First reported securityonline.info
Lead dispatch
First reported · updated · 3 reports embracethered.com
AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection
Researchers found a vulnerability (CVE-2026-10591) in AWS Kiro, an agentic IDE, where hidden instructions planted in a web page or source file that Kiro processes can trigger indirect prompt injection to rewrite Kiro's own MCP server configuration (~/.kiro/settings/mcp.json) or allowlist arbitrary Bash commands in .vscode/settings.json, achieving arbitrary code execution on the developer's machine with no approval prompt. The human-in-the-loop approval boundary is bypassed because Kiro can write to these config files without user consent, and AWS has issued a fix and CVE.indirect-prompt-injection · prompt-injection · remote-code-execution · tool-abuse · config-poisoning
ai-agents · mcp · llm · agentic-ide
Severity
0.85
The wire · latest
First reported · updated · 2 reports screetsec.com
Maland | Another Cursor 0-day Enabling Arbitrary Code Execution Beyond Git.exe
Cursor 3.0.0 patches CVE-2026-48124, a class of sandbox-to-host code execution weaknesses affecting AI coding agents including Cursor, OpenAI Codex CLI, Google Gemini CLI, and Antigravity, where files written by a sandboxed agent are later consumed and executed by trusted host tooling (extensions, task runners, Git integrations, Docker). Related research by Mindgard and others details a Windows binary-planting flaw where opening a repository auto-executes a malicious git.exe planted at the repo root, yielding zero-click arbitrary code execution with no prompt injection or model in the loop. Details →First reported ionix.io
CVE-2026-82268 – Server-Side Request Forgery (SSRF) – Qwen-Agent ≤ 0.0.34
CVE-2026-82268 is a Server-Side Request Forgery vulnerability in Qwen-Agent (versions through 0.0.34), an open-source agent framework built on the Qwen LLM family. The document parsing logic in qwen_agent/tools/simple_doc_parser.py treats caller-supplied paths as URLs without scheme restriction or host validation, letting unauthenticated remote attackers coerce the server into requesting arbitrary internal/external addresses — including cloud metadata endpoints — via the default, exposed Gradio interface. It carries a CVSS v4.0 score of 8.7 (High) with no vendor patch yet available. Details →First reported · updated · 2 reports amazon.com
CVE-2026-18655 - Broker Credential and OAuth Token Disclosure in AWS Labs Amazon MQ MCP Server via Prompt Injection
CVE-2026-18655 is a vulnerability in the AWS Labs Amazon MQ MCP Server that allows broker credential and OAuth token disclosure via prompt injection, disclosed in AWS security bulletin 2026-070-AWS and GitHub advisory GHSA-xwj6-8x5h-hjp6. An attacker can use indirect prompt injection against the MCP server to exfiltrate sensitive broker credentials and OAuth tokens. Details →First reported nist.gov
NVD-CVE-2026-75130
CVE-2026-75130 is a prompt injection vulnerability in Context7 through version 2.1.2, where its Custom AI Instructions feature served via the MCP server passes unsanitized content to connected AI coding agents. Attackers can poison the custom instructions to exfiltrate credentials from environment files to an attacker-controlled service and trigger destructive file deletion when an agent makes a routine library documentation request. Details →First reported nist.gov
NVD - CVE-2026-62676
CVE-2026-62676 is a HIGH-severity (CVSS 7.1) flaw in Omnigent, an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, the shared shell-command parser in _shell.py fails to recognize combined interpreter flags, timeout/nice/setsid/stdbuf wrappers, command substitutions, and a background control operator, so a gated git push or gh write hidden in these forms produces no parsed operation, causing the repo/branch allowlist and workspace confinement policies to abstain and allow the command. An authenticated or prompt-injected agent can push to an unauthorized repository or branch or escape the intended workspace; fixed in version 0.3.0. Details →First reported · updated · 2 reports splunk.com
SVD-2026-0808 | Splunk Vulnerability Disclosure
Splunk advisory SVD-2026-0808 discloses multiple vulnerabilities in Splunk apps including a critical (CVSS 9.1) remote code execution via untrusted-data deserialization (CVE-2026-76404) in the Splunk MCP Server app, plus several flaws in the Splunk AI Toolkit such as RCE in the Model Loading REST API (CVE-2026-76395), improper privilege management on agent run history (CVE-2026-76391), and missing authorization in container/connection management (CVE-2026-76394). Fixed versions are available for each affected app and add-on. Details →First reported · updated · 2 reports cve.org
