VulnWatch VulnWatch
← All articles
Weekly digest · Jun 1, 2026

VulnWatch Weekly: Agentic RCE Epidemic & MCP Trust Boundaries Collapse

78 vulnerabilities tracked this week. PraisonAI, SillyTavern, and MCP servers dominate critical RCE reports. Immediate patching required for agent frameworks.

Prompt Injection Remote Code Execution Data Leakage Auth Bypass SSRF Agentic / MCP

Week in Review: May 25–31, 2026

This week marks a watershed moment for AI application security, characterized by a cascade of critical remote code execution (RCE) vulnerabilities across the emerging agentic stack. The dominant theme is the fragility of trust boundaries in Model Context Protocol (MCP) servers and AI agent frameworks, with PraisonAI, SillyTavern, and RAGFlow issuing urgent patches for flaws that allow unauthenticated attackers to compromise host systems. The single most urgent item is the series of sandbox escapes in PraisonAI (GHSA-4mr5-g6f9-cfrh), which demonstrates that even subprocess isolation can be defeated via Python introspection tricks, rendering default deployments critically unsafe.

Top Items of the Week

The following entries represent the highest risk to AI infrastructure based on CVSS severity, exploitability, and prevalence of the affected components.

  1. GHSA-4mr5-g6f9-cfrh (PraisonAI Sandbox Escape)
    Severity: Critical (9.9) | Component: execute_code tool
    Impact: Full host RCE via print.__self__ builtins leak in subprocess mode.
    Action: Upgrade to v1.6.38+ and disable execute_code if not strictly required. View Advisory

  2. CVE-2026-45312 (RAGFlow SSTI)
    Severity: Critical (9.9) | Component: Prompt Generator
    Impact: Jinja2 template injection allows any authenticated user to execute OS commands.
    Action: Patch to v0.24.1+ and audit custom prompt templates for user input. View Advisory

  3. CVE-2026-44450 (Lumiverse MCP RCE)
    Severity: Critical (9.9) | Component: MCP Server Creation
    Impact: Allowlist bypass via inline-code flags (-e, -c) grants arbitrary code execution.
    Action: Upgrade to v0.9.7+ and restrict MCP server creation to admins. View Advisory

  4. GHSA-vg22-4gmj-prxw (PraisonAI A2A Unauthenticated RCE)
    Severity: Critical (9.8) | Component: A2A Server Example
    Impact: Default example binds to 0.0.0.0 with no auth and exposes eval() tool.
    Action: Do not run example code in production; enforce auth tokens immediately. View Advisory

  5. CVE-2026-44649 (SillyTavern Header Auth Bypass)
    Severity: Critical (9.8) | Component: Authentication Middleware
    Impact: Injection of Remote-User headers allows login as any user without password.
    Action: Upgrade to v1.18.0+ and ensure reverse proxy header stripping is configured. View Advisory

  6. GHSA-mxfr-6hcw-j9rq (Langroid SQLi to RCE)
    Severity: Critical (9.8) | Component: SQLChatAgent
    Impact: Prompt injection leads to SQLi, leveraging DB privileges for OS command execution.
    Action: Restrict database roles for agents and upgrade to v0.63.0+. View Advisory

  7. CVE-2026-44895 (GitLab MCP No Auth)
    Severity: Critical (9.2) | Component: HTTP Transport
    Impact: Wildcard CORS and no inbound auth expose GitLab PAT to any browser context.
    Action: Upgrade to v0.6.0+ and restrict network access to MCP ports. View Advisory

  8. CVE-2026-4944 (vLLM Trust Remote Code)
    Severity: High (8.8) | Component: Model Loader
    Impact: Hardcoded trust_remote_code=True bypasses user settings, enabling malicious model RCE.
    Action: Upgrade to v0.14.2+ and audit loaded model repositories. View Advisory

  9. CVE-2026-45374 (CodeWhale Auto Shell Access)
    Severity: Critical (9.6) | Component: Task Manager
    Impact: Sub-agents inherit allow_shell=true and auto_approve=true by default.
    Action: Upgrade to v0.8.26+ and explicitly disable shell access in agent configs. View Advisory

  10. CVE-2026-44346 (BentoML Dockerfile Injection)
    Severity: High (8.8) | Component: Containerize Build
    Impact: Newline injection in bentofile.yaml smuggles RUN directives into Docker build.
    Action: Upgrade to v1.4.39+ and validate YAML inputs before building. View Advisory

The PraisonAI Crisis: Agent Frameworks as Attack Vectors

PraisonAI dominates this week's critical findings with at least five distinct high-severity advisories. The most technically sophisticated is GHSA-4mr5-g6f9-cfrh, where researchers demonstrated a novel bypass of the subprocess sandbox. By accessing print.__self__, an attacker can retrieve the real Python builtins module, extract __import__ via vars(), and construct arbitrary imports at runtime. This defeats the isolation intended to protect the host from agent code execution.

Compounding this is GHSA-vg22-4gmj-prxw, which highlights the danger of shipping "quickstart" examples with production-grade risks. The official A2A server example binds to all interfaces (0.0.0.0) without authentication and registers a calculate tool backed by Python's eval(). In an era where AI agents are increasingly internet-facing, shipping unauthenticated eval gates is tantamount to leaving the server room door open. Teams using PraisonAI must assume their current deployments are compromised if exposed to untrusted networks and should rotate all API keys and credentials stored in the environment immediately.

MCP Server Meltdown: Trust Boundaries Collapse

The Model Context Protocol (MCP) is rapidly becoming the standard for connecting AI agents to external tools, but this week's vulnerabilities reveal a systemic failure to enforce trust boundaries. CVE-2026-44450 in Lumiverse shows that validating binary names is insufficient if argument arrays are forwarded unchecked; attackers simply pass inline execution flags (e.g., python3 -c) to achieve RCE. Similarly, CVE-2026-44895 in the GitLab MCP Server exposes a stateful RPC endpoint backed by a Personal Access Token without any inbound authentication, compounded by a wildcard CORS policy.

