Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
IBM Langflow OSS (open-source software) versions 1.0.0 through 1.9.6 has a security flaw where attackers without login credentials can access protected project resources and perform operations through the Streamable MCP (model context protocol, a system for AI tools to communicate) transport endpoint because the software fails to properly check user permissions. This vulnerability affects the authorization layer, meaning the system doesn't adequately verify who is allowed to do what.
IBM Langflow OSS versions 1.0.0 through 1.9.6 have a Server-Side Request Forgery vulnerability (SSRF, where an attacker tricks a server into making requests to unintended targets) in two components that make unvalidated HTTP requests to user-controlled URLs. An authenticated attacker can exploit this to access internal resources like cloud metadata services (systems that store sensitive configuration and credentials for AWS, Azure, or GCP) and potentially steal credentials or map internal networks, or trigger the attack through prompt injection (tricking an AI by hiding malicious instructions in its input) in agentic workflows.
IBM Langflow OSS (open-source software) versions 1.0.0 through 1.9.6 have a missing authentication vulnerability in the /api/v1/build_public_tmp/ endpoints, which allows attackers without credentials to read build event data or cancel jobs if they know the job identifier, leading to information disclosure (unauthorized data access) and denial of service (disrupting service availability). This vulnerability is caused by improper authentication (CWE-287, a weakness in verifying user identity).
IBM Langflow OSS versions 1.0.0 through 1.9.3 contain a Server-Side Request Forgery vulnerability (SSRF, a flaw where an attacker tricks a server into making requests to unintended locations) in the URL component. The vulnerability is caused by a TOCTOU race condition (a timing bug where a system checks something at one moment but uses it at another, allowing attackers to change it in between), which attackers can exploit through DNS rebinding (a technique where an attacker changes what a domain name points to after the server checks it).
IBM Langflow OSS versions 1.0.0 through 1.10.0 have a vulnerability in voice mode where API client credentials are improperly shared across different tenants (separate user accounts or organizations). An authenticated attacker can manipulate cached data to make requests from other users run under wrong API credentials, leading to incorrect billing charges and misattribution of actions to the wrong user.
IBM Langflow OSS (open-source software) versions 1.0.0 through 1.9.3 has a critical vulnerability that lets attackers read sensitive secrets (like passwords or API keys), modify flows (the workflows that connect AI components together), access the database, connect to internal systems, and create persistent backdoors by injecting malicious code into public flows.
IBM Langflow OSS versions 1.0.0 through 1.9.3 have a vulnerability where attackers can bypass SSRF protection (a security feature that prevents the server from making requests to internal systems). An authenticated user with basic permissions can enable a follow_redirects setting and use a public URL that redirects to internal addresses, allowing them to access sensitive internal services and data that should be blocked.
LLaMA-Factory (a tool for customizing large language models) versions up to 0.9.5 has a remote code execution vulnerability where attackers with access to the web interface can run malicious code by providing a fake model path in the Chat or Training sections. The vulnerability exists because the application doesn't validate user input before passing it to code that loads models, and it uses a setting called trust_remote_code=True, which tells the underlying Hugging Face library to automatically execute any code included with the model files.
A vulnerability in Devolutions PowerShell Universal 2026.2.0 allows authenticated users with AI Agent read access to obtain sensitive authentication tokens (reusable credentials that grant access to systems) because these tokens are sent in plaintext (unencrypted, readable text) in job API (an interface for running automated tasks) responses. This could allow attackers to gain higher-level access than they should have.
Claude Code, a tool that uses AI to help write software, had a security flaw in versions 2.1.38 through 2.1.163 where it could be tricked into creating special folders named '.git' and accessing files outside its restricted sandbox (a controlled environment that limits what software can access). An attacker could exploit this by creating a malicious code repository and convincing a user to run Claude Code on it, potentially allowing the attacker to run commands on the user's computer outside the sandbox's protections.
The fluent-plugin-opentelemetry plugin's HTTP input lacks size limits, allowing attackers to send huge or highly compressed files that consume excessive memory when decompressed, causing a DoS (denial of service, a type of attack that makes a service unavailable) attack by crashing the Fluentd logging process. If the OpenTelemetry endpoint (a connection point that accepts telemetry data) is exposed to untrusted networks, an attacker can exploit this to disrupt all log collection on the affected server.
AutoGPT versions before 0.6.32 contain a DoS (denial of service, where a system is overwhelmed and stops working) vulnerability in its AITextSummarizerBlock component. A malicious user can input a small amount of content that causes the server to consume massive amounts of memory, exhausting resources and crashing the system, for example turning 10K of input into 50G of memory usage.
Docling is a tool that helps process documents by reading different file formats and connecting with AI systems. Before version 2.94.0, Docling's HTML backend had unsafe handling of URIs and file paths (ways of locating files on a computer), which could be exploited as a security weakness. This issue was fixed in version 2.94.0.