CVE Record: CVE-2026-75845
CVE-2026-75845 is an authorization bypass in ArcadeDB's set_server_setting MCP server-level tool (versions 26.4.2 through 26.7.3). SetServerSettingTool.execute() checks only the global allowAdmin flag and never validates the caller's role, so in an MCP deployment with allowAdmin=true and a non-root allowedUsers set, any authenticated read-only user can invoke the tool to modify server GlobalConfiguration, enabling configuration tampering or denial of service. The issue is fixed in 26.8.1. Details →First reported cisa.gov
Defending Against an Active Threat to Siemens S7 Series PLCs
CISA, NSA, FBI, DOE and EPA issued advisory AA26-231A warning of an active threat targeting Siemens S7 Series PLCs in U.S. critical infrastructure using AI-generated exploitation scripts disguised as legitimate monitoring tools. The actors use internet scanning services like Censys and ZoomEye to find exposed, outdated or poorly protected PLCs, and the broader targeting extends beyond Siemens devices. Details →First reported · updated · 3 reports cisa.gov
CISA Adds One Known Exploited Vulnerability to Catalog
CISA warned that threat actors are actively exploiting CVE-2026-64849, a critical DNS-rebinding SSRF bypass in MLflow's outbound webhook delivery, and added it to its Known Exploited Vulnerabilities catalog. MLflow is a widely used open-source AI engineering platform for LLMs and agents; the flaw lets unauthenticated attackers reach the tracking server and make it issue requests to internal/loopback/cloud-metadata endpoints, enabling theft of cloud credentials such as AWS IMDS IAM credentials. The vulnerability was patched in MLflow 3.15.0. Details →First reported cisa.gov
Defending Against an Active Threat to Siemens S7 Series PLCs
Five US federal agencies (NSA, CISA, FBI, DOE, EPA) issued advisory AA26-231A warning of an active threat in which attackers use AI coding assistants together with open source industrial libraries (snap7.dll/python-snap7) to generate custom exploitation scripts disguised as legitimate OT monitoring tools against internet-exposed Siemens S7 Series PLCs at water, energy, manufacturing, and other critical facilities. The AI-generated tools provide read/write access to PLC memory, configuration, and ladder logic via the S7comm protocol, and the activity is suspected to be linked to Iran-affiliated operatives. Details →First reported · updated · 2 reports cisa.gov
CISA Adds One Known Exploited Vulnerability to Catalog
CISA added CVE-2025-62593 (CVSS 9.4), a critical flaw in Ray — the open-source, Python-native distributed computing framework used to scale AI/ML workloads — to its Known Exploited Vulnerabilities catalog after evidence of active exploitation. The bug can result in remote code execution through web browsers such as Firefox and Safari, and CISA gave federal agencies a short remediation deadline. Details →First reported vuldb.com
CVE-2026-19339 in alibabacloud-dataworks-mcp-server
CVE-2026-19339 is a server-side request forgery flaw in aliyun alibabacloud-dataworks-mcp-server up to version 1.0.43, where the ReadResourceRequestSchema function in src/resources/initResources.ts fails to validate the request.params.uri argument. The flaw is remotely exploitable without authentication (CWE-918), and the project maintainers had not responded to the initial issue report at time of disclosure. Details →First reported nist.gov
NVD - CVE-2026-44192
CVE-2026-44192 is a path-traversal flaw in the Ansible Lightspeed Model Context Protocol (MCP) server that lets an attacker manipulate an AI agent via indirect prompt injection to write files to unauthorized locations. Red Hat rates it CVSS 3.1 base 6.6 (Medium), and successful exploitation can expose sensitive host information and enable malicious command execution leading to full system compromise. Details →First reported feedly.com
CVE-2026-30623 - Exploits & Severity
