Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
IBM Langflow OSS versions 1.0.0 through 1.10.0 have a critical vulnerability in their caching system that allows attackers to run arbitrary code on the server. The problem occurs because the software uses an unsafe deserialization method (pickle.loads(), which converts stored data back into Python objects without checking if it's trustworthy) to load cached data from disk, and attackers can exploit this by inserting malicious data through file access, workflow inputs, or API calls.
IBM Langflow OSS (open-source software) versions 1.0.0 through 1.10.0 contains a critical security flaw in the `apply_tweaks()` function that allows authenticated users (those with login credentials) to override component parameters at runtime via the API (application programming interface, which lets software communicate with other software). This is a type of code injection vulnerability (where attackers insert malicious code by manipulating input that the system then executes).
CVE-2026-7872 is a vulnerability in IBM Langflow OSS (open-source software) versions 1.0.0 through 1.10.0 that allows an authenticated attacker (someone with login credentials) to read arbitrary files on the system, including the JWT signing key (a secret used to create authentication tokens). With access to this key, an attacker could forge authentication tokens to impersonate any user.
IBM Langflow OSS (open-source software) versions 1.0.0 through 1.10.0 have a vulnerability that allows remote code execution (running malicious commands on a system from a distance) because the software doesn't properly validate MCP server configuration files (text files that tell the system how to connect to external services). This is a serious security flaw because an attacker could exploit incomplete validation enforcement to execute unauthorized code.
IBM Langflow OSS versions 1.0.0 through 1.10.0 and Langflow 1.9.0 contain a vulnerability that allows SSRF (server-side request forgery, where an attacker tricks a server into making requests to unintended targets) because of unsafe default settings and incomplete protection mechanisms against this type of attack. The vulnerability has a CVSS 4.0 severity rating, though a full assessment from NIST has not yet been provided.
IBM Langflow OSS (open-source software) versions 1.0.0 through 1.10.0 has a vulnerability where an authenticated attacker (someone with login access) can create a malicious flow pointing to a URL they control, which returns a specially crafted header that tricks the system into writing files to any location on the server. This works because the system doesn't properly validate file paths, allowing an attacker to use path traversal (using sequences like '../' to escape the intended directory) to write files anywhere the Langflow process can access.
IBM Cognos Analytics version 12.1.3 GA through build 12.1.3-2606251736 has a race condition (a bug that occurs when multiple processes access shared data simultaneously without proper protection), allowing attackers to get incorrect report summaries or cause report-processing failures when multiple authenticated users submit reports at the same time.
IBM Langflow OSS (open-source software) versions 1.0.0 through 1.10.1 has a vulnerability where authenticated users (those who have logged in) can run arbitrary commands (any code they choose) with elevated privileges (higher access level) due to improper validation of user input in the Python Interpreter component (the part that executes Python code). The vulnerability stems from OS command injection (CWE-78, where attackers embed malicious system commands in their input), allowing attackers to bypass security checks.
IBM Langflow OSS (an open-source tool for building AI workflows) versions 1.0.0 through 1.10.1 have an unauthenticated remote code execution vulnerability (RCE, where attackers can run commands on the system without logging in) in a public endpoint. The vulnerability exists because the validate_public_flow_no_code_execution() function (a safety check) has an incomplete denylist (a list of things to block) that fails to block certain agent components like OpenDsStarAgent, CodeActAgentSmolagents, and CSVAgent from executing code.
AWS HealthOmics MCP Server versions 0.0.35 and earlier contain a path traversal vulnerability (a flaw where attackers can use special directory notation like '../' to access files outside intended locations) in its workflow linting tools. An attacker who can control inputs to the MCP agent could write malicious files to any location on the system instead of just the workflow bundle directory.
A security flaw in mcp-memory-keeper allowed arbitrary local file reads through the `context_import` function, which didn't validate file paths before reading them. An attacker (either a malicious client or an LLM agent affected by prompt injection, a technique where hidden instructions are embedded in AI inputs) could read any file accessible to the server process, including credential files and configuration files, or view partial file contents through error messages.