Docling is a tool that processes documents in different formats and connects them with AI systems. Versions 2.45.0 through 2.91.0 had security flaws in how they parsed METS-GBS archives (a type of compressed document file), allowing attackers to craft malicious files that could steal sensitive data, use up system resources, or crash the application.
picklescan (a tool that checks if pickle files, which are Python's serialization format, are safe) through version 0.0.26 fails to detect malicious pickle files that use a hidden code-execution technique through idlelib.pyshell.ModifiedInterpreter.runcode. Attackers can hide dangerous code in pickle files that runs when the file is loaded, potentially compromising PyTorch models and other saved Python objects in supply chain attacks (attacks that compromise software as it's being distributed).
Cursor, a code editor that uses AI to help with programming, had a security flaw in versions before 3.0 where its sandbox protection (a restricted environment that limits what programs can do) could be bypassed. An AI agent could create a symlink (a shortcut that points to a different location) inside the workspace to trick the editor into writing files outside the workspace without user approval, potentially allowing an attacker to run code with full system access.
Cursor is a code editor that uses AI to help with programming. Before version 3.0, Cursor had a security flaw where an AI agent could trick the sandbox (a restricted environment that limits what code can do) into allowing file writes to sensitive locations outside the workspace, potentially letting malicious code run with full user permissions without any protection.
The opentelemetry_sdk library had a vulnerability where it didn't check size limits before processing baggage headers (metadata passed between services in distributed tracing, which is used in observability and monitoring). An attacker could send extremely large headers that would waste CPU and memory while being parsed, even though they'd eventually be rejected, potentially causing a denial-of-service attack (making a service unavailable by overwhelming it with resource requests).
The langgraph-sdk (a Python library for making HTTP requests to LangGraph services) had a vulnerability where it directly inserted user-supplied identifier values into URLs without encoding them. This meant special characters in identifiers could change which resource was accessed, potentially allowing users to access, modify, or delete resources they shouldn't have permission to change, especially in systems that check permissions based on the URL path. The vulnerability only affects applications that pass unvalidated user input directly to SDK methods.
LangGraph's `JsonPlusSerializer` (a tool that converts JSON data back into Python objects) has a vulnerability where checkpoint files (saved states of an AI workflow) stored insecurely could be modified by attackers and cause arbitrary code execution (running attacker-chosen commands) when the checkpoint is loaded. This risk only applies if someone gains unauthorized write access to where checkpoints are stored, but the concern is converting that storage access into full control of the running application.
Fix: This vulnerability is fixed in version 2.1.163.
NVD/CVE DatabaseFix: Upgrade to v0.5.3. If immediate upgrade is not possible, restrict network access to the OpenTelemetry ingestion port (default 4318) using firewall rules to only trusted networks, or place a reverse proxy like Nginx in front of Fluentd to handle decompression and enforce strict size limits on both compressed and uncompressed request bodies before sending traffic to Fluentd.
GitHub Advisory DatabaseFix: This vulnerability is fixed in version 0.6.32. Update AutoGPT to 0.6.32 or later.
NVD/CVE DatabaseFix: Update Docling to version 2.94.0 or later, where the vulnerability is fixed.
NVD/CVE DatabaseFix: This vulnerability is fixed in version 2.91.0. Users should update to this version or later.
NVD/CVE DatabaseFix: This is fixed in version 0.0.30. Upgrade picklescan to version 0.0.30 or later.
NVD/CVE DatabaseFix: This vulnerability is fixed in version 3.0.
NVD/CVE DatabaseFix: This vulnerability is fixed in 3.0.
NVD/CVE DatabaseFix: Upgrade opentelemetry_sdk to version 0.32.1 or later. Alternatively, if immediate upgrade is not possible, reject or limit inbound baggage headers larger than 8192 bytes before OpenTelemetry processes them. This can be enforced at a proxy, gateway, middleware layer, or custom carrier boundary.
GitHub Advisory DatabaseFix: The SDK now applies path-segment encoding to identifier values before they are interpolated into request URL templates. After this change, identifier values that contain characters with special meaning in URL paths are transmitted as encoded byte sequences and routed to the resource the SDK method's call site indicates. Additionally, the source recommends: validate identifier values (typically as UUIDs) at the boundary where untrusted input enters the application before passing them to SDK methods, and for deployments relying on URL-prefix-based authorization, prefer authorization at the LangGraph server layer or on parsed-and-validated request paths rather than on raw URL prefixes.
GitHub Advisory DatabaseFix: The JSON deserialization path has been narrowed so that revival is restricted to default-constructor reconstruction using the args/kwargs carried in the payload. The framework's own encoder has not relied on the removed behavior for produced checkpoints since the msgpack migration, so this change does not affect freshly written checkpoints. Additionally, treat checkpoint stores as integrity-sensitive by restricting write access and rotating credentials if unauthorized access is suspected, and avoid providing custom JSON revival hooks that reconstruct arbitrary types unless checkpoint data is fully trusted.
GitHub Advisory Database