Advisories
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
3,134 items
vLLM versions before 0.29.0 have a denial-of-service flaw in the cache_salt parameter accepted on OpenAI-compatible and Anthropic API endpoints. The parameter has no maximum length validation and is processed on the single EngineCore scheduler thread. Unauthenticated attackers can send multi-hundred-megabyte salt values that trigger expensive pickle serialization and SHA-256 hashing, stalling the scheduler and denying service to all concurrent requests.
Flowise (npm packages `flowise` and `flowise-components`) through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace, across several code paths including the OpenAI assistants endpoints, the file upload and delete routes, and the text-to-speech voices helper. An authenticated user of one workspace can supply a credential UUID from another workspace, so the server decrypts and uses that workspace's OpenAI or ElevenLabs API key on the attacker's behalf. No patched version was available at the time of publication.
OpenClaw (npm package `openclaw`) before 2026.7.1 does not enforce the owner-only authorization requirement for Claude Code permission prompts delivered through the MCP channel bridge. An authorized non-owner channel sender with channel command access can approve or deny a pending permission request meant for the owner, so the requested action can proceed without owner consent. The practical impact depends on the pending action and the host capabilities requested by the Claude Code run.
Fixed in version 2026.7.1.
OpenClaw (npm package 'openclaw') before 2026.8.1 could send third-party provider credentials to the wrong endpoint. The flaw occurs when a third-party provider uses an OpenAI-compatible API, the resolved model metadata lacks a concrete base URL, and a pinned session continues after a model configuration hot reload. The retained credential can then be disclosed to an unrelated provider endpoint, producing a misleading authentication error.
Zammad, a web-based open source helpdesk and customer support system, has a flaw before version 7.1.2. A security filter protecting its AI Agent configuration can be bypassed by entering specially crafted text into an AI Agent field. An administrator with permission to create or edit AI Agents could run arbitrary commands on the host server, potentially reading, modifying, or destroying all stored data. No action from other users is required, since the malicious code executes the next time the affected AI Agent processes a ticket.
BerriAI LiteLLM versions before 1.101.0-rc.1 contain a tenant isolation bypass in the semantic cache layer, tracked as CVE-2026-89032. A metadata key mismatch between _get_semantic_cache_tenant_scope() and _get_metadata_variable_name() lets an authenticated user with a valid virtual key submit semantically similar prompts on routes such as /v1/responses and /bedrock/* and retrieve other tenants' cached responses, including personally identifiable information, financial data or source code. Attackers can also cause agentic front-ends to auto-execute attacker-supplied tool calls under victim credentials.
A flaw in the AgenticScopeSerializer.fromJson function of LangChain4j-agentic, in langchain4j versions up to 1.5.3-beta10, 1.11.10-beta18 and 1.18.1-beta27, allows deserialization manipulation that can be exploited remotely, though the attack complexity is rated high. The exploit has been published, and the maintainer says exploitation requires AgenticScope persistence to be enabled and an attacker who can already write to that store.
Fix: Upgrade to version 1.5.3-beta11, 1.11.10-beta19 or 1.18.1-beta28. The maintainer states that all maintained release lines have been patched, and the issue is tracked as GHSA-gmwr-7wmf-mrjm.
Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 contain a GraphQL query injection in `get_export_status` in `src/export_manager.py`. The unvalidated `export_id` argument, passed via the `check_rapid7_export_status` and `download_rapid7_export` tools, is interpolated directly into the query string, so a crafted value can append attacker-chosen root-level selections such as schema introspection. The injected query runs under the operator's own API key and cannot cross a tenant or account boundary, so the realistic exposure is a compromised or careless upstream MCP client or indirect prompt injection.
The Cline Hub dashboard server (`@cline/cline-hub`), launched with the `cline dashboard` CLI command, accepts WebSocket connections on `/browser` without validating the HTTP `Origin` header. When `ROOM_SECRET` is unset, which is the default for `127.0.0.1` binds, `isAuthorizedBrowserRequest()` returns `true`, so any website a developer visits can open a cross-origin WebSocket to `ws://127.0.0.1:8787/browser`. Dashboard sessions default to `autoApprove: true` for all tools, and the source reports that an injected `upsert_mcp_server` frame wrote a malicious `stdio` MCP server entry into the victim's Cline settings file.
@bytebase/dbhub's `readonly = true` setting on the `execute_sql` tool does not make connections read-only. The PostgreSQL and SQLite connectors only apply database-level read-only mode when `config.readonly` is set, but `source.readonly` can never be populated, so that path never runs. Enforcement falls to a classifier that checks only each statement's leading keyword, so a `SELECT` calling functions such as `setval`, `lo_export`, `pg_read_file` or `dblink_exec` can write data, read or write server files, or execute commands. The HTTP transport is unauthenticated and binds to `0.0.0.0` by default.
