Advisories
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
3,134 items
OmniRoute, an open-source AI gateway, is affected in version 3.8.49 and earlier. The POST /api/acp/agents endpoint passes attacker-controlled binary and versionCommand values to execFileSync, and the tokenizer's filter still permits interpreter evaluation arguments. With requireLogin set to false, or during a fresh-instance bootstrap window, an anonymous remote request can execute arbitrary code in the server container. With requireLogin enabled and a management password configured, exploitation requires a management session or a management-scoped API key.
knowns through 0.33.0 does not confine the path argument of its code.find MCP tool to the project root. An attacker can supply absolute paths or relative traversal sequences to read full contents of source files anywhere on the host, from AI agent sessions.
The n8n OAuth Dynamic Client Registration endpoints checked field sizes only for `redirect_uris`, leaving `client_name` and `grant_types` bounded by presence checks alone. An unauthenticated remote caller could submit arbitrarily large values in either field, and they were persisted to the database, so repeated registrations grew persistent storage without limit.
Fix: Fixed in n8n versions 2.37.7 and 2.38.2; upgrade to one of these or later. The patch caps `client_name` at its column length and limits `grant_types` to the grant types the server implements. Temporary workarounds: restrict network access to trusted clients, place the instance behind a reverse proxy enforcing request body size limits below the default 16 MiB, and monitor database growth and audit the `oauth_clients` table. The source states these workarounds do not fully remediate the risk.
GHSA-fmqh-xp37-5hr8 affects Open WebUI. The channel branch of the chat completions endpoint checked channel write access and message channel membership but did not verify that the caller authored the targeted message, so any channel member who can post could replace another member's message text while the original author stayed attached. The dedicated channel message edit route already performed the authorship check.
Fix: Fixed in 0.11.1 by commit `7d392bedc` (#28631). Upgrading to 0.11.1 fully resolves this, and no configuration change is required.
CVE-2026-13745 affects the Gemini CLI and its associated GitHub Action. An unprivileged attacker could achieve arbitrary code execution in Gemini CLI by placing untrusted local .env files that override GEMINI_CLI_HOME.
The `set_functype_version` MCP tool in `functype-mcp-server` accepts an unvalidated `version` string and interpolates it into `functype@<version>`, which `pnpm add` installs without checks. Because package specifiers accept `file:` and `npm:` alias syntax, a client sending an MCP `tools/call` request can make the server install an arbitrary local or remote package as `functype`. The server then calls `initDocsData(true)`, which dynamically imports `functype/cli` from that package, executing attacker-controlled JavaScript in the MCP server process as remote code execution with the server's privileges (CVSS 7.8 High).
nuxt-ollama@1.2.26 merges all module options, including api_key, into Nuxt's public runtime config (runtimeConfig.public.ollama) in src/module.ts. Nuxt serializes that namespace into the SSR HTML window.__NUXT__ payload, so any unauthenticated HTTP client that fetches a page can read the Ollama cloud API key in plaintext and use it against the Ollama API at the operator's expense.
Fix: Recommended remediation: Move api_key to the private runtime config and remove it from the browser composable. Split _options so api_key is written to runtimeConfig.ollama, while publicOptions without api_key are merged into runtimeConfig.public.ollama. The api_key should then only be consumed in the server-side utility (src/runtime/server/utils/useOllama.ts) via useRuntimeConfig().ollama.api_key.
CVE-2026-87912 affects the AWS Security Agent plugin in aws-agents-for-devsecops before version 1.1.0, and CVE-2026-87913 affects the AWS Security Agent MCP server before 0.2.0. Both stem from missing S3 bucket ownership verification, which may let remote attackers obtain the private source archive of a scanned workspace, including credentials and infrastructure state, via a pre-registered storage bucket whose name is derived from a publicly known account identifier. Impacted versions are <=1.0.0 and >=0.1.0 AND <=0.1.5.
CVE-2026-85788 affects awslabs.mysql-mcp-server versions 1.0.21 and earlier, a self-hosted Model Context Protocol server distributed via github.com/awslabs/mcp and PyPI. Under certain conditions, SQL inline comments could bypass the server's read-only enforcement, letting a statement run that the check was meant to block. The source states the read-only mode is a best-effort safeguard, and the effective boundary is the permissions of the configured MySQL user.
n8n, an open source workflow automation platform, has a vulnerability in its OpenAI Chat Model node before versions 1.123.76, 2.37.7, and 2.38.2. The node enforced credential allowed-domain restrictions for normal calls but not for the model-search dropdown, so a workflow editor could set options.baseURL to an arbitrary host and have the searchModels path send the openAiApi credential there. The flaw sits in packages/@n8n/nodes-langchain/nodes/llms/LMChatOpenAi/methods/loadModels.ts, which omitted assertOpenAiCredentialAllowsUrl.
