VulnWatch VulnWatch
← All articles
Weekly digest · Jun 29, 2026

VulnWatch Weekly: Agentic RCE & Supply Chain Risks Surge

Critical vulnerabilities in Langflow, vLLM, and MCP servers highlight severe risks in AI tooling. Immediate patching required for agentic platforms and inference engines to prevent RCE and supply chain compromise.

Prompt Injection Supply Chain Remote Code Execution Data Leakage Auth Bypass SSRF Agentic / MCP

VulnWatch Weekly Retrospective: June 22–28, 2026

Week in Review

This week marked a significant escalation in vulnerabilities affecting the AI agent ecosystem, with multiple critical remote code execution (RCE) flaws discovered in popular orchestration platforms like Langflow and ToolJet. The dominant themes emerging from the 120 tracked entries are the fragility of agentic tool invocation, severe supply chain risks in model serving infrastructure, and persistent authentication bypasses in multi-tenant AI platforms. The single most urgent item is the cluster of critical vulnerabilities in Langflow (CVE-2026-10561, CVE-2026-48519), which allow unauthenticated attackers to execute arbitrary code on host systems running AI workflows. Security teams must prioritize patching agentic frameworks and auditing their model serving pipelines for dependency confusion attacks immediately.

Top Items of the Week

The following entries represent the highest impact risks identified this week. These vulnerabilities offer direct paths to system compromise, data exfiltration, or supply chain poisoning.

  1. CVE-2026-10561 (IBM Langflow)

    • Severity: Critical (CVSS 10.0)
    • Component: IBM Langflow OSS
    • Impact: Authentication bypass combined with improper Python isolation allows unauthenticated attackers to execute arbitrary code on the host.
    • Action: Upgrade to Langflow 1.9.3 or later immediately. Isolate Langflow instances from critical network segments.
    • Source: NVD

  2. GHSA-73cv-556c-w3g6 (mcp-pinot)

    • Severity: Critical (CVSS 10.0)
    • Component: mcp-pinot Server
    • Impact: Unauthenticated tool invocation via default OAuth settings and host binding allows full control over MCP tools.
    • Action: Upgrade to v3.1.0. Ensure OAuth is enabled and HTTP binds to localhost only.
    • Source: GitHub Advisory

  3. CVE-2026-12537 (Google Gemini CLI)

    • Severity: Critical (CVSS 10.0)
    • Component: Google Gemini CLI
    • Impact: Improper neutralization in container launcher allows pre-sandbox host-level code execution via malicious .env files.
    • Action: Update Gemini CLI to 0.39.1+ and run-gemini-cli Action to 0.1.22+. Audit CI/CD pipelines for untrusted env files.
    • Source: NVD

  4. CVE-2026-54232 (vLLM)

    • Severity: High (CVSS 8.8)
    • Component: vLLM Dockerfile
    • Impact: Dependency confusion attack via flashinfer-jit-cache allows arbitrary code execution as root during Docker build.
    • Action: Upgrade to vLLM 0.22.1+. Pin dependencies and audit custom indexes in build pipelines.
    • Source: NVD

  5. CVE-2026-55413 (ToolJet)

    • Severity: Critical (CVSS 9.4)
    • Component: ToolJet Platform
    • Impact: Authenticated users can overwrite globally-shared marketplace plugins with arbitrary JavaScript, achieving RCE and supply chain compromise.
    • Action: Upgrade to ToolJet 3.20.178-lts. Review plugin permissions and restrict builder roles.
    • Source: NVD

  6. CVE-2026-50548 / CVE-2026-50549 (Cursor)

    • Severity: Critical (CVSS 9.3)
    • Component: Cursor Editor
    • Impact: Sandbox escape via working directory manipulation and symlink attacks allows agents to write arbitrary files outside the workspace.
    • Action: Update Cursor to v3.0. Disable agent terminal commands where possible.
    • Source: NVD

  7. GHSA-98x5-vq43-vc5p (semantic-router/litellm)

    • Severity: Critical (Description)
    • Component: semantic-router, LiteLLM
    • Impact: Compromised litellm wheel exfiltrates credentials and secrets via .pth file execution on import.
    • Action: Audit Python environments for litellm==1.82.8. Use lockfiles and verify wheel hashes.
    • Source: GitHub Advisory