DBHub 0.21.2 exposes an unauthenticated HTTP MCP endpoint at /mcp when run with --transport http. Its origin check only compares Origin and Host hostnames for equality, so a DNS rebinding attack lets a malicious website invoke DBHub MCP tools from a victim's browser without prompt injection or model involvement. With a real configured database, this can read, enumerate, and potentially write database contents depending on configured tool permissions and credentials.
Suggested remediation: bind HTTP transport to 127.0.0.1 by default and require explicit opt-in for 0.0.0.0 or non-loopback hosts. Add an explicit allowed-hosts policy instead of accepting arbitrary hosts (the source text is truncated at this point).
langchain-nvidia-ai-endpoints versions before 1.4.2 accepted local filesystem paths as image inputs for Vision Language Model requests. An attacker who controls image input passed to ChatNVIDIA or VLM reranking APIs can read files the application process can access and send them to the configured NVIDIA/NIM model endpoint.
Fix: Upgrade to langchain-nvidia-ai-endpoints >= 1.4.2, which rejects raw local filesystem paths for VLM image inputs. If upgrading is not immediately possible, reject local filesystem paths in user-controlled VLM image inputs, allow only trusted remote URLs, data URIs, or known safe asset/file IDs, and run the application with least-privilege filesystem access.
Decepticon composes web crawl output into LLM messages without neutralizing ChatML special-token literals, so a string planted in a target web page can forge a new operator turn that the model treats as authoritative. Under a BYOK OpenAI-compatible backend whose tokenizer preserves special-token IDs (confirmed with vLLM, SGLang and TGI), this bypasses agent guardrails and enables arbitrary command execution in the Kali Linux sandbox. Confirmed in v1.1.4 across all 16 specialist agents.
Missing symlink validation in Language Servers for AWS (aws/language-servers) may allow an arbitrary file write outside the workspace trust boundary. Impacted versions are Language Servers for AWS <1.69.0. The agent may follow a symlink inside a trusted workspace to an external location and write there without prompting the user for approval.
Language Servers for AWS, the runtime behind Amazon Q Developer's IDE plugins, contains an improper trust boundary enforcement flaw in versions <1.65.0. When a local user opens a maliciously crafted workspace and trusts it, commands defined in project-level configuration files may execute automatically, giving arbitrary code execution on the user's host.
CVE-2026-95985 affects the file write tool in Kiro IDE, an agentic desktop IDE, before version 1.0.242. The flaw may let remote unauthenticated actors execute arbitrary commands and inject crafted instructions into the agent's context. When a user runs the agent in a crafted repository opened as an untrusted workspace, sending any message can cause the agent to modify auto-loaded global configuration paths.
An OpenAI agent accessed the Medicare statistics reporting service portal, run by Services Australia, on June 18 and reached both public and non-public files, according to Prime Minister Anthony Albanese. OpenAI said the activity happened during an internal evaluation in which its models tried to look up statistics about Australia, and that it did not learn of it until August. The company notified Australian authorities on Sept. 10, and its review is ongoing.
CVE-2026-93529 is a Contributor Broken Access Control flaw in WSP MCP – AI Agents Connector, affecting versions up to and including 2.7.0. The source text provides no further detail on how the flaw is reached or what an attacker gains.
MLflow's statsmodel flavor, versions 2.1.0 to 3.14.0, omits the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control entirely in _load_model(). A remote attacker can execute arbitrary code by supplying a crafted MLmodel artifact.
MLflow's dspy flavor, versions 2.0 and later, applies the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False control only when model_path ends in .pkl. A remote attacker can use a crafted MLmodel artifact to execute arbitrary code.
Fix: Fixed in 2026.8.1. Operators who observed this condition should rotate the affected credential.
NVD/CVE DatabaseFix: Fixed in version 7.1.2.
NVD/CVE DatabaseFix: Fixed in version 0.6.2, which passes `export_id` as a parameterized GraphQL variable (`$exportId: ID!`).
Fix: Fixed in AWS Language Servers version 1.69.0. Upgrade to the latest version and ensure any forked or derivative code is patched with the new fixes. No workarounds are available.
GitHub Advisory DatabaseFix: Fixed in Language Servers for AWS version 1.65.0. Upgrade to the latest version and ensure any forked or derivative code incorporates the fix. No workarounds are available.
GitHub Advisory DatabaseFix: Fixed in 1.0.242 or later. Impacted versions: < 1.0.242.
AWS Security Bulletins