VulnWatch VulnWatch
← All articles
Weekly digest · Aug 3, 2026

VulnWatch Weekly: The Agentic Apocalypse & Supply Chain Meltdown

This week marks a turning point for AI security with critical RCEs in Langflow, Flyto2, and sentence-transformers. The dominant theme is the collapse of trust boundaries in agentic workflows, demanding immediate patching of model serving and orchestration layers.

Prompt Injection Remote Code Execution Data Leakage Auth Bypass SSRF Agentic / MCP

Week in Review: The Agentic Apocalypse

Executive Summary The week of July 27–August 2, 2026, will be remembered as the moment the "agentic dream" collided with the reality of insecure infrastructure. The dominant theme is the systemic failure of trust boundaries in AI orchestration layers, specifically within the Model Context Protocol (MCP) ecosystem and popular workflow engines like Langflow and Flyto2. While supply-chain risks in model loading (sentence-transformers, transformers) reached critical severity, the single most urgent item for CISOs is the cluster of unauthenticated Remote Code Execution (RCE) vulnerabilities in IBM Langflow OSS and Flyto2 Core, which allow attackers to hijack agent environments, exfiltrate API keys, and pivot to internal networks with trivial effort.

Top Items of the Week

The following vulnerabilities represent the highest immediate risk to AI/ML platforms. Prioritize these patches before end-of-day.

  1. GHSA-2956-977x-2w3r (Flyto2 Core)

    • Severity: Critical (CVSS 10.0)
    • Component: image.download module
    • Impact: Arbitrary file write. Attackers can write malicious payloads to any path writable by the process, bypassing sandbox constraints entirely.
    • Action: Upgrade Flyto2 Core to v2.26.6+ immediately. Audit output_dir configurations for write permissions.
    • Source

  2. CVE-2026-12946 & CVE-2026-13435 (IBM Langflow OSS)

    • Severity: Critical (CVSS 9.9)
    • Component: PythonREPL sandbox & Input Validation
    • Impact: Unauthenticated arbitrary code injection. The sandbox fails to restrict user input, allowing full host compromise.
    • Action: Patch to Langflow 1.10.2+ or disable external code execution modules if patching is delayed.
    • Source 1 | Source 2

  3. CVE-2026-12940 (IBM Langflow OSS)

    • Severity: Critical (CVSS 9.8)
    • Component: MCP stdio launcher
    • Impact: Unauthenticated RCE via environment variable injection (SHELLOPTS, BASHOPTS).
    • Action: Apply vendor patch; restrict environment variable inheritance in MCP launcher configurations.
    • Source

  4. CVE-2026-68770 (sentence-transformers)

    • Severity: Critical (CVSS 9.3)
    • Component: import_module_class helper
    • Impact: Security control bypass leading to RCE. The trust_remote_code=False flag is ignored if a local path exists, allowing execution of malicious modeling_*.py files.
    • Action: Upgrade sentence-transformers; enforce strict filesystem isolation for model directories.
    • Source

  5. GHSA-qq9q-xgm3-xv9g (Flyto2 Core)

    • Severity: High (CVSS 8.6)
    • Component: llm.chat module
    • Impact: Credential exfiltration. Provider API keys (OpenAI, Anthropic) are sent to attacker-controlled base_url endpoints.
    • Action: Upgrade to v2.26.6; audit logs for outbound requests to unknown domains.
    • Source

  6. CVE-2026-17351 (pgAdmin 4)

    • Severity: Critical (CVSS 9.4)
    • Component: AI Assistant SQL execution
    • Impact: Indirect prompt injection leading to SQL injection and potential RCE. Bypasses read-only transaction wrappers via sqlparse discrepancies.
    • Action: Upgrade pgAdmin 4 to 9.17+; disable AI Assistant features until patched.
    • Source

  7. CVE-2026-51263 (ESP32-audioI2S)

    • Severity: Critical (CVSS 9.8)
    • Component: Audio::openai_speech
    • Impact: Heap buffer overflow via oversized JSON construction. Allows remote code execution on edge IoT devices.
    • Action: Update firmware to v3.4.6+; implement input length validation at the gateway.
    • Source

  8. CVE-2026-67431 (MCP Ruby SDK)

    • Severity: High (CVSS 8.3)
    • Component: StreamableHTTPTransport
    • Impact: Session hijacking. Lack of session owner binding allows attackers with stolen IDs to execute tools in victim sessions.
    • Action: Upgrade MCP Ruby SDK to v0.23.0; rotate all active session tokens.
    • Source

Thematic Analysis: The Collapse of Agentic Trust

The Model Context Protocol (MCP) Crisis

This week exposed a foundational fragility in the rapidly adopted Model Context Protocol. Multiple vulnerabilities in the MCP Ruby SDK and related servers indicate that the protocol's transport layer was designed with an assumption of trusted networks that no longer holds.

The most severe issue, CVE-2026-67431, reveals that session IDs are not bound to session owners. In a practical attack scenario, an attacker who intercepts a session ID (via logs or network sniffing) can seamlessly inject tool calls into a running agent session. This is compounded by CVE-2026-63118 and GHSA-rjr6-rcgv-9m7m, which highlight a complete lack of Host/Origin validation in the HTTP transport. This enables DNS rebinding attacks where a malicious webpage can force a user's browser to connect to a locally running MCP server, invoking tools with the user's privileges. Furthermore, CVE-2026-67432 and CVE-2026-63119 demonstrate that unbounded buffer reads in both HTTP and stdio transports can lead to trivial Denial of Service (DoS) via memory exhaustion.

