VulnWatch VulnWatch
← All articles
Weekly digest · Jun 15, 2026

MCP Meltdown & Flowise Flood: Critical AI Infra Vulnerabilities Surge

Critical MCP auth bypasses and Flowise RCEs dominate this week. LiteLLM command injection is actively exploited. ChromaDB and vLLM also ship high-severity patches. Immediate action required on agent frameworks.

Remote Code Execution Model Poisoning Auth Bypass SSRF API Abuse Agentic / MCP

Week in Review: June 8–14, 2026

This week marks a significant escalation in infrastructure-level risks for AI deployment platforms, characterized by a cluster of critical vulnerabilities in the Model Context Protocol (MCP) ecosystem and widespread authorization failures in low-code LLM orchestration tools. The single most urgent item is CVE-2026-42271 in BerriAI LiteLLM, which is now confirmed as actively exploited in the wild, allowing authenticated users to execute arbitrary commands on the host. Security teams must prioritize patching LiteLLM instances immediately while simultaneously auditing MCP server configurations for DNS rebinding and tool execution bypasses that could compromise agent boundaries.

Top Items of the Week

The following vulnerabilities represent the highest impact risks identified between June 8 and June 14, 2026. They are ranked by a combination of CVSS severity, exploitability, and potential business impact.

  1. CVE-2026-42271 (BerriAI LiteLLM)

    • Severity: High (CVSS 8.7) | Status: KNOWN EXPLOITED
    • Component: LiteLLM Proxy
    • Impact: Command Injection allowing arbitrary host command execution by authenticated users.
    • Action: Upgrade to the latest patched version immediately and rotate all API keys.
    • Source: CISA KEV

  2. CVE-2026-46442 (Flowise)

    • Severity: Critical (CVSS 9.4)
    • Component: Flowise Custom JS Function Node
    • Impact: Authenticated Remote Code Execution via NodeVM sandbox escape.
    • Action: Upgrade to Flowise v3.1.2+ and audit custom function nodes for malicious code.
    • Source: NVD

  3. CVE-2026-11624 (Model Context Protocol)

    • Severity: Critical (CVSS 9.4)
    • Component: MCP Server Origin Validation
    • Impact: DNS Rebinding attacks allowing unauthorized server connections.
    • Action: Set --allowed-hosts and --allowed-origins flags explicitly; do not use defaults.
    • Source: NVD

  4. CVE-2026-45833 (ChromaDB)

    • Severity: Critical (CVSS 9.4)
    • Component: ChromaDB Python Project
    • Impact: Code injection via malicious model repository with trust_remote_code=true.
    • Action: Disable trust_remote_code in production and upgrade ChromaDB.
    • Source: NVD

  5. GHSA-9gw6-46qc-99vr (Meta Ads MCP)

    • Severity: Critical (CVSS 9.1)
    • Component: Meta Ads MCP Server
    • Impact: Unauthenticated HTTP MCP tool execution leaking operator access tokens.
    • Action: Patch to version 1.0.102+ and restrict network access to MCP endpoints.
    • Source: GitHub Advisory

  6. CVE-2026-46519 (mcp-server-kubernetes)

    • Severity: High (CVSS 8.8)
    • Component: MCP Kubernetes Server
    • Impact: Access control bypass allowing restricted tool execution via direct calls.
    • Action: Upgrade to v3.6.0+ and enforce network policies around MCP traffic.
    • Source: NVD

  7. CVE-2026-49948 (Mem0)

    • Severity: High (CVSS 8.6)
    • Component: Mem0 Self-Hosted Server
    • Impact: Configuration hijack allowing redirection of LLM traffic to attacker servers.
    • Action: Upgrade to commit ae7f406+ and audit /configure endpoint logs.
    • Source: NVD

  8. CVE-2026-46432 (LMDeploy)

    • Severity: High (CVSS 7.8)
    • Component: LMDeploy Model Loading
    • Impact: Arbitrary code execution via hardcoded trust_remote_code=True.
    • Action: Monitor vendor patches; isolate model loading environments strictly.
    • Source: NVD

  9. GHSA-8q5r-mmjf-575q (Claude Code Action)

    • Severity: Medium (CVSS 0.0) | Impact: High
    • Component: GitHub Actions / Claude Code
    • Impact: Remote Code Execution via malicious .mcp.json in PRs.
    • Action: Disable enableAllProjectMcpServers and require manual approval for PR workflows.
    • Source: GitHub Advisory

  10. CVE-2026-5497 (vLLM)

    • Severity: High (CVSS 7.5)
    • Component: vLLM Video Processing
    • Impact: Denial of Service via Out-of-Memory error on crafted video inputs.
    • Action: Implement input size limits and upgrade vLLM to patched versions.
    • Source: NVD

The Model Context Protocol (MCP) Security Crisis

This week exposed fundamental architectural weaknesses in the rapidly adopting Model Context Protocol. With five significant vulnerabilities identified across MCP servers and clients, the assumption that MCP connections are inherently trusted has been shattered. CVE-2026-11624 highlights a DNS rebinding risk where servers failing to validate the Origin header could be tricked into accepting connections from malicious hosts. This is particularly dangerous in agentic workflows where MCP servers often have access to sensitive internal tools.