CVE-2026-30623 is a critical (CVSS 9.8) OS command injection flaw in LiteLLM 1.18.10's MCP server creation feature: the application executes arbitrary command and args values supplied via JSON MCP server configuration without validation. An unauthenticated network attacker can achieve remote code execution with the privileges of the LiteLLM process; patches are available for LiteLLM and related products (DocsGPT, Flowise, Bisheng), while Windsurf and Langchain-Chatchat were reported still vulnerable. Details →First reported nist.gov
NVD - CVE-2026-70477
CVE-2026-70477 is a critical (CVSS 9.5) vulnerability in Flowise prior to 3.1.3, where a prompt injection sent to a chatflow using the CSV Agent node can cause the LLM to emit malicious Python that bypasses the blocklist validator (validatePythonCodeForDataFrame) and executes in an unsandboxed Pyodide environment. The flaw in the CSV_Agents class run method lets an attacker achieve arbitrary code execution in the context of the service account; it is fixed in version 3.1.3. Details →First reported ca.gov
CYBER ADVISORY
Cal-CSIC issued an advisory for CVE-2026-61459, a critical (CVSS 9.8) argument injection vulnerability in MCP Server Kubernetes, a component that bridges AI assistants and automated tools to Kubernetes clusters. If the MCP server is externally exposed, an attacker can send crafted requests to steal credentials, bypass security checks, inject malicious arguments, and compromise the entire cluster with potential lateral movement across clusters. A fix is available in version 3.9.0. Details →First reported cve.org
CVE Record: CVE-2026-47427
CVE-2026-47427 is a null pointer dereference denial-of-service in GitHub's official MCP Server (github-mcp-server) prior to version 1.1.0, where the CompletionsHandler in pkg/github/server.go accesses params.Ref without a nil check. A completion/complete JSON-RPC request with a missing or empty ref field triggers a Go runtime panic before any authentication, letting any unauthenticated client crash the server. The issue is fixed in version 1.1.0 (CVSS 7.5 HIGH). Details →First reported github.com
Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server · Advisory · awslabs/mcp
A vulnerability (CVE-2026-18954, GHSA-j694-4m5j-w8hc) in Amazon AWS Labs DocumentDB MCP Server lets an authenticated MCP client bypass read-only mode enforcement by submitting aggregation pipelines with write-capable stages ($out, $merge) through the aggregate tool, which fails to validate pipeline stages. The issue is fixed in version 1.0.12; a workaround is to configure the server with a read-only database user. Details →First reported · updated · 2 reports thehackernews.com
AWS, Google, and Vercel Agent Flaws Let Attackers Trigger Tools Without Running the Model
Security flaws in agent infrastructure from AWS (Bedrock AgentCore's InvokeHarness API), Google (Agent Development Kit for Python), and Vercel (AI SDK harness packages for Codex and OpenCode) allow untrusted or forged instructions to reach an agent's tools without verifying that a model turn authorized them. In several attack paths the model never ran, so system prompts, content filters, and model-level guardrails never engaged. AWS fixed the managed service, Google addressed the issues in ADK 2.5.0, and Vercel patched @ai-sdk/harness-codex 1.0.29 and @ai-sdk/harness-opencode 1.0.28. Details →First reported · updated · 4 reports cve.org
IBM's agentic AI platform is under active attack - patch now
A critical vulnerability, CVE-2026-9198, in IBM-owned low-code AI agent builder Langflow lets unauthenticated attackers achieve remote code execution on default deployments by chaining an auto-login endpoint that mints superuser tokens with a code-validation endpoint that runs arbitrary Python. CISA added it to its Known Exploited Vulnerabilities catalog after confirming active exploitation; IBM says Langflow OSS 1.0.0 through 1.10.0 are affected and urges upgrading to 1.10.1 or later. Sysdig telemetry documents in-the-wild attack chains (including related CVE-2026-33017 RCE and CVE-2026-55255 IDOR) that probe /api/v1/auto_login, enumerate flows, and deliver second-stage loaders. Details →First reported oasis.security
Paperclip AI Flaws Let Attackers Run Host Commands via Malicious Agent Imports
Two flaws in Paperclip, an open-source control plane for teams of AI agents, let attackers execute host commands by importing and starting a malicious agent. The server-side path CVE-2026-41679 (CVSS 10.0) needs no account or victim interaction against authenticated deployments with default registration, while GHSA-x8hx-rhr2-9rf7 (CVSS 9.6) triggers when a user opens an attacker-controlled page in default local_trusted mode; a third flaw exposed sensitive data via API routes lacking access checks. Version v2026.416.0 adds import-authorization and hostname-validation fixes. Details →First reported corgea.com