Recommendation: Treat MCP servers as public-facing internet services. Implement strict allow-listing for Host headers, enforce session ownership validation, and apply byte limits on all input streams.

Orchestration Engines: Flyto2 and Langflow Under Siege

The orchestration layer, responsible for chaining LLM calls and tools, has become the primary attack surface for RCE. Flyto2 Core suffered a catastrophic week with multiple critical flaws. Beyond the arbitrary file write (GHSA-2956-977x-2w3r), the llm.chat module (GHSA-qq9q-xgm3-xv9g) blindly trusts the base_url parameter, sending sensitive API keys to attacker-controlled servers. Even more insidious is GHSA-hr7p-wg7r-hg9m, where the variable resolver bypasses capability deny-lists by expanding ${env.VAR} syntax, effectively nullifying security policies designed to protect secrets.

Similarly, IBM Langflow OSS is plagued by a suite of vulnerabilities allowing unauthenticated RCE (CVE-2026-12946, CVE-2026-13435, CVE-2026-12940). The PythonREPL sandbox, intended to isolate code execution, fails to validate input properly, while the MCP launcher leaks control via environment variables. Additionally, multi-tenant isolation is broken (CVE-2026-13444, CVE-2026-13442), allowing attackers to access or poison vector stores (Chroma, FAISS) belonging to other users simply by guessing collection names.

Supply Chain & Model Loading Risks

The assumption that "loading a model" is a safe operation has been shattered. CVE-2026-68770 in sentence-transformers is a paradigm-shifting bug: the library's safety check trust_remote_code=False is bypassed if the model path exists on the local filesystem. This allows an attacker who can write a malicious directory structure (e.g., via a compromised cache or download) to execute arbitrary Python code during model initialization. Similarly, CVE-2026-9856 in huggingface/transformers allows arbitrary file writes, and CVE-2026-61536 in the banks framework allows unrestricted Python imports via tool definitions. These vulnerabilities confirm that model artifacts must be treated as executable code, not static data.

Prompt Injection Evolves to SQLi and RCE

Prompt injection is no longer just about leaking system prompts; it is now a direct vector for infrastructure compromise. CVE-2026-17351 in pgAdmin 4 demonstrates how an LLM-generated SQL query can bypass parser-level protections (sqlparse vs. PostgreSQL parser mismatch) to break out of read-only transactions and execute destructive commands. In the Dynatrace MCP Server (GHSA-pqh8-p93p-2rx7, GHSA-xrmj-5g4g-8987), prompt injection allows attackers to inject DQL queries and Jinja2 templates, persisting malicious workflows and exfiltrating data long after the initial session ends. The Kimi Code vulnerability (CVE-2026-17534) further shows how SSRF protections can be bypassed via DNS resolution tricks in fetch tools, allowing agents to scan internal networks.

Data Leakage and DoS in Edge & Tooling

Edge AI devices are not immune. The ESP32-audioI2S buffer overflow (CVE-2026-51263) proves that unvalidated string concatenation in IoT firmware can lead to remote takeover. On the software side, GHSA-6hxr-mr5r-9836 in the re2 Node.js bindings reveals a regex engine flaw where global matches on empty strings cause infinite loops and memory exhaustion, blocking the event loop. Additionally, CVE-2026-50736 and CVE-2026-50737 in pglogical highlight how replication mechanisms can be abused for privilege escalation to superuser, a critical risk for shared database deployments hosting AI workloads.

Known Exploited Items

While no entries in this week's dataset are flagged with is_exploited=true, the nature of these vulnerabilities—specifically the unauthenticated RCEs in Langflow and the credential theft in Flyto2—suggests a high probability of imminent wild exploitation. The low barrier to entry (often requiring only a crafted HTTP request or a specific prompt) means threat actors will likely weaponize these within days. Security teams should operate under the assumption that active scanning for these versions is already underway.

What to Do This Week

  1. Emergency Patching: Prioritize updates for Langflow, Flyto2, sentence-transformers, and MCP SDKs. These are not routine updates; they address fundamental breaks in security logic.
  2. Network Segmentation: Isolate MCP servers and agent orchestration engines from the public internet. Use strict egress filtering to prevent base_url SSRF attacks from reaching internal metadata services.
  3. Audit Model Sources: Verify the integrity of all locally stored models. Ensure that model directories are not writable by untrusted users or processes to mitigate the sentence-transformers bypass.
  4. Review Environment Variables: Audit workflows for ${env.VAR} usage. Explicitly deny-list sensitive variables in capability policies and monitor for unexpected outbound traffic containing secret patterns.
  5. Disable High-Risk Features: If patching is not immediately possible, disable the AI Assistant in pgAdmin, turn off external code execution in Langflow, and restrict trust_remote_code globally in transformer pipelines.

What to Watch Next Week

Expect vendors to release follow-up patches addressing the cascading effects of these vulnerabilities, particularly in the MCP ecosystem where session management and transport security need a complete overhaul. Watch for new advisories regarding vector database poisoning as the Langflow multi-tenant issues gain attention. Additionally, be prepared for potential supply-chain attacks leveraging the file-write vulnerabilities in transformers and Flyto2 to distribute malicious model weights via public repositories. The focus must shift from "prompt safety" to "infrastructure hardening" as the attack surface expands beyond the LLM itself.

Covered entries (58)