Advisories

Beta9 gateway versions below 0.1.776 and worker versions below 0.1.756 let a tenant with any workspace token attach a volume whose identifier uses parent-directory segments, such as ../../.., so the mount resolves to the worker's filesystem root. The mount is read-write by default, exposing host files and other tenants' volumes stored on that host.

CVE-2026-120338 (CVSS 10, critical) affects prefab-ui from 0.14.0 before 0.21.0. Its Generative UI sandbox runs caller-supplied Python in a Deno subprocess started with unrestricted --allow-read, --allow-write and --allow-net, and the Deno API remains reachable from Python through Pyodide's js module, letting callers read and write host files. The usual remote path is the generate_prefab_ui tool in FastMCP's GenerativeUI provider, which is exposed unauthenticated on servers with no authentication configured, and the flaw is reachable there.

Beta9 worker versions below 0.1.756 let a tenant holding a workspace token and one running sandbox escape the container through the sandbox file API. The getHostPathFromContainerPath helper in pkg/worker/container_server.go joins tenant-supplied paths onto worker paths, so traversal segments and absolute symbolic links reach any file on the worker as root, including other tenants' files and the worker pod's Kubernetes service account token, which is bound to cluster-admin in the shipped remote-node manifests.

Beta9 workers before 0.1.756 run each tenant image build step with Buildah using BUILDAH_ISOLATION=chroot, without passing --isolation. This leaves the step sharing the worker pod's PID, network, IPC and user namespaces, running as uid 0 with CAP_DAC_OVERRIDE, so a tenant with any workspace token can reach the worker's filesystem through /proc/1/root in a single image build. The CVSS score is 9.9 (critical), and the issue was discovered by Natan Nehorai of the JFrog Security Research Team.

CVE-2026-63377 affects TAKO AI Agent for Okta before 3.0.1-beta. The unauthenticated `POST /api/auth/setup` endpoint in `src/api/routers/auth.py` lets a network attacker create the first administrator account before the legitimate owner completes initial setup, because `initial_setup` checks only the `is_setup` flag. The attacker then gains a valid `fctr_session` JWT cookie and can read Okta-synced user data, API tokens, chat history and configuration, modify users and Okta integration credentials, or lock out administrators.

SOCFortress CoPilot exposes its `scoutsuite-report` directory through an unauthenticated `/scoutsuite-report` StaticFiles mount in `backend/copilot.py`, even though normal /api routes require JWT authentication. The directory holds generated AWS, Azure and GCP reports and `scoutsuite-results/scoutsuite_results_<name>.js` files that disclose IAM principals, resource inventories and findings. During a GCP scan, the uploaded Google service-account JSON key is saved into that same web-served directory and removed only after the scan finishes, so an anonymous client can retrieve it and use the service account's cloud permissions.

SOCFortress CoPilot versions before 0.1.76 authenticate Graylog and Velociraptor webhooks against the same publicly hardcoded fallback header value, which is also shipped in `.env.example`. Deployments that leave these header secrets unset or unchanged let an anonymous caller bypass JWT authentication and reach `POST /api/graylog/invoke`, which forwards attacker-selected commands to the configured Wazuh manager, and the alert creation endpoints, which accept forged alerts for arbitrary `customer_code` values. Active-response delivery requires a reachable Wazuh manager.

CoPilot versions before 0.1.76 let a customer_user, the lowest-privilege portal role, upload case-report templates that are later rendered without a sandbox by Jinja2 engines when an admin or analyst generates a report. The upload route validates only the filename-derived MIME type, and the shared template store lacks customer_code scoping, so an attacker can replace a default template. In the reported deployment, attacker Jinja expressions run as Python on the backend with root privileges, exposing all tenants' incident and SIEM data and stored connector credentials. The wkhtmltopdf HTML/PDF renderer also permits local-file reads and internal requests.

IBM Langflow OSS versions 1.0.0 through 1.12.8 are affected by CVE-2026-110186. A remote attacker can exploit improper control of code generation to execute arbitrary code.

IBM Langflow OSS versions 1.0.0 through 1.12.4 are affected by CVE-2026-107329. A remote authenticated attacker could exploit improper control of code generation to execute arbitrary code.

IBM Langflow OSS versions 1.0.0 through 1.12.4 contain CVE-2026-107328. The flaw is improper neutralization of code in eval/exec, which could allow a remote authenticated attacker to execute arbitrary code.

IBM Langflow OSS versions 1.0.0 through 1.12.4 are affected by CVE-2026-107327. A remote authenticated attacker can execute arbitrary code because of missing authorization.

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a flaw, tracked as CVE-2026-104339, caused by improper neutralization of special elements used in an OS command. A remote attacker can exploit it to execute arbitrary code.

CVE-2026-117574 is a flaw in ai-gateway-payload-processing. An authenticated remote attacker can submit a request naming another tenant's model identifier in the request body or header. Because the service does not verify authorization before retrieving credentials from the shared store, it injects the target tenant's API keys into the request, letting the attacker consume that tenant's LLM resources and quotas.

MLflow 3.12.0 added registration and deserialization support for third-party scorers. On the default no-auth server, an unauthenticated HTTP caller can chain experiment, run, and artifact-upload endpoints with the scorer invoke endpoint to import an uploaded Python module and run arbitrary code with the privileges of the MLflow server process. The official v3.14.0 image runs that process as uid 0.