VulnWatch VulnWatch
← All articles
Weekly digest · Jul 20, 2026

VulnWatch Weekly: The Langflow Catastrophe & MCP Supply Chain Risks

This week is dominated by a critical cluster of RCE and auth-bypass flaws in IBM Langflow, alongside severe multi-tenant isolation failures in the emerging Model Context Protocol (MCP) ecosystem. Immediate patching is required for Langflow instances and MCP servers handling sensitive workflows.

Prompt Injection Remote Code Execution Data Leakage Auth Bypass SSRF Agentic / MCP

Week in Review: The Langflow Meltdown and the MCP Isolation Crisis

Week of July 13–19, 2026

The security landscape for AI infrastructure suffered a seismic shift this week with the disclosure of a catastrophic vulnerability cluster in IBM Langflow OSS, effectively rendering default deployments of versions 1.0.0 through 1.10.0 fully compromiseable by unauthenticated attackers. Simultaneously, as the industry rapidly adopts the Model Context Protocol (MCP) to connect agents to tools, we are seeing a wave of critical design flaws related to multi-tenant isolation, path traversal, and command injection across the MCP server ecosystem. The single most urgent item for CISOs and platform teams is the immediate isolation or patching of any exposed Langflow instance, as the chain of vulnerabilities allows for trivial remote code execution (RCE) without credentials. Beyond Langflow, the week highlights a systemic issue in how AI agents handle untrusted inputs, with severe implications for supply chain integrity in tools like n8n, LiteLLM, and various vector store integrations.

Top Items of the Week

The following vulnerabilities represent the highest immediate risk to AI/ML operations. These items are ranked by exploitability, impact, and the prevalence of the affected components.

  1. CVE-2026-9198 / CVE-2026-9103 / CVE-2026-8481 (IBM Langflow)

    • Severity: Critical (CVSS 9.8)
    • Component: IBM Langflow OSS (v1.0.0–1.10.0)
    • Impact: Unauthenticated Remote Code Execution. A chain of flaws allows an attacker to mint a superuser token via the auto_login endpoint (enabled by default) and immediately execute arbitrary Python code via the validate/code API.
    • Action: EMERGENCY. Upgrade to v1.10.1+ immediately. If patching is not possible, disable the service or restrict network access to localhost only. Ensure AUTO_LOGIN and WEBHOOK_AUTH_ENABLE are explicitly set to false in configuration, though upgrading is the only reliable mitigation.
    • NVD Detail

  2. CVE-2026-54052 / GHSA-j6r7-6fhx-77wx (n8n-MCP)

    • Severity: Critical (CVSS 9.9)
    • Component: n8n-MCP Server
    • Impact: Multi-tenant Data Leakage and Integrity Loss. In HTTP mode with multi-tenancy enabled, workflow version backups are not isolated. Attackers can read, delete, or overwrite other tenants' workflow snapshots, exposing credentials and logic.
    • Action: Upgrade n8n-MCP to v2.56.1+ immediately. Audit logs for cross-tenant access attempts if running affected versions.
    • NVD Detail

  3. CVE-2026-30623 (LiteLLM)

    • Severity: Critical (CVSS 9.8)
    • Component: LiteLLM Proxy
    • Impact: Remote Code Execution via MCP Configuration. The MCP server creation functionality executes arbitrary OS commands specified in the JSON configuration without validation.
    • Action: Upgrade LiteLLM to v1.83.10+ (and subsequent patches for related MCP flaws). Review all registered MCP servers for malicious command arguments.
    • NVD Detail

  4. CVE-2026-14890 (SGLang)

    • Severity: Critical (CVSS 9.1)
    • Component: SGLang Expert-Parallel Backup Subsystem
    • Impact: Unauthenticated RCE via Pickle Deserialization. The ZeroMQ PULL socket exposed on routable interfaces accepts malicious pickle payloads.
    • Action: Firewall the SGLang backup ports immediately. Upgrade to the patched version and ensure the backup subsystem is not exposed to untrusted networks.
    • NVD Detail

  5. CVE-2026-63093 (Cursor IDE)

    • Severity: High (CVSS 8.7)
    • Component: Cursor for Windows
    • Impact: Binary Planting / RCE. Cloning a repository containing a malicious git.exe in the root causes the IDE to execute it automatically.
    • Action: Update Cursor IDE. Implement strict controls on cloning repositories from untrusted sources until the patch is widely deployed.
    • NVD Detail