IBM Langflow OSS versions 1.0.0 through 1.10.0 contain a code injection vulnerability (a type of security flaw where attackers insert malicious code) in the ToolGuard integration that allows authenticated users to bypass the allow_custom_components=false security control and execute arbitrary Python code on the backend. The vulnerability exists because the validation system only checks the main component code but misses dynamic CodeInput fields, and attackers can exploit this by embedding malicious code in these unvalidated fields that get executed when tools are invoked. The flaw can be made worse through cross-tenant flow manipulation (exploiting flows across different user accounts) when certain security settings are misconfigured.
IBM Langflow OSS versions 1.0.0 through 1.10.0 have a critical vulnerability in the /api/v1/login/auto_login endpoint that allows unauthenticated attackers to gain full administrative access by obtaining long-lived superuser bearer tokens (special credentials that prove you have admin privileges) when AUTO_LOGIN is enabled by default. The vulnerability is made worse by overly permissive CORS settings (rules controlling which websites can access the application), which can expose these tokens to unintended websites.
Agentic-Flow, an AI agent orchestration platform (a system that manages and coordinates multiple AI agents working together), had a critical vulnerability in versions before 2.0.14 where user-controlled input was directly inserted into shell commands without proper safety checks, allowing attackers to execute arbitrary operating system commands with the server's permissions.
IBM Langflow OSS (open-source software) versions 1.0.0 through 1.10.0 has a critical flaw that allows attackers without login credentials to create unlimited user accounts. When a specific deployment setting called NEW_USER_IS_ACTIVE is enabled, these newly created accounts become immediately usable and can access RCE endpoints (remote code execution, where an attacker can run commands on a system they don't own), completely bypassing security controls.
IBM Langflow OSS versions 1.0.0 through 1.10.0 have a critical security flaw where unauthenticated attackers can chain two API endpoints together to gain full control of a system. The attackers first use /api/v1/auto_login to mint SUPERUSER tokens (special access credentials), then use /api/v1/validate/code to execute arbitrary code through exec() (a function that runs user-provided commands), achieving RCE (remote code execution, where an attacker can run commands on a system they don't own).
The AI Copilot WordPress plugin before version 1.5.4 has a security flaw where OAuth access tokens (temporary credentials that grant access to accounts) are not properly tied to specific WordPress users, allowing attackers who complete the public login process to gain administrator privileges and perform dangerous actions like creating new users or changing user permissions.
Quicly is a library that implements the QUIC protocol (a modern internet communication standard) for the H2O web server. Before a certain code update, an attacker could send specially crafted network messages that trick the server into allocating huge amounts of memory using very few packets, potentially causing a denial of service (making the service unavailable by exhausting its resources).
text-generation-inference (a tool for running AI text models) versions up to 3.3.7 have a server-side request forgery vulnerability (SSRF, where an attacker tricks a server into making requests to places it shouldn't) in its chat feature that lets unauthenticated attackers supply malicious image URLs to make the server fetch data from internal systems, cloud metadata endpoints, or scan ports. The vulnerability exists because the code doesn't validate whether URLs point to private or internal addresses, and the HTTP client automatically follows redirects, letting attackers bypass security checks.
Fix: Update aws-healthomics-mcp-server to version 0.0.36 or later.
AWS Security BulletinsFix: Fixed in version 0.13.0 (PR #36). The patch: (1) restricts imports to a server-owned exports directory using `realpathSync` and rejects `../` traversal and absolute paths outside the directory, (2) separates file read and JSON parsing operations with generic error messages instead of echoing file bytes, and (3) adds security regression tests covering arbitrary-read, traversal, and symlink escape vectors. Users must upgrade to version >= 0.13.0; there is no configuration-only workaround for affected versions.
GitHub Advisory DatabaseFix: Update to version 2.0.14 or later, which fixes this vulnerability.
NVD/CVE DatabaseFix: Update the AI Copilot WordPress plugin to version 1.5.4 or later.
NVD/CVE DatabaseFix: This issue has been fixed by commit 8b178e6.
NVD/CVE DatabaseAWS Bedrock AgentCore Python SDK versions 1.4.8 and 1.5.0 unintentionally logged sensitive user data in OpenTelemetry span attributes (metadata tags that track operations), which then flowed into CloudWatch Logs (AWS's logging service) where anyone with log access could read them. This meant raw user prompts and AI agent responses were stored unfiltered in logs, exposing sensitive information.
Fix: Upgrade to version 1.5.1 or later. Additionally, users who ran the affected versions should review and purge sensitive content from their aws/spans CloudWatch log groups.
NVD/CVE Database