  8. CVE-2026-53753 (Crawl4AI)

    • Severity: Critical (CVSS 9.8)
    • Component: Crawl4AI
    • Impact: Sandbox escape via AST validator bypass allows arbitrary code execution via crafted extraction schemas.
    • Action: Upgrade to Crawl4AI 0.8.7. Disable JWT auth only if strictly internal.
    • Source: NVD

Agentic RCE & Tooling Risks

The most alarming trend this week is the prevalence of Remote Code Execution (RCE) vulnerabilities within AI agent orchestration platforms. Langflow, a popular tool for building AI workflows, suffered a catastrophic week with multiple critical CVEs. CVE-2026-10561 is particularly severe because it combines an authentication bypass with improper isolation of Python execution. This means an attacker does not need valid credentials to compromise the host system; they simply need network access to the Langflow instance. Furthermore, CVE-2026-48519 exposes the "Shareable Playground" feature, allowing unauthenticated users to execute arbitrary Python code within nodes of a public flow. This highlights a fundamental design flaw in exposing agent execution capabilities to untrusted users without strict sandboxing.

Similarly, ToolJet (CVE-2026-55413) demonstrated how low-privilege users can compromise the entire platform supply chain. By overwriting globally-shared marketplace plugins, an attacker can ensure their malicious JavaScript executes server-side whenever any user triggers a query using that plugin. This is a classic supply chain attack vector enabled by insufficient isolation between tenant configurations and global resources. The Cursor editor vulnerabilities (CVE-2026-50548, CVE-2026-50549) further illustrate the risk of agentic tools having filesystem access. Even with a sandbox, flaws in how working directories and symlinks are handled allowed agents to write files outside the intended workspace, potentially overwriting critical system configurations or exfiltrating data.

The Model Context Protocol (MCP) is also emerging as a high-risk surface. The mcp-pinot vulnerability (GHSA-73cv-556c-w3g6) showed that default configurations often leave MCP servers bound to 0.0.0.0 without OAuth, allowing unauthenticated tool invocation. As organizations adopt MCP to connect LLMs to data sources, the security of these servers becomes paramount. We also saw issues in the GitHub MCP Server (CVE-2026-48529) where lockdown mode failed due to singleton confusion, and the Foreman MCP Server (CVE-2026-12112) which allowed session hijacking. These indicate that the MCP ecosystem is maturing rapidly but lacks consistent security baselines.

Model Serving & Supply Chain Integrity

Infrastructure supporting model inference faced significant supply chain and authentication challenges. vLLM, a critical component for high-throughput LLM serving, had a dependency confusion vulnerability (CVE-2026-54232) in its Dockerfile. Because the flashinfer-jit-cache package was not registered on PyPI but was installed via a custom index with an "unsafe-best-match" strategy, an attacker could register the package on PyPI and inject malicious code during the build process. This compromises every container image built thereafter, enabling persistent backdoors in production inference clusters.

Additionally, the semantic-router advisory (GHSA-98x5-vq43-vc5p) highlighted a compromised litellm wheel (version 1.82.8) that executed code on interpreter startup via a .pth file. This is a severe supply chain incident affecting any project depending on litellm without strict version pinning. The wheel exfiltrated environment variables, cloud credentials, and SSH keys. This serves as a stark reminder that AI infrastructure relies heavily on the Python ecosystem, which remains vulnerable to dependency confusion and package poisoning.

Authentication bypasses in model serving were also prevalent. CVE-2026-48746 in vLLM allowed attackers to bypass the OpenAI API AuthenticationMiddleware due to trust issues in ASGI web servers. This means protected inference endpoints could be accessed without an API key, leading to unauthorized usage, cost inflation, or potential prompt injection attacks against internal models. Ollama also faced information disclosure risks (CVE-2026-5757) in its quantization engine, allowing heap memory exfiltration. These vulnerabilities underscore the need for rigorous network segmentation around inference endpoints; they should never be exposed directly to the public internet without a robust API gateway.

