VulnWatch VulnWatch
← All articles
Weekly digest · Jul 6, 2026

VulnWatch Weekly: Langflow Cascade & MCP Ecosystem Risks

Langflow faces a critical week with 10+ CVEs including RCE and secret leakage. MCP servers show systemic auth flaws. Action required on model loading.

Prompt Injection Supply Chain Remote Code Execution Data Leakage Auth Bypass SSRF API Abuse Agentic / MCP

Week in Review

This week in AI security is defined by a catastrophic cluster of vulnerabilities in IBM Langflow OSS and systemic authentication failures across the emerging Model Context Protocol (MCP) ecosystem. The dominant theme is the fragility of agentic orchestration layers, where trust boundaries between users, tools, and models are repeatedly violated. The single most urgent item is the suite of Critical vulnerabilities in Langflow (CVE-2026-10134, CVE-2026-7873), which allow attackers to read all secrets, modify flows, and execute arbitrary OS commands on the host. While no known exploited vulnerabilities (KEV) were flagged in the data this week, the severity and ease of exploitation for these orchestration flaws demand immediate patching and network segmentation.

Top Items of the Week

The following vulnerabilities represent the highest risk to AI infrastructure this week. Prioritize remediation based on the exposure of your environment.

  1. CVE-2026-10134: IBM Langflow OSS Secret & Flow Compromise

    • Severity: Critical (CVSS 10.0)
    • Affected Component: IBM Langflow OSS 1.0.0 - 1.9.3
    • Impact: Attackers can read every secret available to the Langflow process, modify all flows and conversations, and establish persistence by injecting code into public flows. This effectively grants full control over the LLM orchestration layer.
    • Recommended Action: Upgrade to Langflow 1.10.1 or later immediately. Rotate all API keys and secrets stored within the Langflow instance. Audit all saved flows for unauthorized tool_code modifications. Source

  2. CVE-2026-7873: IBM Langflow OSS OS Command Execution

    • Severity: Critical (CVSS 9.9)
    • Affected Component: IBM Langflow OSS 1.0.0 - 1.10.0
    • Impact: Authenticated attackers can execute arbitrary OS commands and read sensitive files, enabling complete system compromise and lateral movement within the network.
    • Recommended Action: Apply vendor patches immediately. If patching is not possible, restrict network access to the Langflow UI and API to trusted management subnets only. Source

  3. CVE-2026-45499: Azure OpenAI Server-Side Request Forgery

    • Severity: Critical (CVSS 9.9)
    • Affected Component: Azure OpenAI Service
    • Impact: An authorized attacker can exploit SSRF to elevate privileges over a network, potentially accessing internal Azure metadata services or internal endpoints not meant for public exposure.
    • Recommended Action: Review Azure OpenAI network security rules. Ensure Managed Identities are scoped with least privilege. Monitor for unusual outbound traffic from OpenAI resources. Source

  4. GHSA-84hp-mqvj-3p8h: MCP Memory Service Authentication Bypass

    • Severity: Critical (CVSS 9.8)
    • Affected Component: mcp-memory-service
    • Impact: Missing authentication on /api/documents/* endpoints allows unauthenticated remote attackers to read, write, or delete memory documents. This compromises the context integrity of any agent using this memory service.
    • Recommended Action: Update mcp-memory-service to the latest version. Verify that MCP_API_KEY is enforced on all endpoints. Source

  5. CVE-2026-58116: LLaMA-Factory Remote Code Execution

    • Severity: Critical (CVSS 9.3)
    • Affected Component: LLaMA-Factory <= 0.9.5
    • Impact: Attackers with WebUI access can execute arbitrary Python code by supplying a malicious model path. The application loads remote code with trust_remote_code=True without validation.
    • Recommended Action: Upgrade LLaMA-Factory. Disable trust_remote_code in production environments unless strictly necessary and vetted. Source

  6. CVE-2026-12481: Keras Lambda Layer Deserialization RCE

    • Severity: High (CVSS 8.8)
    • Affected Component: keras-team/keras 3.14.0
    • Impact: Improper handling of deserialization in the Lambda layer allows arbitrary code execution via malicious model files. The safe-mode guard is bypassed when safe_mode is None.
    • Recommended Action: Upgrade Keras. Implement strict allowlisting for model sources. Scan uploaded .keras or .h5 files before loading. Source

  7. CVE-2026-55607: Claude Code Worktree Sandbox Escape

    • Severity: High (CVSS 7.7)
    • Affected Component: Claude Code 2.1.38 - 2.1.163
    • Impact: Worktree handling allows creation of worktrees named .git, enabling git directory confusion attacks. Attackers can overwrite files in the user's home directory (e.g., .zshenv) to achieve code execution outside the sandbox.
    • Recommended Action: Update Claude Code. Restrict the directories Claude Code is permitted to access via configuration. Source

  8. GHSA-6gr2-qh89-hxwm: Apify MCP Token Leak

    • Severity: High (CVSS 8.1)
    • Affected Component: @apify/actors-mcp-server 0.10.7
    • Impact: Actor MCP path authority injection allows attackers to craft URLs that cause the MCP client to send the victim's Authorization token to an attacker-controlled host.
    • Recommended Action: Update Apify MCP server. Audit MCP server logs for requests to unexpected domains. Source

Theme: The Langflow Cascade

The most striking pattern this week is the sheer volume of critical vulnerabilities disclosed in IBM Langflow OSS. We observed over ten distinct CVEs ranging from CVSS 9.1 to 10.0. This is not merely a single bug but a systemic failure in the platform's security architecture. The vulnerabilities span authentication bypasses (CVE-2026-10560), SSRF protections bypasses (CVE-2026-10129, CVE-2026-10564), and weak encryption at rest (CVE-2026-7874).