  6. CVE-2026-58659 (PyTorch Lightning)

    • Severity: High (CVSS 8.4)
    • Component: PyTorch Lightning
    • Impact: RCE via Checkpoint Loading. Malicious checkpoint files can bypass weights_only=True protections to execute arbitrary code.
    • Action: Upgrade PyTorch Lightning. Treat all external checkpoint files as untrusted executable code; verify hashes before loading.
    • NVD Detail

  7. CVE-2026-15643 (AWS HealthLake MCP)

    • Severity: Critical (CVSS 9.2)
    • Component: AWS HealthLake MCP Server
    • Impact: SSRF leading to Credential Exfiltration. Pagination handling allows redirection to arbitrary endpoints, leaking AWS temporary security credentials.
    • Action: Upgrade awslabs.healthlake-mcp-server to v0.0.14+. Rotate any credentials that may have been exposed if the server was previously accessible.
    • NVD Detail

  8. CVE-2026-9810 (AI Copilot WordPress Plugin)

    • Severity: Critical (CVSS 9.8)
    • Component: AI Copilot WordPress Plugin
    • Impact: Privilege Escalation. OAuth tokens are not bound to users, allowing attackers to hijack admin sessions and execute privileged MCP tools.
    • Action: Update the plugin to v1.5.4+ immediately. Invalidate all active OAuth sessions.
    • NVD Detail

Theme: The Langflow Supply Chain Collapse

The most significant event of the week is the comprehensive collapse of security boundaries in IBM Langflow OSS. This is not a single bug but a systemic failure affecting authentication, input validation, and serialization. The cluster includes:

  • Authentication Bypass: CVE-2026-9103 and CVE-2026-9202 reveal that default configurations allow unauthenticated users to mint superuser tokens or create active accounts.
  • Direct RCE: CVE-2026-8481 exposes a code validation API that executes user-supplied Python via exec() without sandboxing. CVE-2026-8476 highlights unsafe pickle.loads() usage in the caching mechanism.
  • Privilege Escalation: CVE-2026-8635 allows authenticated users to manipulate the database directly to become superusers.
  • File System Compromise: CVE-2026-8859 and CVE-2026-7667 demonstrate path traversal vulnerabilities allowing arbitrary file writes.

Analysis: The combination of these flaws means that any network-accessible Langflow instance running a default configuration is effectively a public shell. The "secure by default" principle was entirely absent. Organizations using Langflow for prototyping or production flows must assume full compromise if they have not yet patched to v1.10.1 or later. The presence of hard-coded credentials (CVE-2026-13446) further complicates the trust model of the software supply chain.

Theme: Model Context Protocol (MCP) Growing Pains

As MCP becomes the standard for connecting LLMs to tools, we are seeing a rash of vulnerabilities stemming from improper trust boundaries between the agent, the MCP server, and the host system. The core issue is that many MCP servers treat configuration inputs or tool parameters as trusted, leading to injection and execution flaws.

  • Command Injection: Multiple servers, including LiteLLM (CVE-2026-30623), LangBot (GHSA-3pvh-63gf-j9mw), and ForgeCode (CVE-2026-57860), allow attackers to specify arbitrary system commands in MCP configurations or tool parameters. ForgeCode is particularly dangerous as it auto-executes commands from .mcp.json files in cloned repositories, creating a potent supply chain attack vector.
  • Multi-Tenant Isolation Failures: The n8n-MCP flaws (CVE-2026-54052, CVE-2026-55608) and MCP Python SDK issues (CVE-2026-52870, CVE-2026-52869) show that session management and data isolation are frequently broken. Attackers can access other tenants' tasks, workflow history, and credentials.
  • SSRF in Agents: AWS HealthLake MCP (CVE-2026-15643), Grafana MCP (CVE-2026-15583), and CrewAI (CVE-2026-62240) all suffer from SSRF vulnerabilities where agent-controlled URLs can be used to probe internal networks or steal cloud metadata credentials.
  • Path Traversal: yutu (GHSA-2c7f-fxww-6w6c) and AWS HealthOmics MCP (CVE-2026-15415) allow arbitrary file writes via unvalidated paths in tool arguments.

