VulnWatch VulnWatch
← All articles
Weekly digest · Jun 22, 2026

VulnWatch Weekly: PraisonAI Auth Collapse & MCP Server Exposure

This week saw a cascade of critical vulnerabilities in PraisonAI agents and widespread authentication failures in Model Context Protocol servers. Oracle Coherence and Langflow also shipped critical RCEs requiring immediate patching.

Prompt Injection Supply Chain Remote Code Execution Data Leakage Auth Bypass SSRF API Abuse Agentic / MCP

VulnWatch Weekly Retrospective: June 15–21, 2026

Week in Review

This week was defined by a systemic collapse of authentication controls in agentic frameworks, headlined by a massive cluster of critical vulnerabilities in PraisonAI affecting both Python and TypeScript distributions. Simultaneously, the emerging Model Context Protocol (MCP) ecosystem showed significant maturity gaps, with multiple servers exposing sensitive tools to unauthenticated network actors without default security boundaries. While no vulnerabilities were flagged as known-exploited in the wild this week, the sheer volume of Critical severity Remote Code Execution (RCE) and authentication bypass issues demands immediate remediation from ML platform teams. Security engineers should prioritize patching agentic orchestration layers and auditing network exposure for MCP servers.

Top Items of the Week

The following entries represent the highest impact risks identified this week, ranked by severity and potential blast radius.

  1. PraisonAI Remote Code Execution via Sandbox Escape

    • Identifier: GHSA-p69m-4f92-2v84
    • Severity: Critical (9.8)
    • Affected Component: PraisonAI codeMode Tool
    • Impact: Arbitrary code execution on the host system via new Function() bypass.
    • Action: Upgrade to the latest patched version immediately and disable codeMode if not strictly required.

  2. PraisonAI MCP Server Unauthenticated Access

    • Identifier: GHSA-j4f3-55x4-r6q2
    • Severity: Critical (9.8)
    • Affected Component: PraisonAI MCPServer
    • Impact: Full access to MCP tools, resources, and prompts without authentication.
    • Action: Implement network-level access controls and upgrade to patched versions enforcing auth.

  3. mcp-pinot Confused Deputy & Cluster Takeover

    • Identifier: CVE-2026-49257
    • Severity: Critical (10.0)
    • Affected Component: mcp-pinot Server
    • Impact: Full read/write access to configured Apache Pinot clusters via unauthenticated HTTP.
    • Action: Upgrade to version 3.1.0+ and ensure MCP servers are not bound to 0.0.0.0 in production.

  4. Oracle Coherence Remote Takeover

    • Identifier: CVE-2026-35307
    • Severity: Critical (10.0)
    • Affected Component: Oracle Fusion Middleware (Coherence)
    • Impact: Complete takeover of Oracle Coherence instances via HTTP.
    • Action: Apply Oracle Critical Patch Update immediately; isolate Coherence ports from untrusted networks.

  5. Langflow IDOR in Flow Execution

    • Identifier: GHSA-qrpv-q767-xqq2
    • Severity: Critical (9.9)
    • Affected Component: Langflow /api/v1/responses
    • Impact: Authenticated attackers can execute flows belonging to other users.
    • Action: Upgrade Langflow and review access logs for cross-user flow execution attempts.

  6. Langflow Unauthenticated RCE in Shareable Playgrounds

    • Identifier: GHSA-v5ff-9q35-q26f
    • Severity: Critical (9.6)
    • Affected Component: Langflow Public Flows
    • Impact: Unauthenticated users can execute arbitrary Python code via public flow links.
    • Action: Disable "Shareable Playground" features unless absolutely necessary and patched.

  7. Windows-MCP Unauthenticated PowerShell Execution

    • Identifier: CVE-2026-48989
    • Severity: High (8.9)
    • Affected Component: Windows-MCP
    • Impact: Arbitrary PowerShell execution via unauthenticated HTTP control plane.
    • Action: Upgrade to version 0.7.5+ and restrict MCP HTTP modes to localhost.

  8. Network-AI Empty Default Secret

    • Identifier: GHSA-r78r-rwrf-rjwp
    • Severity: Critical (9.1)
    • Affected Component: Network-AI MCP SSE Server
    • Impact: Unauthenticated cross-origin MCP tool invocation due to empty secret default.
    • Action: Explicitly configure a strong secret key and upgrade to version 5.7.1+.

  9. Stanza Unsafe Pickle Deserialization

    • Identifier: GHSA-v5jw-96jm-7h2c
    • Severity: High (7.5)
    • Affected Component: Stanza Model Loaders
    • Impact: Arbitrary code execution via malicious PyTorch checkpoint files.
    • Action: Validate model sources and implement checksum verification for all loaded artifacts.

  10. M365 Copilot Missing Authentication

    • Identifier: CVE-2026-54130
    • Severity: Critical (9.8)
    • Affected Component: M365 Copilot
    • Impact: Information disclosure over network due to missing auth on critical function.
    • Action: Monitor Microsoft security advisories for tenant-specific patching instructions.

The PraisonAI Authentication Collapse

The most alarming trend this week is the sheer density of critical vulnerabilities disclosed in the PraisonAI ecosystem. Across both the PyPI and npm distributions, researchers identified a systemic failure to enforce authentication and authorization boundaries in agentic orchestration components. Vulnerabilities such as GHSA-j4f3-55x4-r6q2 and GHSA-892r-p3jq-jp24 reveal that core HTTP servers for agent management and MCP tool exposure were shipping with no authentication middleware enabled by default. This is compounded by issues like GHSA-cwj8-7gp2-ggcw, where JWT signing secrets were hardcoded to dev-secret-change-me, allowing trivial token forgery.

