Advisories

Strands Agents SDK, shipped as strands-agents for Python and @strands-agents/sdk for TypeScript, shares conversation history across callers with different context_id values in the Agent2Agent (A2A) server under certain circumstances. An authenticated remote user in a multi-tenant deployment can read another caller's conversation history or influence model behavior for that caller (CWE-488). Affected versions are strands-agents below 1.43.0 for Python and @strands-agents/sdk below 1.5.0 for TypeScript.

CVE-2026-57208 affects Entire CLI before version 0.7.7, a tool that hooks into Git workflows to capture AI agent sessions. An attacker with push access to the checkpoints repository can craft checkpoint metadata whose SessionID field is used unvalidated to build filesystem paths in the entire session resume or entire checkpoint rewind restore path, causing attacker-controlled transcript data to be written outside the expected session directory and potentially overwriting arbitrary files on the victim's machine.

Improper certificate validation in the WebSocket streaming client of agentjido req_llm lets an on-path attacker read and modify OpenAI WebSocket sessions, including the authorization bearer token, when the client accepts an untrusted TLS certificate. ReqLLM.Streaming.WebSocketSession.Client.start/3 starts WebSockex without TLS options, so it defaults to verify: :verify_none, and the option allowlist drops caller-supplied cacerts or ssl_options. The OpenAI Responses, Realtime, and Codex WebSocket paths are affected, while HTTP streaming through Finch and the HTTP/2 session through Mint are not. Versions 1.9.0 before 1.29.0 are affected.

CVE-2026-115419 affects the Agent2Agent (A2A) server component of the Strands Agents SDK, which exposes an agent over HTTP. The A2A server did not properly isolate conversation state between callers, so an authenticated remote user could access another caller's conversation history or influence model behavior for other callers in multi-tenant deployments. Impacted versions are strands-agents (Python) containing the multiagent.a2a module below 1.43.0, and @strands-agents/sdk (TypeScript) below 1.5.0.

Flexible GraphRAG versions 0.6.0 through 0.8.2 contain a Cypher injection flaw (CVE-2026-114510) in the _escape() helper of flexible-graphrag/langchain/graph/pg_store_adapters/falkordb_adapter.py. Escaping quotes before backslashes lets an inserted escape be doubled and a quote end the string early. With GRAPH_BACKEND=langchain and GRAPH_DB=falkordb, attacker-influenced document content can make the extraction model emit malicious entity or relationship values that reach these queries, enabling modification or deletion of graph data and, where results are surfaced to users or an LLM, disclosure of graph data.

CVE-2026-108456 is an elevation of privilege vulnerability in Azure AI Foundry. Server-side request forgery (SSRF) in the product allows an authorized attacker to elevate privileges over a network.

When the terminal integration feature is enabled in Goose, the application captures shell command history and sends it verbatim, without sanitization, to configured LLM provider endpoints during queries. Secrets a user types in the terminal, such as API tokens, passwords, or environment variables, are transmitted unredacted across trust boundaries, exposing them to external providers and logs.

CVE-2026-112408 affects the default_bucket() function in the Amazon SageMaker Python SDK, which uses a predictably named S3 bucket without checking that the caller's AWS account owns it. A remote actor who creates that bucket first could achieve code execution in a remote SageMaker execution environment and obtain IAM credentials. Impacted versions are V2 before 2.257.3 and V3 from 3.0.0 before 3.10.0.

CVE-2026-92206 is a remote code execution flaw in CrewAI crewAI, affecting installations that load agent configurations. The specific flaw exists in the load_agent_from_repository function, which does not properly restrict a user-supplied argument before using it to import a module. An attacker can exploit this by getting the target to load a malicious agent configuration from the repository, executing code in the context of the service account.

HKUDS Vibe-Trading versions from 0.1.0 before 0.1.7 are affected by an indirect prompt injection flaw tracked as CVE-2026-114107. Remote attackers can plant instructions in documents or web pages the agent processes, causing shell commands to run as root. BashTool and BackgroundRunTool pass model-emitted commands to subprocess.run with shell=True and no allow-list or approval step, and read_url fetches arbitrary URLs, which also enables server-side request forgery.

vLLM versions from 0.7.3 before 0.31.0 contain CVE-2026-114055, an uncontrolled resource consumption flaw. Remote clients can supply per-request mm_processor_kwargs to set large image size, patch count, crop count, or frame count values in the Isaac, InternVL, H2OVL, and other multimodal processors. This exhausts memory and terminates the shared server.

vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting clients choose which revision of a model's dynamic processor code is imported when trust_remote_code is enabled. An attacker who controls a revision in the served model repository can send a multimodal request to the unauthenticated /tokenize endpoint and execute arbitrary Python in the vLLM API process.

vLLM versions after 0.24.0 and before 0.31.0 contain a memory exhaustion flaw (CVE-2026-114052) in MOSS-Audio model serving. The component caches a processor for every distinct request-controlled mm_processor_kwargs value in an unbounded dictionary, so unauthenticated attackers can send distinct or oversized mel_config values to the /tokenize endpoint, which bypasses --api-key, to exhaust host memory and crash the API process.

vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests when max_tokens is null. The EngineCore input thread then dies on an uncaught VLLMValidationError, while /health still returns 200. An unauthenticated remote attacker can send one request with an oversized min_tokens to hang all later generation requests until a manual restart.

vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity, with no consistency check on cache hits. Unauthenticated attackers can desynchronize the P0/P1 processor caches to trigger a fatal token-placeholder mismatch, crashing the entire serving instance until it is restarted.