AI & LLM Vulnerabilities

Grackle's MCP (Model Context Protocol) tool layer has inconsistent authorization checks that let scoped agents (restricted AI assistants) perform operations they shouldn't be allowed to, like deleting or modifying other agents' tasks or reading data across workspaces (an IDOR vulnerability, where attackers access resources by guessing IDs). The root cause is that the server uses its full API key for all backend requests without passing caller information, making the MCP tool layer the only place where permissions are checked, and some tools skip these checks entirely.

Langroid's SQLChatAgent contains a security flaw where its `_validate_query` blocklist (a list of dangerous SQL patterns to reject) fails to block several PostgreSQL file-reading functions like `pg_read_file()` and `pg_ls_logdir()`. An attacker who can influence the SQL queries the AI generates (through direct input or by injecting instructions into data the AI reads) can exploit this to read arbitrary files from the database server, even when the agent is configured to only allow SELECT statements and forbid dangerous operations.

Langroid's ReadFileTool and WriteFileTool have a path traversal vulnerability (a security flaw where attackers use sequences like ../ to access files outside intended boundaries) because they only change the working directory but don't validate that file paths stay within the configured curr_dir (current directory) boundary. An attacker can use paths like ../secret.txt to read or write files outside the intended sandbox directory, potentially compromising applications that rely on curr_dir to restrict file access.

CVE-2025-69134 is a vulnerability in the OpenAI Chatbot for WordPress Helper plugin (version 1.1.4 and earlier) that allows attackers without authentication to delete arbitrary content from WordPress sites. The flaw stems from missing authorization checks (CWE-862, a weakness where code doesn't properly verify if a user should be allowed to perform an action).

MLflow versions before 3.14.0 have a security flaw where trace API endpoints (tools for tracking AI model operations) don't properly check user permissions when authentication is turned on, allowing any logged-in user to read, delete, or modify traces they shouldn't have access to. The problem occurs because the `_before_request` handler (code that runs before processing requests) doesn't validate permissions for trace endpoints. This could lead to sensitive data leaks, destroyed audit logs (records of what happened), and unauthorized changes.

Gradio versions before 6.16.0 contain a path traversal vulnerability (a security flaw where attackers bypass restrictions on which directories they can access) in the FileExplorer component's preprocess() method. Unauthenticated attackers can supply specially crafted file paths that cause the system to escape the intended root directory and read arbitrary files outside the configured location, potentially exposing sensitive data.

Keras versions up to 3.13.2 have a security flaw that lets attackers read files from your computer by hiding malicious instructions in model files. When you load a model using Keras functions like `keras.models.load_model()`, the vulnerability doesn't properly check if datasets are virtual (pointing to other files), so it automatically reads files an attacker specifies, potentially exposing sensitive data.

CVE-2026-24264 is a vulnerability in NVIDIA Triton Inference Server for Linux where an attacker can exploit improper handling of highly compressed data (data that has been reduced in size), potentially causing a denial of service (making a system unavailable to users). The vulnerability has a CVSS score of 4.0, which indicates a moderate severity rating.

A missing authorization vulnerability in GitHub Enterprise Server allowed authenticated users to read source code from private repositories they shouldn't have access to. The vulnerability existed in a Copilot pull request description feature that compared code across repositories without checking if the user had permission to view the target repository, and it required the attacker to already have read access to at least one repository on the system.