Advisories

TAKO AI Agent for Okta, prior to 3.0.1-beta, lets any authenticated user with a valid `fctr_session` cookie submit arbitrary Python through `POST /api/react/execute-script`, without administrator privilege. The `script_code` bypasses AI content filtering and passes an AST check that misses dynamic `getattr` call chains through `__builtins__`, then runs as root in the default container, enabling disclosure of Okta API tokens, the JWT key and the SQLite database, plus backend pivoting and persistence.

RAGFlow versions 0.25.2 through 0.27.3 call completion_openai in POST /api/v1/agents/chat/completions before UserCanvasService.accessible() checks access to the requested agent. An authenticated user who knows another user's private agent UUID can run that Only me workflow and read its output across user or tenant boundaries, and configured tools may cause side effects, though stronger impacts were not demonstrated.

praktor, a multi-agent Claude Code orchestrator with Telegram input, has a path traversal flaw in both Telegram upload sites in `internal/telegram/bot.go` before 0.9.1. The attacker-controlled document filename is concatenated into the destination path without sanitization, and `path.Join` collapses parent-directory traversal, so a remote Telegram user can write outside `uploads/` within the persistent agent workspace mounted at `/workspace/agent`. With `allow_from: []`, which permits all senders by default, no authentication is needed, and the attacker can plant or overwrite `CLAUDE.md`, instruction, skill, hook or configuration files that the agent reads on later runs. The demonstrated write scope is the workspace volume, not the unrestricted host filesystem.

Flowise through 3.1.4 has a sandbox escape (CVE-2026-119978) that lets authenticated users run OS commands when ALLOW_BUILTIN_DEP=true. Attackers submit JavaScript to /api/v1/node-custom-function that uses LocalFileStore to write a file into the mammoth package and then require it, escaping vm2 as the Flowise process user.

DBHub, a database MCP server, versions prior to 0.22.6 contain a flaw where read-only SQL validation can be bypassed on its MySQL and MariaDB connectors. The `scanSingleLineComment` function in `src/utils/sql-parser.ts` treats any double dash as a comment, while MySQL and MariaDB require following whitespace, so a hidden write or DDL statement evades `isReadOnlySQL` and still executes with `multipleStatements` enabled. An attacker who can influence the assistant's SQL, including via prompt injection, can modify or drop data within the database account's privileges. PostgreSQL is not affected.

Prior to version 0.1.76, SOCFortress CoPilot's `POST /api/agent_data_store/upload` endpoint in `backend/app/data_store/data_store_routes.py` let `customer_user` callers choose `bucket_name` and `object_name` with no allowlist, tenant prefix, ownership check or content restriction, so existing objects of any tenant could be overwritten. Targets include Sysmon configs distributed to Windows endpoints, server-rendered case report templates, and case and Velociraptor forensic artifacts, letting a lowest-privilege user tamper with cross-tenant evidence, blind endpoint telemetry or poison report templates. Sibling list, download and delete routes stay restricted to admin and analyst roles.

n8n versions before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contain CVE-2026-119408, a remote code execution flaw. The deprecated Function, Function Item, and LangChain Code nodes run outside task runner isolation. Authenticated users who can create, modify, or import workflows that name these hidden node types can execute JavaScript in the n8n main process.

Kubeflow Pipelines versions before 2.18.0 have a resource exhaustion flaw in the API server's handling of uploaded pipeline archives. A small ZIP or gzip-compressed tar file can expand to consume disproportionately large memory and exhaust API-server resources. Multipart pipeline and pipeline-version uploads decompress before namespace authorization, so a reachable caller does not need a successful pipeline-create authorization decision.

CVE-2026-118759 affects Kubeflow Pipelines before 2.18.0. The GET /apis/v1alpha1/runs/{run_id}/nodes/{node_id}/log handler returns logs without checking that the caller is authorized for the selected run, so a caller who can reach the backend and knows a run ID and a pod or node identifier can read live or archived logs with the API server's permissions. Live log requests also accept the node ID as a pod name without verifying run ownership, letting a known run ID reach an unrelated pod's main container logs.

Prior to 2.18.0, the volume artifact handler for GET /artifacts/get?source=volume in Kubeflow Pipelines did not confine a caller-supplied file path to the selected volume. A caller who can reach the route and name an existing mounted volume can use path traversal to read files outside that volume, if the artifact-serving process can read them. With authentication disabled no application credentials are needed; in multi-user deployments the caller ordinarily must be authorized for the supplied namespace.

@eeacms/volto-chatbot@2.0.3 registers an Express middleware on `**/_v1_da/**` that forwards unauthenticated requests of any HTTP method to the configured Danswer API, attaching the server-side DANSWER_API_KEY or session cookie. Because the path is derived from req.url with no allowlist or method restriction, an unauthenticated attacker can call arbitrary Danswer endpoints, including admin ones, as the service account.

When @sylphx/pdf-reader-mcp runs as an HTTP server (MCP_TRANSPORT=http), it reads MCP_API_KEY and logs that X-API-Key authentication is enabled, but never validates the header, so the /mcp endpoint accepts unauthenticated requests. With the default bind address of 0.0.0.0, any client that can reach the port can invoke every PDF tool and read any PDF the server process can open on the host, and URL-based sources allow limited SSRF unless --allow-private-ips is set. Only the opt-in HTTP transport is affected; the default stdio transport is not.

PraisonAI's JobWorkflowExecutor._exec_inline_python() runs inline Python from YAML workflow script: steps after AST validation, but the module import allowlist (allowed_modules) includes 'os', and the AST allowlist permits ast.Import, ast.Call and ast.Attribute nodes. A script such as "import os; os.system(...)" passes validation, so arbitrary OS commands run with the privileges of the calling process when PRAISONAI_ALLOW_JOB_WORKFLOWS=true and a workflow is executed via praisonai workflow run. The source notes the risk is greatest in multi-tenant or CI environments where workflows come from untrusted sources.