Compounding this, CVE-2026-46519 in mcp-server-kubernetes revealed that access controls enforced at the tool discovery layer (tools/list) were not enforced at the execution layer (tools/call). This means an attacker who can enumerate tools can bypass read-only restrictions and execute destructive Kubernetes operations. Similarly, the Meta Ads MCP vulnerability (GHSA-9gw6-46qc-99vr) demonstrated how unauthenticated HTTP transports can leak operator tokens, effectively handing over ad account control to remote attackers. The Claude Code Action vulnerability (GHSA-8q5r-mmjf-575q) extends this risk into CI/CD pipelines, where malicious PRs can inject MCP configurations to exfiltrate secrets during automated runs. Organizations relying on MCP for agent tooling must treat these servers as high-value targets and implement strict network segmentation.

Low-Code LLM Platform Instability

Flowise emerged as a focal point for vulnerability research this week, with over a dozen CVEs published ranging from Critical to High severity. The most alarming, CVE-2026-46442, allows authenticated users to escape the NodeVM sandbox in Custom JS Function nodes, leading to full remote code execution on the host server. This is exacerbated by a lack of route-level authorization on critical endpoints, meaning any valid API key can potentially trigger these exploits.

Beyond RCE, Flowise suffered from widespread mass assignment vulnerabilities (CVE-2026-46477 through CVE-2026-42863). These flaws allow attackers to modify server-controlled properties like workspaceId, breaking tenant isolation in multi-tenant deployments. An attacker could reassign assistants, variables, or chatflows to arbitrary workspaces, gaining unauthorized access to proprietary prompts and data. IBM Langflow also faced similar issues with CVE-2026-7787 (IDOR) and CVE-2026-3341 (SSRF). The pattern here is clear: low-code AI platforms are prioritizing feature velocity over security governance, leaving them susceptible to basic web application attacks that compromise the underlying AI infrastructure.

Vector Database & Storage Integrity

Vector databases are the backbone of RAG architectures, and this week ChromaDB released a cascade of patches addressing severe authorization and code injection flaws. CVE-2026-45833 allows authenticated attackers to inject code via malicious model repositories if trust_remote_code is enabled. More concerning are the authorization bypasses (CVE-2026-8828, CVE-2026-45831, CVE-2026-45830) where the SimpleRBACAuthorizationProvider fails to check tenant context, allowing users to read or write data across tenant boundaries.

Mem0 also shipped a critical fix (CVE-2026-49948) where the /configure endpoint lacked role validation. Any authenticated user could redirect global LLM provider configuration to an attacker-controlled server, persisting the change in PostgreSQL to affect all users. Weaviate (CVE-2026-11500) and Qdrant (CVE-2026-11479) also reported authentication and hashing weaknesses. For security engineers, this underscores the need to treat vector stores not just as data repositories, but as critical security boundaries requiring strict RBAC and network isolation.

Model Supply Chain & Serving Risks

The supply chain for AI models remains fragile. LMDeploy vulnerabilities (CVE-2026-46432, CVE-2026-46517) revealed hardcoded trust_remote_code=True settings in model loading call sites, enabling supply chain RCE without user opt-in. This mirrors the risks seen in ChromaDB and highlights a systemic issue in HuggingFace-integrated tools. vLLM faced a denial of service risk (CVE-2026-5497) via unbounded frame count processing in video inputs, and a supply chain integrity issue (GHSA-3ww4-5jv9-j5gm) where artifact pinning did not apply to nested weights or processors.

Traditional ML libraries were not spared; Keras (CVE-2026-11816) and Kedro (CVE-2026-3840) both shipped path traversal vulnerabilities in archive extraction and versioning utilities, respectively. These bugs allow attackers to write files outside intended directories, potentially overwriting system configurations or planting malicious scripts in CI/CD runners. The prevalence of trust_remote_code defaults across multiple serving frameworks suggests that secure model loading requires explicit configuration rather than secure defaults.

Known Exploited Vulnerabilities

CVE-2026-42271 (BerriAI LiteLLM) is the only entry this week marked as is_exploited=true. This command injection vulnerability allows any authenticated user, including those with low-privilege internal keys, to run arbitrary commands on the host. Given LiteLLM's popularity as a unified inference proxy, the attack surface is massive. Threat intelligence suggests attackers are scanning for exposed LiteLLM instances to gain initial access to cloud environments. This is not a theoretical risk; it is an active campaign. Immediate patching and key rotation are non-negotiable.

What to Do This Week

  1. Patch LiteLLM Immediately: If you run LiteLLM, upgrade to the latest version now. Rotate all API keys and audit logs for suspicious command execution patterns.
  2. Harden MCP Servers: Audit all MCP server configurations. Ensure --allowed-hosts and --allowed-origins are set to specific values, not wildcards. Disable unauthenticated HTTP transports where possible.
  3. Upgrade Flowise & ChromaDB: Move to Flowise v3.1.2+ and the latest ChromaDB releases. Review custom JS nodes and disable trust_remote_code in vector store configurations.
  4. Enforce Tenant Isolation: Test your multi-tenant AI platforms for mass assignment vulnerabilities. Ensure workspace IDs cannot be manipulated via API parameters.
  5. Review CI/CD Permissions: For GitHub Actions using Claude Code or similar agents, disable automatic MCP server enabling from PRs. Require manual approval for workflows that access secrets.

What to Watch Next Week

Next week, we expect further disclosures regarding the integrity of pinned model artifacts in serving frameworks like vLLM and TGI. As the MCP ecosystem matures, look for standardized authentication mechanisms to replace the current ad-hoc header validation. Additionally, monitor for follow-on exploits targeting the newly patched ChromaDB authorization logic, as attackers often reverse engineer patches to find variant vulnerabilities. Finally, keep an eye on regulatory guidance regarding "secure defaults" for AI infrastructure, as the prevalence of trust_remote_code issues may trigger compliance scrutiny.

Covered entries (52)