Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
Coder's OIDC (OpenID Connect, a login standard) authentication had a bug where it didn't properly check if an email was verified when the identity provider returned the verification status as a string or omitted it entirely, causing it to assume the email was verified by default. An attacker could use this flaw to take over someone's account by registering their email at a compatible identity provider without verifying it, then logging in through OIDC to gain access to the victim's Coder account.
Fix: Upgrade to one of the patched versions: v2.34.2 (for release line 2.34), v2.33.8 (for 2.33), v2.32.7 (for 2.32), or v2.29.17 (for 2.29 ESR). The fix properly handles the `email_verified` claim across boolean, string, and numeric types and blocks email-based account matching when the user already has a different linked identity provider. As a temporary workaround, ensure your identity provider returns `email_verified` as a native JSON boolean, though upgrading is still required to fully address the email-fallback linking issue.
GitHub Advisory DatabaseA vulnerability called CVE-2026-14471 exists in Amazon mcp-gateway-registry (a tool that manages AI agent access to different services) versions 1.0.3 through 1.0.12. An authenticated user can exploit SQL injection (inserting malicious SQL commands into inputs) in the metrics tracking system to read sensitive data like API keys, or delete and modify stored information.
Langroid has a security flaw where tools registered with `use=False, handle=True` (meant to prevent the AI from calling them) can still be invoked directly by users sending raw JSON chat messages, because the message-handling code doesn't verify whether the message came from a user or the AI. This could allow unauthorized access to sensitive operations like file access or database queries depending on which tools are enabled.
Langroid's TableChatAgent and VectorStore have a critical vulnerability where they use Python's `eval()` function to execute code generated by the AI, but fail to properly sandbox it. Even though they pass an empty dictionary for local variables, Python automatically includes built-in functions like `__import__()` in the execution environment, allowing an attacker to run arbitrary commands on the host system through prompt injection (tricking the AI into generating malicious code).
Langroid's SQLChatAgent has a security flaw in its dangerous-function blocklist, which uses a regex pattern (a rule for matching text) to block dangerous PostgreSQL functions like pg_read_file. However, attackers can bypass this blocklist by writing the function name in quoted form, adding comments, or using schema-qualified names (like pg_catalog."pg_read_file"), because PostgreSQL accepts all these variations but the regex only checks for the function name directly followed by an opening parenthesis. This means the earlier fix that tried to block file-reading functions doesn't actually work.
vLLM (a system for running large language models) versions 0.22.0 to 0.23.0 have a vulnerability where two audio processing routes load uploaded files entirely into memory before checking if they exceed the maximum allowed file size limit (25 MB by default), allowing attackers to cause memory exhaustion or crash the system by uploading oversized files. This happens because the size check occurs too late in the process, after the file has already been loaded.
The OpenAI Codex desktop app for macOS had a security flaw where it automatically loaded remote images from AI responses without user confirmation. An attacker could use indirect prompt injection (tricking the AI by hiding instructions in untrusted input like tool results) to make the app fetch images containing sensitive data like API keys or source code, secretly sending that information to the attacker's server.
The flyto-core library has a security flaw in its SSRF protection (SSRF is server-side request forgery, where an attacker tricks a server into making requests to internal systems). The protection checks if a URL points to a private IP address, but it only recognizes standard private IP formats and misses special IPv6 transition address forms (formats that embed IPv4 addresses like ::ffff:127.0.0.1). An attacker who can write workflows can use these alternate address formats to bypass the protection and access internal services like cloud metadata endpoints, potentially reading sensitive data.
When DEBUG loglevel (a setting that outputs detailed program information for troubleshooting) is enabled in SUSE Rancher AI Agent versions before 1.0.2, sensitive data like API keys (credentials for accessing external services) and LLM response text can be written to logfiles where local attackers (people with access to the same computer) could find and misuse them. This is rated as HIGH severity with a CVSS score (a 0-10 rating of how severe a vulnerability is) of 7.0.
A vulnerability (CVE-2026-14742) was found in langchain-ai langgraph up to version 1.2.4, where the _freeze function in the Task Result Cache (a system that stores computed task results to avoid recalculating them) uses a weak hash when processing the default_cache_key argument. This could potentially be exploited remotely, though the attack requires significant technical skill and is considered difficult to execute.