The most alarming aspect is the persistence mechanism described in CVE-2026-10134. By modifying the public flow's tool_code, an attacker can ensure their malicious code is re-executed at each build by any user. This transforms a standard compromise into a supply-chain attack within the platform itself. Furthermore, CVE-2026-7871 highlights the risk of shared infrastructure; users with Redis access can execute code with full application privileges. For organizations using Langflow for production orchestration, this week's disclosures suggest that the platform should be treated as fully compromised until patched and audited. The interconnectivity of these flaws means that fixing one (e.g., SSRF) may not prevent exploitation via another (e.g., direct OS command execution).

Theme: MCP Ecosystem Growing Pains

As the Model Context Protocol (MCP) gains traction for connecting AI agents to tools, we are seeing a corresponding rise in security debt. This week, vulnerabilities were reported in mcp-memory-service, fast-mcp-telegram, Apify MCP, Kong Konnect MCP, auth-fetch-mcp, and Presenton. The common thread is a lack of robust authentication and authorization boundaries.

In mcp-memory-service (GHSA-84hp-mqvj-3p8h), document API endpoints were served without authentication dependencies, allowing unauthenticated read/write/delete access. Similarly, fast-mcp-telegram (CVE-2026-52830) allowed authentication bypass via path traversal in session file validation. These issues stem from a "trust-by-default" mentality often seen in early-stage developer tools. However, when these servers are exposed to the internet or connected to powerful LLM agents, the risk escalates from data leakage to full account takeover. The Apify token leak (GHSA-6gr2-qh89-hxwm) further demonstrates how MCP's URL construction logic can be hijacked to exfiltrate credentials. Security teams must inventory all MCP servers in their environment and treat them as high-value targets requiring strict network isolation and authentication enforcement.

Theme: Insecure Model Loading & Deserialization

The risk of loading untrusted models remains a perennial issue, highlighted again by vulnerabilities in LLaMA-Factory, Keras, and Picklescan. CVE-2026-58116 in LLaMA-Factory is particularly dangerous because it abuses the trust_remote_code=True parameter, a common convenience feature that effectively disables security controls. When combined with user-supplied model paths, it creates a direct RCE vector.

Similarly, CVE-2026-12481 in Keras shows that even "safe modes" can be bypassed through logic errors involving None values in deserialization contexts. The Picklescan vulnerability (CVE-2025-71342) reminds us that pickle scanning tools themselves can have blind spots, specifically regarding idlelib.run.Executive.runcode. For ML platform teams, this reinforces the need for a "zero trust" approach to model artifacts. Models should be loaded in sandboxed environments with no network access, and trust_remote_code should be disabled by default in production pipelines.

Theme: Agentic Boundary Failures

Agentic tools like Claude Code and Langroid are pushing the boundaries of what AI can do, but they are also blurring the lines between the AI and the host system. CVE-2026-55607 in Claude Code allowed a sandbox escape via git worktree manipulation, enabling writes to the user's home directory. This is a classic container escape scenario applied to an AI developer tool.

In Langroid, multiple issues (GHSA-fg23-3346-88f5, GHSA-pmch-g965-grmr) showed that file tools and SQL agents lacked proper path traversal and SQL injection protections. The SQLChatAgent missed blocking pg_read_file, allowing arbitrary file reads via SQL. These vulnerabilities highlight the difficulty of securing tool-use interfaces. When an LLM is given the ability to execute tools, every parameter passed to those tools must be validated as if it came from a malicious human user, because via prompt injection, it effectively did.

What to do this week

  1. Patch Langflow Immediately: If you run IBM Langflow OSS, upgrade to version 1.10.1 or later. This is the highest priority action for the week. Rotate all secrets stored in the instance.
  2. Audit MCP Servers: Inventory all MCP servers in your stack. Verify that authentication is enforced on every endpoint, not just the main handshake. Check for path traversal vulnerabilities in session handling.
  3. Harden Model Loading: Review your ML pipelines for trust_remote_code=True. Disable it where possible. Ensure model artifacts are scanned and loaded in isolated environments without network access.
  4. Restrict Agentic Tools: For tools like Claude Code, restrict the working directories they can access. Do not run agentic tools as root or with access to sensitive environment variables.
  5. Network Segmentation: Isolate AI orchestration layers (Langflow, MCP servers) from internal metadata services and sensitive databases. Use egress filtering to prevent SSRF exploitation.

What to watch next week

Next week, we will be monitoring the adoption rate of the patches released for the Langflow cluster and whether any proof-of-concept exploits appear in public repositories. We are also tracking the evolution of MCP security standards; expect more vendors to release guidance on securing MCP hosts. Finally, keep an eye on deserialization vulnerabilities in new model formats beyond pickle and HDF5, as the industry shifts towards more complex artifact structures.

Covered entries (79)