Analysis: The MCP ecosystem is maturing too fast, with security controls lagging behind feature development. The assumption that "the agent is trusted" is dangerous when the agent's context can be influenced by external prompts or untrusted repositories. Developers must implement strict allow-lists for commands, sandbox file access, and enforce rigorous session isolation.

Theme: Inference Engine & Model Loading Risks

Vulnerabilities in the underlying inference engines and model loading libraries continue to pose risks, particularly regarding deserialization and resource exhaustion.

  • Unsafe Deserialization: PyTorch Lightning (CVE-2026-58659), NVIDIA TensorRT-LLM (CVE-2026-24233, CVE-2026-24220), and Keras (CVE-2026-12484) all have flaws where loading model weights or checkpoints can trigger arbitrary code execution. The industry's reliance on pickle and similar serialization formats remains a critical weakness.
  • DoS via Resource Exhaustion: vLLM faces multiple issues, including ReDoS via regex compilation (GHSA-rwxx-mrjm-wc2m), OOM via audio decompression bombs (PYSEC-2026-3404), and GPU crashes via invalid token reinjection (GHSA-8wr5-jm2h-8r4f). Ollama (CVE-2026-15685) and NVIDIA Triton (CVE-2026-47479) also have DoS vectors.
  • Data Leakage: vLLM (PYSEC-2026-3403) has a flaw where GGUF dequantization can leak uninitialized GPU memory containing data from other tenants. vLLM also logs authorization headers and chat payloads by default (CVE-2026-15574), risking PII exposure.

Theme: Prompt Injection & Data Integrity

While RCE dominates the headlines, prompt injection and data integrity issues remain prevalent, particularly in plugins and content generation tools.

  • Stored Prompt Injection: The BetterDocs WordPress plugin (CVE-2026-11371) allows unauthenticated attackers to inject malicious payloads into AI-generated summaries, which then execute in the browsers of visitors.
  • Data Leakage via Telemetry: dbt-mcp (CVE-2026-44970) and AWS Bedrock AgentCore (CVE-2026-15737) were found to be logging sensitive data (SQL queries, user prompts) to telemetry or span attributes without redaction.
  • Output Sanitization: FacturaScripts (GHSA-hgjx-r89m-m7v4) and Kiota (CVE-2026-59864) have path traversal issues in file handling components that could be triggered by AI-generated file names or paths.

Known Exploited Items

Fortunately, as of this writing, none of the vulnerabilities disclosed this week are flagged as is_exploited=true in the wild. However, the simplicity of the Langflow exploit chain (a simple HTTP POST to mint a token, followed by another to execute code) suggests that active exploitation is imminent if not already occurring in automated scanning campaigns. The public availability of PoC details for the Langflow and n8n-MCP flaws significantly increases the risk of rapid weaponization.

What to Do This Week

  1. Patch Langflow Immediately: If you run IBM Langflow OSS, treat this as a P0 incident. Upgrade to v1.10.1+ or isolate the instance from all networks. Verify that AUTO_LOGIN and WEBHOOK_AUTH_ENABLE are disabled, but do not rely on config changes alone.
  2. Audit MCP Servers: Inventory all MCP servers in your environment (n8n, LiteLLM, custom implementations). Apply patches for the specific CVEs listed above. Specifically, check for multi-tenant isolation configurations and ensure command execution is restricted to a strict allow-list.
  3. Secure Model Loading: Review pipelines that load external models (PyTorch, Keras, TensorRT). Ensure weights_only=True is enforced where possible, and validate the integrity of checkpoint files via checksums before loading. Consider using safe serialization formats like Safetensors.
  4. Sanitize Agent Inputs: For teams building agentic workflows, implement strict input validation for any tool parameters that involve file paths, URLs, or system commands. Assume the LLM's output can be maliciously influenced.
  5. Review Logging Configurations: Check vLLM, Bedrock AgentCore, and dbt-mcp configurations to ensure sensitive data (prompts, tokens, SQL) is not being logged to plaintext files or unsecured telemetry endpoints.

What to Watch Next Week

Next week, we expect to see the emergence of exploit scripts targeting the Langflow and n8n-MCP vulnerabilities in public repositories. We will also be monitoring for secondary disclosures related to the Cursor IDE binary planting issue, as attackers may begin distributing malicious repositories on GitHub to target developers. Additionally, keep an eye on the MCP specification itself; as these server-side flaws surface, there may be calls for protocol-level changes to enforce better authentication and isolation standards across the ecosystem.

Covered entries (120)