Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
A vulnerability exists in AWS Transform MCP Server (a tool that lets AI assistants run code-transformation jobs on a developer's local machine) versions 0.1.0 through 0.1.4. An attacker could exploit improper pathname validation in the get_resource tool to write files anywhere on the system outside the intended directory, potentially leading to local code execution (unauthorized commands running on the developer's computer).
Fix: Update awslabs.aws-transform-mcp-server to version 0.1.5 or later.
AWS Security BulletinsMilvus versions 2.6.22 and 3.0.0 have a vulnerability that allows attackers without authentication to shut down the service by sending a specially crafted HTTP request to an unprotected endpoint on port 9091. By exploiting the /management/stop endpoint, which doesn't require login credentials, attackers can disable critical components like the proxy, datanode, or querynode, causing a denial of service (interruption where the service stops working).
IBM Langflow OSS (an open-source software tool) has a weak cryptographic key derivation vulnerability in its ensure_fernet_key() function (a function that creates encryption keys using Fernet, a symmetric encryption method). The issue involves using a cryptographically weak pseudo-random number generator (PRNG, a tool for creating unpredictable numbers needed for secure encryption), which could compromise the strength of generated encryption keys.
IBM Langflow OSS versions 1.0.0 through 1.10.3 have a security flaw in how they validate custom components when hardening mode is enabled. An authenticated attacker can exploit a cryptographic weakness (truncated SHA-256 hash, a shortened version of a security fingerprint) to create malicious code that appears to match trusted templates, allowing them to run arbitrary Python code and potentially take over the affected system.
IBM Langflow OSS (an open-source tool for building AI applications) versions 1.0.0 through 1.10.3 has a vulnerability where an authenticated attacker can execute unintended code because the application runs Python code generated by the AI model during validation before a user approves it. This allows attackers to perform harmful actions like accessing the network, interacting with files, or stealing data using the permissions of the Langflow backend process.
IBM Langflow OSS (an open-source tool for building AI applications) versions 1.0.0 through 1.10.3 have an authorization bypass vulnerability in the MemoryComponent, which stores conversation data. Authenticated users can view other users' chat histories by exploiting session_id collision (when different users accidentally get the same session identifier), because the system doesn't properly verify that a user owns the data they're requesting. This only affects systems with multiple users where automatic login is disabled.
IBM Langflow OSS (an open-source software framework for building AI applications) versions 1.0.0 through 1.10.3 has a code injection vulnerability (CWE-94, where attackers can insert malicious code by exploiting improper input validation) that allows remote attackers to execute arbitrary code on affected systems.
IBM Langflow OSS versions 1.0.0 through 1.10.3 use Python's non-cryptographic random module (a weak randomness generator not designed for security) to create Fernet encryption keys (a cryptographic method for protecting data) from user secrets under 32 characters. Because the Mersenne Twister PRNG (pseudorandom number generator, an algorithm that produces predictable sequences) produces identical keys from identical seeds, attackers can recreate these keys and decrypt stored API keys and authentication tokens.
IBM Langflow OSS versions 1.0.0 through 1.10.3 contain a path traversal vulnerability (CWE-22, a weakness where an attacker can access files outside the intended directory) that allows remote attackers to view arbitrary files on a system by sending specially crafted URLs with dot-dot sequences (/../) to bypass directory restrictions.
CVE-2026-8182 is a critical vulnerability in IBM Langflow OSS (open-source software) versions 1.0.0 through 1.10.3 that allows anyone on the internet to execute arbitrary code (run any commands they want) on the affected server without needing a password or login, using just 2 HTTP requests (standard web communications). This is a code injection vulnerability, where attackers can insert malicious code into the system.
IBM Langflow OSS versions 1.0.0 through 1.10.3 has a path traversal vulnerability (a flaw where an attacker can access files outside their intended directory) in the Knowledge Bases API endpoint. An authenticated attacker can exploit this by sending specially crafted knowledge base names that aren't properly checked, allowing them to create directories and write files anywhere on the server.
IBM Langflow OSS (open-source software) versions 1.0.0 through 1.10.3 has a vulnerability where the username field is not properly checked, allowing attackers to use path traversal (a technique to access files outside intended directories by using sequences like '../'). This flaw could let attackers delete files from any directory, destroy data belonging to other users, or remove JWT signing keys (cryptographic keys used to verify user sessions), which would invalidate all user sessions.
PraisonAI (a system for running multiple AI agents together as teams) versions before 4.6.40 have a command injection vulnerability (a flaw where attackers can sneak malicious commands into the system) in its GitHub Actions workflow (an automation tool for running code when repository changes happen). An outside contributor can create a pull request with a malicious branch name and trigger the vulnerable workflow with a comment, allowing them to run harmful commands with powerful permissions like writing to the repository and accessing authentication tokens.
IBM Langflow OSS (an open-source AI tool framework) versions 1.0.0 through 1.10.3 has a vulnerability that allows an authenticated attacker (someone with login access) to run arbitrary code (any commands they choose) on the system through code injection (inserting malicious code into the application's input). The vulnerability has a CVSS score (severity rating on a 0-10 scale) that has not yet been assigned by NIST.
IBM Langflow OSS (an open-source tool for building AI applications) versions 1.0.0 through 1.10.3 has a vulnerability where a logged-in attacker could run malicious code on the system because the software doesn't properly check Python code during AST-based security scanning (a method that analyzes code structure before execution). This is a code injection vulnerability (CWE-94), meaning attackers can insert and execute their own code.
IBM Langflow OSS versions 1.0.0 through 1.10.3 contain a vulnerability that allows a remote authenticated attacker (someone with login access) to run arbitrary code (any commands they choose) due to improper validation of module imports (not properly checking which code libraries are being loaded). The vulnerability is classified as CWE-94, a type of code injection (inserting malicious code into a program).
IBM Langflow OSS (an open-source workflow tool) versions 1.0.0 through 1.10.3 has a vulnerability where an authenticated user can inject malicious graph data into a shared cache by exploiting improper ownership validation in a deprecated API endpoint. This could allow attackers to corrupt data for other users, run workflows without permission, or crash the system.
IBM Langflow OSS versions 1.0.0 through 1.10.3 contain a server-side request forgery (SSRF, a vulnerability where an attacker tricks a server into making unwanted requests to other systems) in the validate_model_provider_key() function for the Ollama provider. The vulnerability exists because the function accepts a user-supplied URL parameter without checking if it's safe, allowing attackers to potentially access private internal networks or services.
IBM Langflow OSS versions 1.0.0 through 1.10.3 contain a vulnerability that allows server-side request forgery (SSRF, where an attacker tricks a server into making unwanted requests to internal systems) because the software's protections against this attack are incomplete and not properly enforced. The vulnerability has a CVSS score that is still being assessed by the National Institute of Standards and Technology.
IBM Langflow OSS versions 1.0.0 through 1.10.3 contain a vulnerability that allows a remote authenticated attacker (someone who has logged in to the system) to execute arbitrary commands due to improper neutralization of special elements used in OS commands (a weakness called OS command injection, where attackers can sneak malicious commands into system operations). The vulnerability affects multiple versions of this open-source AI/LLM workflow tool.
Fix: Update to version 4.6.40 or later, where this issue has been fixed.
NVD/CVE Database