CVE-2026-55607 vulnerability: npm/@anthropic-ai/cl…
CVE-2026-55607 is a vulnerability affecting the npm package @anthropic-ai/claude-code, Anthropic's AI coding agent, tracked via GitHub Security Advisory GHSA-7835-87q9-rgvv and NVD, with a fix referenced in the v2.1.163 release. The Corgea page is an advisory catalog entry pointing to the upstream advisory and NVD record. Details →First reported · updated · 2 reports zafran.io
Hugging Face Diffusers Flaws Could Let Model Repositories Execute Arbitrary Code
Zafran Labs disclosed three high-severity flaws, collectively named FaceHugger, in Hugging Face's Diffusers library (CVE-2026-44827 CVSS 8.8, CVE-2026-45804 CVSS 7.5, and CVE-2026-44513 CVSS 8.8) that let a malicious model repository silently execute arbitrary code on any machine loading it. The flaws stem from a Time-of-Check to Time-of-Use race that bypasses the trust_remote_code safeguard by splitting a model download into two non-atomic HTTP requests, so a routine model load becomes an initial-access vector across CI/CD, container, and production pipelines. Details →First reported nist.gov
NVD - cve-2024-5184
CVE-2024-5184 is a prompt injection vulnerability in the EmailGPT service, whose API allows a malicious user to inject a direct prompt and take over the service logic. Attackers can force the AI service to leak hard-coded system prompts or execute unwanted prompts, and the flaw can be exploited by anyone with access to the service (CVSS 3.x base 9.1 CRITICAL per NIST). Details →First reported redhat.com
CVE-2026-49468 - Red Hat Customer Portal
CVE-2026-49468 is an Important-severity (CVSS 8.1) authentication-bypass flaw in LiteLLM, a proxy server (AI Gateway) used to call LLM APIs. A remote attacker sending a crafted Host header can bypass the proxy authentication layer to gain unauthenticated access to protected management routes, potentially leading to full system compromise. The issue is fixed in LiteLLM v1.84.0 (GHSA-4xpc-pv4p-pm3w), and Red Hat notes its default images do not start the vulnerable proxy. Details →First reported redhat.com
CVE-2026-12112 - Red Hat Customer Portal
CVE-2026-12112 is a session management flaw in the foreman-mcp-server (MCP Server) shipped with Red Hat Satellite 6.18 and 6.19, where unauthenticated attackers can hijack active administrative sessions because the server caches authenticated client connections and trusts a non-secret session ID without re-validating authentication tokens, while also logging newly created session IDs to standard logs. Rated 7.8 CVSS v3 (Important), it can lead to privilege escalation and infrastructure-wide code execution; Red Hat has issued fixes via RHSA-2026:28405 and RHSA-2026:28438. Details →First reported gitlab.com
LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback | GitLab Advisory Database (GLAD)
CVE-2026-59822 is an authentication bypass in LiteLLM's MCP Streamable HTTP endpoint, where the OAuth2 passthrough fallback path replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object. An unauthenticated attacker could supply an arbitrary/fabricated Bearer token to establish an authenticated MCP session, then list and call configured MCP tools and access connected services. The issue is fixed in LiteLLM v1.84.0. Details →First reported vuldb.com
CVE-2026-7755 IBM Langflow MCP Server Configuration input validation
CVE-2026-7755 is a critical (CVSS 10.0) input-validation vulnerability in IBM Langflow OSS 1.0.0 through 1.10.0 that could allow unauthenticated remote code execution due to incomplete validation enforcement on MCP server configuration files. The flaw affects the MCP Server Configuration component and can be exploited remotely without authentication; no public exploit is currently available. Details →First reported undercodetesting.com
Code Under Siege: New Vulnerabilities Turn AI Coding Assistants Into Hackers' Gateways + Video
Check Point Research disclosed critical vulnerabilities (CVE-2025-59536, CVE-2026-21852, CVSS 8.7) in agentic AI coding assistants like Anthropic's Claude Code that allow malicious repositories to weaponize the tool against its users. Through configuration files (.settings.json, .mcp.json), MCP hooks, and environment variables such as ANTHROPIC_BASE_URL, attackers can achieve consent-bypass arbitrary code execution and API key theft simply by getting a developer to open an untrusted project. Details →First reported nist.gov
