the minimum safe version. Upgrade before resuming any agent workflows that interact with wallet functions, shell tools, or the WAVS bridge.

Audit every workflow definition, prompt template, and tool configuration for instances where a raw BIP-39 mnemonic phrase is passed as a parameter. Remove them immediately. Even after upgrading, mnemonic values that appeared in prior tool-call JSON may persist in LLM provider logs, telemetry, and your own application traces.

If any wallet mnemonic was passed through an MCP tool-call in an affected version, treat that seed as compromised. Generate a new wallet with a freshly created BIP-39 seed — generated offline or in a hardware wallet — and transfer all assets immediately. Do not reuse the exposed seed phrase for any purpose.

Until the patched command execution and command-safety logic is deployed and verified, disable the shell plugin entirely or run it in a sandboxed environment (Docker container, VM, or seccomp-restricted process) where unauthorized commands cannot affect the host or network. Shell access from an LLM agent should be treated as a privileged capability requiring explicit justification.

Apply egress firewall rules or network policy to block agent runtime access to 169.254.169.254, RFC1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), and loopback addresses. This neutralizes the SSRF vector even before the application-layer fix is in place, and is best-practice for any agent runtime regardless of this vulnerability.

The architectural fix for CVE-2026-43992 is to never allow the model to see or pass raw seed material. Replace mnemonic: string parameters with opaque wallet_id: string handles resolved server-side against an encrypted wallet registry. The model passes an identifier; the signing operation occurs in a hardened boundary that the LLM never crosses.

Substring blocklists are not a viable security primitive for command filtering — they are bypassed by encoding, whitespace, and Unicode normalization. Replace them with: an allowlist of permitted executables, parsed argv arrays passed directly to execve without shell interpretation, and explicit rejection of any argument that cannot be validated against a known-safe pattern.

Any tool that calls fetch() or equivalent on an agent-supplied URL must resolve the hostname and validate the final IP before connecting. Deny loopback, link-local, RFC1918 private space, and cloud metadata IPs. Restrict schemes to https:// only unless a documented business requirement requires otherwise. This applies to all agent tools — not just the WAVS bridge.

Wallet-signing, shell execution, file writing, network fetch, contract deployment, and token transfer tools are privileged capabilities that warrant separate review and stronger policy gates than read-only informational tools. Establish a formal risk classification for agent tools in your organization, require explicit approval to add privileged tools to any agent, and run privileged tools in dedicated isolated runtimes.

Audit all logging, tracing, and telemetry pipelines for places where tool-call arguments are captured verbatim. Implement redaction rules that scrub known-sensitive parameter names — mnemonic, private_key, password, secret, token — before values reach any log sink. Govern LLM provider data retention and data-processing agreements to limit how long tool-call JSON is retained by the model provider.