Fixed in versions 1.123.76, 2.37.7 and 2.38.2.
n8n's sub-workflow caller policy, set by the "_This workflow can be called by_" option, was enforced by the Execute Workflow node but not when the same workflow was attached to an Agent as a tool. Any user who could build an Agent could call a workflow its owner had restricted and read its output. The issue is fixed in n8n 2.37.7 and 2.38.2.
Fix: Fixed in n8n 2.37.7 and 2.38.2; upgrade to one of these versions or later. Until then, restrict instance access to fully trusted users, audit workflows attached as Agent tools and review their caller policy settings, and remove sensitive workflows from Agent tool configurations. These workarounds do not fully remediate the risk.
The winml-cli project's serve/cli_api.py exposes all winml CLI commands over HTTP without authentication and sets allow_origins to a wildcard, so any website can call the localhost endpoint. Combined with the --trust-remote-code flag in the build and config commands, an attacker hosting a malicious model repository can run arbitrary code as the server user. The report's proof of concept demonstrates execution from a cross-origin request.
CVE-2026-79721 affects versions of the MLflow platform running version 0.0.1 or newer. A maliciously crafted model artifact can execute arbitrary code on an end user's system when the project loads it.
CVE-2026-81381 describes insufficiently protected credentials in GitHub Copilot and Visual Studio Code. An unauthorized attacker can exploit this over a network to disclose information.
CVE-2026-81380 is a command injection flaw (CWE-77 style wording: improper neutralization of special elements used in a command) affecting GitHub Copilot and Visual Studio Code. An unauthorized attacker can exploit it over a network to disclose information.
NVIDIA Triton Inference Server for Linux contains a vulnerability in which an attacker could abuse missing authorization. A successful exploit might lead to information disclosure, data tampering, and denial of service.
NVIDIA Triton Inference Server for Linux contains a vulnerability (CVE-2026-16497) that lets an attacker cause excessive iteration. A successful exploit might lead to denial of service.
NSA, CISA, and FBI issued a joint Cybersecurity Advisory warning that China-based AI companies, including DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI, are running industrial-scale distillation campaigns against U.S. frontier models such as variants of Claude, GPT, Gemini, and Grok. The companies reportedly extracted billions of tokens across millions of requests since at least late 2024, routing traffic through APIs, cloud providers, third-party aggregators, and proxy "transfer stations" to bypass geographic restrictions and terms of use.
CVE-2026-86289 affects Ollama up to 0.31.1. An integer overflow in the readGGUFV1String function of fs/ggml/gguf.go, in the GGUF Decoder component, can be triggered remotely. A public exploit exists.
Fix: Upgrading to version 0.31.2-rc1 addresses this issue. The patch is named 67b6a1c2d45321e0cb3c04a18073f9818de7724b. Upgrading the affected component is recommended.
NVD/CVE DatabaseCVE-2026-86288 affects ModelCloud GPTQModel up to 7.2.0, specifically the Triton dequantization kernel in gptqmodel/nn_modules/qlinear/tritonv2.py. Manipulating the g_idx argument causes an out-of-bounds read, and the attack can be executed remotely. The exploit has been publicly disclosed and may be used.
Fix: Upgrade to version 7.3.0, which resolves the issue. The patch is named 877c732f7d7dccd56a729844c6a5bd20f3aa8bb1. Upgrading the affected component is recommended.
Fix: Upgrade the aws-agents-for-devsecops plugin to version 1.1.0 or later, and the AWS Security Agent MCP server to version 0.2.0 or later.
AWS Security BulletinsFix: The authoring agencies recommend U.S. AI companies implement comprehensive detection and mitigation, monitoring anomalous prompts, accounts, networks, and behaviors, including subscription-to-usage ratios, maximum usage from new accounts, and enterprise-scale throughput patterns. They also recommend deploying targeted response changes, subtly altering responses for suspected malicious distillation attempts to reduce the payoff to attackers. The source lists a third immediate action that is not shown in the excerpt.
CISA Cybersecurity Advisories