NVD - CVE-2026-61439
CVE-2026-61439 affects PraisonAI versions before 4.6.78, where a prompt injection defense misconfiguration defaults the block threshold to CRITICAL severity, letting HIGH-level threats pass unblocked. Attackers can submit single-vector prompt injection attacks such as instruction overrides or financial manipulation to achieve system prompt extraction and unauthorized tool invocations; VulnCheck rates it CVSS 8.7 HIGH and a fix is available in 4.6.78. Details →First reported nist.gov
NVD - CVE-2026-57300
CVE-2026-57300 is a missing permission check in the Jenkins MCP Server Plugin (version 0.177.v629fdb_2557fe and earlier) that allows attackers with Item/Read permission to read the Pipeline replay scripts of jobs they can access. CISA-ADP scored it CVSS 3.1 4.3 (Medium), and a Jenkins security advisory dated 2026-06-24 addresses the flaw. Details →First reported github.com
AI Agents Project Viewer Privilege Escalation via run_node_tool · Advisory · n8n-io/n8n
A GitHub Security Advisory (GHSA-x5vx-c2c8-m3w9) for n8n discloses a privilege-escalation flaw in its AI Agents feature: a read-only Project Viewer could chat with an agent whose node tools were enabled and, via the run_node_tool authorized only by the agent:execute scope, execute arbitrary tool nodes using the project's credentials without authorization checks. Where command- or file-capable nodes (Execute Command, SSH) are enabled, this could extend to arbitrary command execution on the n8n host. The issue is fixed in n8n versions 2.29.8 and 2.30.1. Details →First reported · updated · 2 reports cyera.com
Ollama Out-of-Bounds Read Vulnerability Allows Remote Process Memory Leak
Cyera researchers disclosed CVE-2026-7482 ("Bleeding Llama", CVSS 9.1), a heap out-of-bounds read in Ollama's GGUF model loader that lets a remote, unauthenticated attacker leak the entire process memory of an Ollama server. The flaw is fixed in Ollama 0.17.1 and is estimated to affect over 300,000 exposed servers globally. Details →First reported nist.gov
NVD - CVE-2026-30741
CVE-2026-30741 is a remote code execution vulnerability in OpenClaw Agent Platform v2026.2.6 that allows attackers to execute arbitrary code via a request-side prompt injection attack. CISA-ADP rated it CVSS 3.1 base 9.8 (Critical), classified as CWE-94 code injection, with public exploit references including a GitHub PoC repository. Details →First reported strobes.co
CVE-2026-23744 - CVE Details, Severity, and Analysis | Strobes VI
CVE-2026-23744 is a critical (CVSS 9.8) remote code execution vulnerability in MCPJam Inspector versions 1.4.2 and earlier, a local-first development platform for MCP servers. Because the tool binds to 0.0.0.0 and its /api/mcp/connect endpoint extracts command and args without security checks, an attacker can send a crafted, unauthenticated HTTP request to trigger arbitrary command execution with no user interaction; public PoCs and vendor patches are available. Details →First reported nist.gov
NVD - CVE-2026-59819
CVE-2026-59819 is a vulnerability in LiteLLM, an AI gateway/proxy for calling LLM APIs, where prior to version 1.83.10-stable the /health/test_connection endpoint resolved request-supplied environment and OIDC file references in litellm_params, allowing a privileged caller to read arbitrary local files via an oidc/file/ reference (CWE-73). The issue is fixed in version 1.83.10-stable. Details →First reported darkreading.com
DifyTap Bugs Let Attackers 'Wiretap' AI Chat Histories
Four vulnerabilities dubbed 'DifyTap' in Dify, a platform for building and managing AI applications, allow attackers to silently access and exfiltrate sensitive data, including AI chat histories. Details →First reported arstechnica.com
Millions of AI agents imperiled by critical vulnerability in open source package
A critical authentication-bypass vulnerability (CVE-2026-48710, dubbed BadHost) in the Starlette framework lets a single character injected into the HTTP Host header bypass path-based authorization. Because Starlette underpins FastAPI, vLLM, LiteLLM, and many MCP servers and agent harnesses, the flaw exposes millions of AI agents and their stored third-party credentials and sensitive data to trivial exploitation. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector