Advisories

Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose information over a network. The source gives no affected versions, attack preconditions or further technical detail.

AI Agent Automation, a modular AI agent workflow platform, is affected by CVE-2026-54520 in versions prior to 0.9.1. The executeStep file-step implementation in backend/src/agents/executor.js passes the user-controlled step.path value through path.resolve with process.cwd() and uses the result for reads or writes without confirming it stays inside an approved workflow directory. An authenticated user who can create or modify workflow file steps can use traversal segments to read sensitive files or write and overwrite files the backend process can access, including application-adjacent files when process permissions allow.

AI Agent Automation versions prior to 0.9.1 contain an authorization flaw in backend/src/controllers/memory.controller.js. The listMemories, deleteMemory, and clearAgentMemory functions accept a caller-supplied agentId or memory _id without checking that the related Agent belongs to req.user. An authenticated attacker who knows or obtains another user's identifiers can read that user's AgentMemory content, delete an individual memory, or clear all memory for a victim agent.

SQLBot, a Text-to-SQL system built on large language models and RAG, is affected by CVE-2026-53556 before version 1.9.0. The POST /api/v1/datasource/previewData endpoint places the client-controlled table_name value into generated SQL without safe identifier handling. An authenticated user can use a crafted table_name to call pg_read_file(), pg_read_binary_file() or pg_ls_dir() through a datasource pointed at the internal PostgreSQL service, reading filesystem content such as /etc/hosts and /etc/passwd, and potentially configuration, credentials and source code. In the default tested trusted loopback authentication configuration, the connection runs with PostgreSQL superuser privileges.

CVE-2026-53554 affects SQLBot, a Text-to-SQL system built on large language models and RAG, prior to 1.9.0. The POST /api/v1/datasource/parseExcel endpoint trusts attacker-controlled multipart filenames when choosing storage, and it writes uploaded content before spreadsheet parsing and validation finish. A crafted upload can plant a Python file in /opt/sqlbot/app/alembic/versions/ even when parsing fails and the endpoint returns an error. On the next startup or migration, Alembic imports that file and runs its module-level statements inside the SQLBot runtime.

MCP Documentation Server versions 1.13.0 through 1.13.1 start a Web UI by default on port 3080, and startWebServer in src/web-server.ts calls app.listen(PORT) without a host, binding the unauthenticated document-management API to all interfaces instead of localhost. A network-reachable client can call endpoints such as GET /api/documents, POST /api/documents, DELETE /api/documents/:id and POST /api/search-all without credentials to read, search, insert or delete documents and alter the assistant's knowledge base. The attacker must be able to reach the service over a LAN, VM network, container bridge, VPN or other routed network, and the issue does not grant remote code execution.

Unauthenticated remote attackers can leak one entry from the in-memory session table of `LocalSessionManager` per HTTP request by sending a well-formed JSON-RPC `POST` that is not an `InitializeRequest` to the rmcp Streamable HTTP server. `handle_post` in `crates/rmcp/src/transport/streamable_http_server/tower.rs` allocates the session before validating the body and early-returns on failure without calling `close_session`, so the leak is permanent for the process lifetime. The source reports over 2,000 leaking requests per second from a single Python client, equivalent to roughly 75 GB of resident memory per day.

The rmcp library does not validate the resource field in OAuth Protected Resource metadata (RFC 9728), so a malicious MCP server can point an OAuth flow at a legitimate authorization server. The victim completes the authorization prompt, and the resulting access token, valid for the legitimate server, is sent to the attacker's server, which can then impersonate the victim. All MCP clients built on rmcp that use OAuth-protected MCP servers are affected.

Kedro-Datasets versions 5.0.0 through 9.5.0 have a flaw in kedro_datasets_experimental.pytorch.PyTorchDataset, which loads .pt model files with torch.load without enforcing weights_only=True and silently drops user-supplied load_args. On PyTorch versions earlier than 2.6, a malicious pickle-backed model from an attacker-influenced source can execute arbitrary code when a Kedro pipeline loads it. The issue affects only the opt-in experimental component.

LiteLLM, an AI Gateway proxy for calling LLM APIs, is affected before version 1.83.9. An authenticated caller holding a valid virtual key can nest api_base inside the user_config request body, which bypasses is_request_body_safe because that check blocks only top-level api_base and base_url. Since user_config builds the outbound router, the caller can redirect server-side requests to an internal or external host of their choosing and reach endpoints they could not otherwise access.

Stanza, a Stanford NLP Python library, prior to 1.14.0 extracts downloaded model and resource archives in stanza/resources/common.py via zipfile.ZipFile.extractall without validating member paths. Archives reached through stanza.download and stanza.install_corenlp containing parent-directory traversal entries can write outside the model directory, overwriting files writable by the Stanza process and potentially enabling code execution through shell configuration, SSH authorization data, Python packages, or executable scripts.