This pattern repeats in CVE-2026-45707 (n8n-MCP), where tenant isolation fails, allowing one tenant to execute management calls against the operator's instance. The lesson for platform teams is clear: MCP servers must be treated as privileged infrastructure. They should never bind to public interfaces without strict mTLS or OAuth enforcement, and argument validation must be semantic, not just syntactic.

Local LLM UIs Under Fire: The SillyTavern Spree

SillyTavern, a popular local interface for LLM interaction, issued a bulk patch (v1.18.0) addressing a wide array of critical flaws. CVE-2026-44649 is particularly severe, allowing header injection to bypass authentication entirely if SSO headers are trusted without verification. Additionally, CVE-2026-44650 permits directory traversal to delete the entire extensions folder via a . parameter, and CVE-2026-46372 enables SSRF through an unvalidated baseUrl parameter.

These vulnerabilities underscore the risk of "local-first" AI tools that are increasingly connected to the web. Users often expose these interfaces to their local network for convenience, assuming isolation provides security. This week proves that assumption false; local UIs require the same hardening as public SaaS applications, including strict input validation and session management.

Supply Chain & Inference: Model Loading Risks

The supply chain remains a potent attack surface. CVE-2026-4944 in vLLM reveals that trust_remote_code=True was hardcoded in specific model implementation files (nemotron_vl.py, kimi_k25.py), bypassing user CLI flags. This is a recurrence of issues seen in CVE-2025-66448, indicating that incomplete fixes in model loaders continue to pose risks. When loading models from HuggingFace, the code accompanying the weights is executed with the privileges of the inference server.

BentoML also faces critical issues (CVE-2026-44346/45) where malicious bentofile.yaml configurations can inject Dockerfile directives during the containerization process. This shifts the attack vector from runtime to build time, potentially poisoning the deployment pipeline. Security teams must scan configuration files for newline characters and unescaped variables before triggering build processes.

Coding Agents Gone Rogue

Autonomous coding agents introduce unique risks by design. CVE-2026-45374 and CVE-2026-45311 in CodeWhale highlight the danger of default permissions. The task_create tool spawns sub-agents with allow_shell=true and auto_approve=true, meaning a single user approval can grant an agent unrestricted shell access. Similarly, run_tests auto-approves cargo test, which executes arbitrary build scripts. Langroid's GHSA-mxfr-6hcw-j9rq further demonstrates how prompt injection can cascade into SQL injection and eventually RCE if the database user has high privileges. Developers must adopt the principle of least privilege for agent tools, explicitly disabling shell access and requiring approval for every distinct action.

Infrastructure & Dependency Noise

Beyond the AI-specific stack, this week saw a flood of legacy vulnerabilities. A significant cluster of CVEs (CVE-2026-10183 through CVE-2026-10060) affects TRENDnet TEW-432BRP routers. These devices have been End-of-Life since 2009, and the vendor explicitly states they cannot fix these stack-based buffer overflows. While not AI-specific, these devices often sit at the network perimeter; if your infrastructure still relies on them, they represent an immediate, unpatchable risk that requires hardware replacement.

Additionally, several Symfony vulnerabilities (GHSA-6439-2f28-8p8q, GHSA-j8gj-9rm5-4xhx) were published. While these are web framework issues, many AI applications (including some MCP servers) are built on Symfony. The HEAD request bypass and CAS service URL derivation flaws could allow authentication bypasses in AI admin panels built with this framework. Teams should audit their web dependencies alongside their ML libraries.

Known Exploitation Status

As of this writing, no entries in this week's digest are marked as known-exploited (is_exploited=true). However, the technical simplicity of several flaws—particularly the header injection in SillyTavern and the unauthenticated eval in PraisonAI—suggests that weaponization is trivial. The absence of public exploit code should not be interpreted as safety; it is more likely a reflection of the recency of disclosure. Security teams should operate under the assumption that active scanning for these vulnerabilities is already underway.

What to Do This Week

  1. Patch Agent Frameworks Immediately: Prioritize updates for PraisonAI, CodeWhale, and Langroid. If patching is not immediately possible, disable any tools that allow code execution (execute_code, eval, shell) in your agent configurations.
  2. Audit MCP Servers: Inventory all MCP servers running in your environment. Ensure none are binding to 0.0.0.0 without authentication. Implement network segmentation to isolate MCP traffic from untrusted clients.
  3. Harden Local UIs: For SillyTavern and similar tools, enforce strict reverse proxy configurations that strip incoming Remote-User or X-Authentik-Username headers. Do not expose these ports directly to the LAN.
  4. Review Model Sources: Audit your vLLM and HuggingFace pipelines. Ensure trust_remote_code is explicitly set to False wherever possible, and pin specific model commits rather than using floating tags.
  5. Replace Legacy Hardware: If the TRENDnet router vulnerabilities apply to your network perimeter, initiate hardware replacement immediately. These devices cannot be secured.

What to Watch Next Week

Next week, we anticipate further scrutiny on the Model Context Protocol (MCP) specification itself. With multiple servers failing to implement basic auth and SSRF protections, expect the MCP maintainers to release updated security guidelines or a reference implementation with stricter defaults. Additionally, keep an eye on RAG pipelines; with the RAGFlow SSTI vulnerability, we expect researchers to probe other RAG orchestration layers for similar template injection flaws. Finally, monitor AI supply chain registries for new malicious model uploads leveraging the vLLM trust bypass.

Covered entries (78)