Authentication & Multi-Tenancy Failures

A recurring theme across AI application platforms is the failure to properly enforce multi-tenancy and authorization. Langflow appeared again in this category with CVE-2026-55255 (IDOR) and CVE-2026-33760 (BOLA), where authenticated users could access or modify other users' flows and data simply by guessing resource IDs. Open WebUI (CVE-2026-54009, CVE-2026-54019) and LibreChat (CVE-2026-54027, CVE-2026-54029) exhibited similar Broken Object Level Authorization (BOLA) issues. In LibreChat, users could upload files to agents they did not own or delete other users' messages.

These vulnerabilities suggest that AI platform developers are prioritizing feature velocity over security governance. The complexity of managing state across agents, conversations, and knowledge bases often leads to missed authorization checks on secondary endpoints. For CISOs, this means that enabling "collaboration" features like shared playgrounds or public flows should be treated as high-risk decisions. Multi-tenancy must be enforced at the database query level, not just in the API middleware. The prevalence of these issues across Langflow, LibreChat, and Open WebUI indicates a systemic problem in the open-source AI application layer that requires defensive configuration rather than relying on vendor patches alone.

Data Leakage & SSRF in AI Crawlers

AI agents designed to interact with the web introduce significant Server-Side Request Forgery (SSRF) risks. Crawl4AI (CVE-2026-56266, CVE-2026-53755) had multiple SSRF vulnerabilities where internal address blocklists could be bypassed using IPv6-mapped IPv4 addresses or proxy configurations. This allows attackers to force the AI crawler to access internal cloud metadata services (e.g., AWS IMDS) or internal APIs. AutoGPT (CVE-2026-56663) similarly failed to normalize IPv4-mapped IPv6 addresses before checking blocked ranges.

Data leakage was also a concern beyond SSRF. The compromised LiteLLM wheel mentioned earlier directly targeted secret exfiltration. Additionally, vLLM (CVE-2026-53923) had an integer truncation bug in GGUF dequantize kernels that could leak residual GPU memory from other tenants in multi-tenant deployments. This is a novel side-channel risk specific to GPU sharing in AI clouds. Organizations running multi-tenant inference services must ensure that memory zeroing is enforced between context switches to prevent cross-tenant data leakage.

Known Exploited Status

Based on the data collected this week, none of the identified vulnerabilities are currently marked as known exploited (is_exploited=true) in public tracking systems. However, the severity of the RCE vulnerabilities in Langflow and the supply chain compromise in LiteLLM suggests they are prime candidates for immediate weaponization. The lack of public exploitation data should not induce complacency; the availability of proof-of-concept details in advisories lowers the barrier for opportunistic attackers.

What to Do This Week

  1. Patch Agentic Platforms: Immediately upgrade Langflow to 1.9.3+, ToolJet to 3.20.178-lts, and Cursor to v3.0. These patches address critical RCE vectors.
  2. Audit Python Dependencies: Scan all environments for litellm==1.82.8 and flashinfer-jit-cache. Enforce lockfiles and verify wheel hashes against known good repositories.
  3. ** Harden MCP Servers:** Ensure all MCP servers (Pinot, Foreman, GitHub) are bound to localhost (127.0.0.1) and require OAuth or token authentication. Disable HTTP exposure unless strictly necessary.
  4. Review Inference Security: Update vLLM to 0.22.1+ to fix auth bypass and supply chain issues. Place inference endpoints behind an API gateway with strict rate limiting and authentication.
  5. Disable Public Features: Temporarily disable "Shareable Playground" or public flow features in Langflow and similar platforms until authorization models are verified.
  6. Network Segmentation: Isolate AI crawler services (Crawl4AI, AutoGPT) from internal networks. Use egress proxies to enforce allowlists on outbound requests.

What to Watch Next Week

Next week, we will be monitoring the adoption rate of the patches released for Langflow and vLLM, as telemetry suggests these platforms are widely deployed in production. We are also tracking potential follow-on vulnerabilities in the Model Context Protocol (MCP) ecosystem as more vendors integrate MCP servers. Expect increased scrutiny on AI agent sandboxing mechanisms, particularly around filesystem access and tool invocation permissions. Finally, keep an eye on supply chain advisories for Python AI packages, as the LiteLLM incident may trigger a wave of audits across the dependency graph.

Covered entries (120)