For CISOs, this highlights a critical risk in adopting rapid-development agentic frameworks. The convenience of "zero-config" deployment often comes at the cost of security defaults. In this case, the "zero-config" experience meant that any network-adjacent attacker could invoke agents, read internal files via tools like multiedit (GHSA-29w3-p9w9-wc47), or execute arbitrary code via sandbox escapes in codeMode (GHSA-p69m-4f92-2v84). The sandbox escape is particularly concerning as it relies on blocklist-based filtering which was bypassed using standard JavaScript global object recovery techniques. Teams using PraisonAI must assume their deployments are compromised if exposed to untrusted networks and should prioritize isolation and patching.

Model Context Protocol (MCP) Exposure

As the Model Context Protocol gains traction as a standard for connecting AI models to tools and data, this week's vulnerabilities expose a immature security posture in many server implementations. The critical vulnerability in mcp-pinot (CVE-2026-49257) is a textbook confused deputy problem: the MCP server defaulted to binding on 0.0.0.0 without authentication, proxying attacker requests using server-side Pinot credentials. This effectively granted any network caller full database access.

Similar patterns emerged in Windows-MCP (CVE-2026-48989) and Network-AI (CVE-2026-48814), where MCP control planes were reachable without credentials, allowing attackers to invoke PowerShell commands or tool calls remotely. The SearXNG MCP Server also showed SSRF vulnerabilities (GHSA-mrvx-jmjw-vggc) where DNS rebinding could bypass private IP blocks. The lesson for platform teams is clear: MCP servers should be treated as high-privilege interfaces. They must never be exposed to public networks without strict authentication, and tool definitions should be audited for dangerous capabilities like file system access or shell execution.

Low-Code AI Platform Instability

Langflow continues to struggle with security hygiene in its rapid feature development cycle. This week saw multiple Critical severity issues, including an Insecure Direct Object Reference (IDOR) allowing users to execute other tenants' flows (GHSA-qrpv-q767-xqq2) and a Remote Code Execution vulnerability in "Shareable Playgrounds" (GHSA-v5ff-9q35-q26f). The latter is particularly dangerous as it allows unauthenticated users to execute arbitrary Python code simply by accessing a public link.

Additionally, path traversal vulnerabilities in the Knowledge Bases API (GHSA-79ph-745m-6wxq) and unauthenticated file uploads leading to DoS (GHSA-x223-p2gf-v735) suggest that input validation is not keeping pace with feature additions. For organizations using Langflow for RAG or workflow orchestration, these issues undermine the trust boundary of the platform. Security engineers should enforce network segmentation around Langflow instances and disable public sharing features until stability is proven.

Model Supply Chain & Pickle Risks

The risk of malicious model artifacts remains a persistent threat. This week, Stanza was found to fall back to unsafe pickle deserialization (weights_only=False) when safe loading fails (GHSA-v5jw-96jm-7h2c). This allows an attacker who can poison a model repository to achieve RCE. Similarly, picklescan itself was found to have a scanning bypass vulnerability (CVE-2026-53875), meaning even security tools designed to catch these issues can be evaded using dynamic eval tricks.

Furthermore, stable-diffusion.cpp shipped with multiple heap buffer overflows in its checkpoint parser (CVE-2026-47750, CVE-2026-47747). These memory corruption bugs could lead to crashes or potentially code execution when loading crafted .ckpt files. This reinforces the need for a "zero trust" approach to model weights: never load models from unverified sources, and always run inference in sandboxed environments with limited system calls.

Known Exploited Vulnerabilities

Fortunately, none of the vulnerabilities disclosed this week were flagged as is_exploited=true. However, the presence of public advisories and detailed proof-of-concept details in GitHub advisories significantly lowers the barrier for weaponization. The PraisonAI and MCP issues, in particular, are trivial to exploit using standard HTTP clients. Security teams should operate under the assumption that exploitation is imminent if patches are not applied within days.

What to Do This Week

  1. Patch PraisonAI Immediately: If you use PraisonAI, upgrade all components (PyPI and npm) to the latest versions. Audit your deployment for hardcoded secrets like dev-secret-change-me and rotate them.
  2. Audit MCP Servers: Inventory all running MCP servers. Ensure none are bound to 0.0.0.0 without authentication. Implement network policies to restrict MCP traffic to trusted pods or services only.
  3. Disable Langflow Public Features: Turn off "Shareable Playgrounds" and public flow execution in Langflow until you have confirmed you are on a patched version.
  4. Enforce Model Integrity: Implement checksums for all model weights. Configure loaders like Stanza and PyTorch to strictly enforce weights_only=True and fail closed on errors rather than falling back to unsafe modes.
  5. Review Oracle Coherence: Apply the latest Oracle Critical Patch Update to all Fusion Middleware instances and verify network isolation for Coherence ports.

What to Watch Next Week

Next week, we will be monitoring the adoption rate of the patches released for PraisonAI and MCP servers. Given the "fail-open" nature of many of these authentication bugs, we expect to see scanning activity targeting default ports (3000, 8080) associated with these tools. Additionally, keep an eye on the vLLM ecosystem, as multiple medium-severity issues regarding tensor validation and audio processing bombs were disclosed this week that could evolve into denial-of-service campaigns against public inference endpoints.

Covered entries (120)