Advisories
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
3,134 items
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a flaw in which special elements used in code are not properly neutralized. A remote authenticated attacker could exploit this to execute arbitrary code.
Agno through 3.1.11 contains an unsafe reflection flaw in PandasTools. Model-controlled function names passed to getattr() let attackers invoke arbitrary pandas functions. Through prompt injection, an attacker can make the agent call pandas.read_pickle on attacker-controlled paths for code execution, or call other readers to read local files.
`langgraph deploy --verbose` in `langgraph-cli` 0.4.15 through 0.4.31 printed the temporary registry push token that the CLI passes to `docker login --password-stdin`. Anyone who could read that output, such as CI logs, could use the token for up to 12 hours, limited to the deployment's image repository, to pull images and push new ones.
Fix: Upgrade to `langgraph-cli` 0.4.32 or later. 0.4.37 also stops `--verbose` from printing the input of any command the CLI runs. Tokens printed more than 12 hours ago have expired.
LangGraph deployments using JavaScript or TypeScript custom authentication may fail to apply Store authorization changes returned by an authorization handler. An authenticated user may then read, overwrite, search, or delete another user's Store data, provided the handler relies on namespace rewriting and multiple users' data is stored through that path.
Fix: Fixed in langgraph-api version 0.15.0; users should upgrade to langgraph-api>=0.15.0. Deployments that cannot upgrade immediately should change JavaScript or TypeScript Store authorization handlers to reject requests for unauthorized namespaces rather than rewriting them, applied to every Store action the deployment exposes.
The LangGraph Python SDK v3 streaming client, in `langgraph-sdk` versions 0.4.0 through 0.4.5, inserts caller-supplied `thread_id` and `assistant_id` values into request paths without encoding them, in the `get_tree` and `_fetch_state` implementations. Relative path segments in these values can redirect an authenticated GET request to another readable path on the configured server, and the SDK returns that response to the application. `RemoteGraph` v3 streaming in `langgraph` 1.2.3 and later is also affected when it pairs with a vulnerable SDK version.
CVE-2026-117574 is a flaw in ai-gateway-payload-processing. An authenticated remote attacker can submit a request naming another tenant's model identifier in the request body or header. Because the service does not verify authorization before retrieving credentials from the shared store, it injects the target tenant's API keys into the request, letting the attacker consume that tenant's LLM resources and quotas.
CVE-2026-115415 affects the environment tool in Strands Agents Tools, versions >= 0.1.0 and < 0.8.6. The tool accepted a masking parameter from the LLM through its tool schema, so a crafted prompt in content the agent processes could turn masking off and return the host's environment variables in cleartext, including cloud credentials and API keys, without operator consent.
Fix: Fixed in 0.8.6 or later. Refer to AWS Security Bulletin 2026-154-AWS for the most up-to-date and complete information.
AWS Security BulletinsTelerik Document Processing Libraries before version 2026.3.1027 contain a path traversal flaw (CVE-2026-118038) in the Convert and Merge AI agent tools. An authenticated attacker with low privileges who can supply tool arguments can read files outside the configured output directory and overwrite them where writable, using relative paths resolved against the process current working directory.
Fix: Fixed in version 2026.3.1027 or later.
The AI ChatBot for WooCommerce – WoowBot plugin for WordPress, in all versions up to and including 5.0.0, fails to verify that a user is authorized to perform an action. Authenticated attackers with subscriber-level access or above can repeatedly trigger RAG document sync operations, which issue paid embedding API calls to OpenAI, Gemini, OpenRouter, or xAI charged to the site administrator's stored API key. The wp_chatbot nonce needed to reach this endpoint is emitted to every authenticated frontend visitor via wp_localize_script, so any subscriber-level account can obtain it.
The Bit Flows AI Agent Automation plugin for WordPress, in all versions up to and including 1.31.0, has a Local File Inclusion flaw in the 'image' parameter, which maps to any body field referenced by the ImageHelper node's mix tag. Unauthenticated attackers can include and execute arbitrary .php files on the server, enabling code execution, access control bypass, or sensitive data access. Exploitation requires an administrator to have built a webhook-triggered flow piping a body field into an ImageHelper imageToBase64 node, with the webhook left in its default configuration (no bearer secret, no IP allowlist).
Tabularis versions before 0.28.0 contain an SQL injection flaw in their SQLite driver, tracked as CVE-2026-118378. A crafted table_name supplied to the describe_table tool lets MCP clients run stacked statements by closing the quoted PRAGMA argument. An attacker, including an AI agent steered by untrusted content, can read, modify, or drop SQLite data while bypassing read-only mode and write approval.
MLflow tracking servers running without authentication, the default for mlflow server, let a remote attacker read arbitrary files from the server's filesystem. The prompt branch of CreateModelVersion stores schemeless local paths such as ../../etc unchanged, and the model-versions/get-artifact endpoint later serves files from them with the server process's privileges. Servers using --app-name basic-auth are also affected, since any authenticated user can exploit this to read the authentication database, including the admin password hash.
MLflow's `mlflow.crewai.autolog()` serializes a CrewAI `Agent.__dict__` into span attributes, and the `llm` field's string form includes its `api_key` in plaintext. Applications using autologging can therefore send LLM provider API keys to the MLflow trace backend or configured OTLP destination without explicitly logging them. The issue was verified on MLflow 3.16.0 with CrewAI 1.15.18.