A security weakness was found in CowAgent version 2.1.0 where the verify_server function fails to properly authenticate requests when the wechatmp_token (a security credential) is missing or empty, allowing remote attackers to bypass authentication. This vulnerability has been publicly disclosed and is being actively exploited.
A weakness was found in ONNX (a software format for AI models) versions up to 1.21.x that allows an out-of-bounds read (accessing memory outside the intended area). The vulnerability is in a function called convPoolShapeInference_opset19 and can be attacked remotely by someone with login access, though the attack code is now public.
In fickling (a security tool for analyzing pickle files), versions up to 0.1.11 have a bug where the UnsafeImportsML analysis pass marks all imports as already-checked in a shared list, causing the MLAllowlist pass (which is supposed to block imports from unsafe libraries) to skip its checks entirely. This means dangerous imports from standard library modules that aren't explicitly blocked can be deserialized and executed when fickling's security check returns LIKELY_SAFE.
Picklescan (a security tool that checks pickle files, which are Python files that serialize and deserialize objects) before version 0.0.33 fails to detect a specific dangerous code gadget called numpy.f2py.crackfortran.getlincoef that can hide in pickle __reduce__ methods (special functions that control how objects are reconstructed). This allows attackers to create malicious pickle files that execute arbitrary code when opened, potentially compromising shared model files in supply chains.
picklescan (a tool for detecting malicious code in pickle files, which are Python serialized objects) before version 0.0.30 has a vulnerability that allows attackers to hide malicious code in pickle files using a specific method (idlelib.run.Executive.runcode in reduce methods). When these files are loaded using pickle.load, the hidden code executes automatically, enabling RCE (remote code execution) and potential supply chain attacks on systems using PyTorch models.
A vulnerability in Keras (a machine learning library) version 3.14.0 allows attackers to run arbitrary code by exploiting how the Lambda layer deserializes data (converts stored data back into usable form). The bug occurs because the safety check treats an unset value the same as a deliberately disabled one, allowing malicious bytecode (low-level machine instructions) to execute when functions like `keras.layers.deserialize()` are called without proper safety protections.
CVE-2026-13341 is a vulnerability in Kong Konnect MCP (Model Context Protocol, a system for standardized communication between AI models and tools) server versions before 1.0.0 that allows remote attackers to perform prompt injection attacks (tricking the AI by hiding malicious instructions in input) and execute unintended API requests (commands to interact with web services).
CVE-2026-45499 is a server-side request forgery vulnerability (SSRF, a flaw where an attacker tricks a server into making unwanted network requests) in Azure OpenAI that allows an authorized attacker to gain elevated privileges over a network. The vulnerability has a CVSS score (severity rating from 0-10) that has not yet been assigned by NIST. Microsoft has published information about this vulnerability on their security update page.
CVE-2026-41106 is an open redirect vulnerability (a flaw where a website redirects you to an untrusted site) in Microsoft 365 Copilot that allows an attacker to gain unauthorized elevated privileges (higher access levels) over a network. The vulnerability has a CVSS score (severity rating) of 4.0. This is an exclusive service issue affecting Microsoft 365 Copilot users.
Weaviate versions before 1.38.0 have a security flaw in RBAC (role-based access control, a system that restricts what users can do based on assigned roles) where the system doesn't check if someone assigning a role to themselves or others actually has permission to grant those permissions. This means a user with limited permissions can assign themselves or others powerful admin roles, gaining full control of the database.
Fix: This issue is fixed in version 0.24.0.
NVD/CVE DatabaseFix: Update SUSE Rancher AI Agent to version 1.0.2 or later.
NVD/CVE DatabaseFix: Upgrading to version 2.1.1 addresses this issue. The fix adds an explicit check to ensure wechatmp_token is not empty in the verify_server() function, causing the /wx endpoint (the entry point for requests) to reject requests with a 403 Forbidden error when the token is missing or has its default empty value, instead of falling back to a weaker signature verification method.
NVD/CVE DatabaseFix: Apply patch a7bf3a0f1d18bb62575236ef6e4944980c40e045, available at https://github.com/onnx/onnx/commit/a7bf3a0f1d18bb62575236ef6e4944980c40e045.
NVD/CVE DatabaseFix: Update to Weaviate version 1.38.0 or later.
NVD/CVE Database