AI Sec Watch

An authenticated user with permission to create or modify workflows in n8n could escape the Python sandbox (a restricted environment meant to safely run untrusted code) and execute arbitrary code on the task runner container. This vulnerability only affects instances where the Python Task Runner feature is enabled.

vLLM has an authentication bypass vulnerability in its OpenAI API protection. An attacker can craft a request with a specially crafted Host header (containing special characters like `/` or `?`) to trick the authentication check into looking at the wrong URL path, allowing them to use the API without providing the required `VLLM_API_KEY`. This only affects vLLM instances exposed directly to attackers; those behind a proper web server like nginx are protected.

Langflow's Shareable Playground feature allows unauthenticated users to execute public workflows through a special endpoint. This endpoint accepts a list of files that can be read from either the local system or S3 storage (cloud file storage), potentially exposing sensitive files if the workflow is configured to read them. An attacker could craft a request specifying arbitrary file paths to extract data without authentication.

Langflow's Shareable Playground feature contains a critical RCE (remote code execution, where an attacker can run commands on a system they don't own) vulnerability that allows unauthenticated users to execute arbitrary Python code. By sharing a flow and then modifying the code field in the API request to the `/api/v1/build_public_tmp` endpoint, an attacker can run malicious commands on the server.

Langflow has a path traversal vulnerability (a security flaw where an attacker can access files outside intended directories) in its Knowledge Bases API that allows authenticated attackers to create files and directories anywhere on the server by supplying malicious names like '../victim_user/evil_kb' or '/tmp/pwned' to the creation endpoint, potentially compromising data across users and corrupting knowledge bases.

vLLM has a security vulnerability where an `assert` statement (a line of code that checks a condition) used to restrict which activation functions can be loaded is removed when Python runs in optimized mode, allowing attackers to publish malicious models on HuggingFace that execute arbitrary code when loaded.

Langflow's monitor API has 7 endpoints that lack ownership checks, allowing any authenticated user to read, modify, or delete another user's data like messages, sessions, and LLM logs through IDOR/BOLA (insecure direct object references/broken object-level authorization, where an attacker can access resources by guessing or knowing their IDs). The source code shows that the correct ownership-checking pattern exists in one endpoint but was not applied consistently across the other vulnerable endpoints.

France's intelligence service is switching from Palantir, a US company's AI data analysis tool, to a domestic provider called ChapsVision to reduce dependence on foreign technology. The French government argues that relying on tools controlled by other countries poses a strategic risk, and that France should develop and use its own AI systems instead.

AI agents (autonomous systems that can perform complex tasks independently) are becoming more powerful but also riskier, so Google developed the AI Control Roadmap, a 'defense-in-depth' security framework that combines traditional safeguards like sandboxing (isolating software to limit damage) with monitoring systems and permission controls to protect against agents that may not be perfectly aligned (trained to match human goals) with organizational values. The roadmap treats AI agents as potential insider threats and uses trusted AI supervisors to constantly monitor their reasoning and actions, blocking harmful behaviors before they occur.