MLflow 3.12.0 added registration and deserialization support for third-party scorers. On the default no-auth server, an unauthenticated HTTP caller can chain experiment, run, and artifact-upload endpoints with the scorer invoke endpoint to import an uploaded Python module and run arbitrary code with the privileges of the MLflow server process. The official v3.14.0 image runs that process as uid 0.
The MCP Python SDK's server-side bearer authentication did not check that a token was issued for the receiving server (its audience). Where one authorization server issues tokens for several services, a valid token for another service was accepted by the MCP server. Affected versions are mcp 1.10.0 through 1.29.1 and 2.0.0 through 2.1.1.
Fix: Upgrade to mcp 1.30.0 or later (1.x) or mcp 2.2.0 or later (2.x), then set validate_token_resource=True in AuthSettings with resource_server_url set to the audience the authorization server puts in tokens, and return the token's audience from verify_token() as AccessToken.resource. Upgrading alone changes nothing. If your TokenVerifier already checks the audience, set validate_token_resource=False to silence the deprecation warning. If you cannot upgrade yet, reject any token whose aud does not include your server inside verify_token().
The Model Context Protocol Python SDK's Streamable HTTP and SSE client transports, and its OAuth client providers, followed HTTP redirects to any host. Custom headers such as an X-API-Key credential were sent to the redirect target, and on 307 or 308 redirects the request body was re-sent too, while a lone Authorization bearer header was dropped by the HTTP library. Affected versions are 1.8.0 through 1.29.1 and 2.0.0 through 2.1.1, and exploitation requires a trusted endpoint to redirect to a different origin.
The Model Context Protocol Python SDK's client validated tool results against server-declared outputSchema using jsonschema's default resolver, which fetched any unresolved $ref by opening the URL. A malicious server could make the client request http, https or file URLs from its own network position on every call, and because the fetch ran synchronously with no timeout, a target that stalled would freeze all sessions in the process. Affected versions are 1.10.0 through 1.29.1 and 2.0.0 through 2.1.1, for applications that use the SDK as a client.
Affected versions of the MCP TypeScript SDK put no limit on the size of HTTP POST bodies or on the number of messages in a JSON-RPC batch, so large requests can exhaust server memory and a long batch can block other clients. Exploitation needs no credentials unless the application authenticates requests before they reach the SDK, and stdio-only servers are not affected.
Fix: Upgrade @modelcontextprotocol/sdk to 1.30.1 or later for 1.x, and to @modelcontextprotocol/server 2.1.0, @modelcontextprotocol/node 2.1.0 and @modelcontextprotocol/hono 2.0.1 or later for 2.x, upgrading every installed package. Bodies over 4 MiB now get 413 and batches over 100 messages get 400; raise the maxRequestBodySize option if clients send larger bodies. If upgrading is not possible yet, cap request body size in a reverse proxy.
Hydra's legacy target blacklist omits PyYAML's unsafe loading functions, so an application that passes attacker-controlled targets and arguments to instantiate() can let yaml.unsafe_load run Python code from a config-controlled YAML stream. The attacker must control the target and arguments, and the callable runs with the application's process privileges; the affected ranges are hydra-core 1.3.6 through 1.3.7 and the 1.4 prerelease legacy path (1.4.0.dev9, 1.4.0.dev10, 1.4.0rc1, 1.4.0rc2).
Fix: The fix blocks the yaml. target namespace except for yaml.safe_load, yaml.safe_load_all, yaml.safe_dump, and yaml.safe_dump_all. Workarounds: do not pass untrusted configuration to instantiate() or call(), and for Hydra 1.4 supply a narrow execution whitelist from trusted Python code.
The default FileSessionManager in Strands Agents stores session data in the world-writable /tmp/strands/sessions/ directory. Its write routine (open(path + ".tmp", "w") followed by os.replace()) follows symbolic links, so a local attacker can redirect writes to arbitrary files, such as shell configs or SSH keys, or inject crafted session data that the agent later loads without integrity checks.
Fix: The source suggests: use a user-private default directory such as ~/.strands/sessions/ or $XDG_DATA_HOME/strands/sessions/; open files with os.open() using O_NOFOLLOW | O_CREAT | O_WRONLY; use tempfile.mkstemp() for atomic writes; verify directory ownership matches the current user before writing; and add optional HMAC integrity verification on session files.
Fix: Upgrade `langgraph-sdk` to version 0.4.6 or later. If you use `RemoteGraph`, also upgrade `langgraph` to version 1.2.14 or later, which requires `langgraph-sdk>=0.4.6`.
Fix: Fixed in 3.17.0 by mlflow/mlflow#25870, which accepts only MLflow's own placeholder sources for prompt versions and requires the prompt tag to be true.
Fix: Upgrade to mcp 1.30.0 (1.x) or 2.2.0 (2.x) or later; no code changes are needed. Until upgrading, supply your own HTTP client with follow_redirects left at False (http_client= on streamable_http_client; httpx_client_factory= on sse_client and streamablehttp_client), and rotate any credentials a client may have sent to a host you do not control.
Fix: Fixed in mcp 1.30.0 (1.x) and 2.2.0 (2.x). The client now resolves references only within the server-sent schema document plus the standard JSON Schema metaschemas. Until upgrading, call tools only on trusted servers. As a partial stopgap, skip tools whose outputSchema contains an $id, or a $ref or $dynamicRef that does not start with #.