VulnWatch VulnWatch
← All articles
Weekly digest · Aug 10, 2026

VulnWatch Weekly: The Flowise Apocalypse & Active Langflow Exploitation

This week marks a critical turning point for AI platform security with a massive cluster of RCE vulnerabilities in Flowise and active exploitation of IBM Langflow. Immediate patching is required for model serving stacks and agentic frameworks.

Prompt Injection Remote Code Execution Data Leakage Model Poisoning Auth Bypass SSRF Agentic / MCP

Week in Review: The Supply Chain Collapses

The week of August 3–9, 2026, will be remembered as one of the most catastrophic periods for AI infrastructure security in recent history. The dominant theme is unequivocally the systemic collapse of trust in low-code AI orchestration platforms, spearheaded by a devastating cluster of over fifteen critical vulnerabilities in Flowise, ranging from prompt injection to full remote code execution (RCE). Simultaneously, the threat landscape shifted from theoretical to kinetic with the confirmation that IBM Langflow vulnerabilities are being actively exploited in the wild, necessitating immediate incident response for any deployment of that software. While model serving layers like llama.cpp revealed deep memory safety issues, the most urgent item for CISOs this week is the active exploitation of Langflow (CVE-2026-9198); if you are running Langflow OSS 1.0.0–1.10.3, assume compromise and isolate immediately.

Top Items of the Week

The following entries represent the highest impact risks identified this week. These items demand immediate attention from platform engineering and security operations teams.

  1. CVE-2026-9198 (IBM Langflow Code Injection)

    • Severity: Critical (CVSS 9.8)
    • Status: KNOWN EXPLOITED (CISA KEV)
    • Component: IBM Langflow OSS
    • Impact: Unauthenticated attackers can achieve full remote code execution on default deployments.
    • Action: Isolate affected instances immediately. Upgrade to the latest patched version or disable the vulnerable component if a patch is unavailable. Review logs for unauthorized code execution attempts.
    • Source: NVD

  2. CVE-2026-70477 & CVE-2026-70470 (Flowise Prompt Injection & Validator Bypass)

    • Severity: Critical (CVSS 9.5)
    • Component: Flowise (CSV Agent Node)
    • Impact: Prompt injection allows attackers to bypass blocklist validators using Unicode homoglyphs, leading to arbitrary Python execution in Pyodide and subsequent OS command execution.
    • Action: Upgrade Flowise to version 3.1.3 or later immediately. Audit all chatflows utilizing CSV or Airtable agents for suspicious logic.
    • Source: NVD - 70477 | NVD - 70470

  3. CVE-2026-48168 (PraisonAI Command Injection)

    • Severity: Critical (CVSS 10.0)
    • Component: PraisonAI (GitHub Actions Workflow)
    • Impact: Command injection via unquoted branch names in GitHub Actions allows arbitrary shell code execution by outside contributors.
    • Action: Update PraisonAI to version 4.6.40+. Review GitHub Actions logs for unauthorized workflow triggers from forked repositories.
    • Source: NVD

  4. CVE-2026-61808 (LightRAG Unauthenticated Access)

    • Severity: Critical (CVSS 9.8)
    • Component: LightRAG API Server
    • Impact: Default configuration binds to all interfaces with no authentication, allowing full read/write access to knowledge graphs and LLM resources.
    • Action: Upgrade to 1.5.5rc1. Immediately firewall port 8000 (or custom config) to trusted networks only if upgrading is not instantly possible.
    • Source: NVD

  5. CVE-2026-67531 (FrontMCP Sandbox Escape)

    • Severity: Critical (CVSS 9.3)
    • Component: FrontMCP (Model Context Protocol)
    • Impact: ECMAScript Proxy invariant failure allows scripts to escape the sandbox via Zod schema instances, achieving RCE in the server process.
    • Action: Upgrade FrontMCP to version 1.5.7+. Audit custom MCP tools for untrusted code execution paths.
    • Source: NVD

  6. CVE-2026-43631 & CVE-2026-43629 (llama.cpp Use-After-Free & Overflow)

    • Severity: Critical (CVSS 9.2)
    • Component: llama.cpp (llama-server)
    • Impact: Race conditions and heap overflows in tokenization and KV cache restore paths allow unauthenticated RCE or DoS.
    • Action: Upgrade llama.cpp builds immediately. Disable --sleep-idle-seconds until patched if upgrade is delayed.
    • Source: NVD - 43631 | NVD - 43629

  7. CVE-2026-14526 (WordPress AI Copilot Auth Bypass)

    • Severity: Critical (CVSS 9.8)
    • Component: AI Copilot – Content Generator Plugin
    • Impact: Unauthenticated attackers can create administrator accounts and achieve full site takeover via malicious workflow nodes.
    • Action: Update the plugin immediately. Audit user accounts for unauthorized admins created in the last 48 hours.
    • Source: NVD

The Flowise Catastrophe: A Platform Compromised

This week, the security community witnessed what can only be described as a total systemic failure of the Flowise platform. Prior to version 3.1.3, Flowise contained a staggering array of vulnerabilities that effectively nullified any security boundary between a user and the host operating system. The sheer volume of critical issues suggests a fundamental lack of secure coding practices in the handling of user-defined logic and external data.

The most severe vector involves the CSV Agent and Airtable Agent nodes. Vulnerabilities such as CVE-2026-70477 and CVE-2026-69256 demonstrate how prompt injection can coerce an LLM into generating malicious Python code. Crucially, the built-in validator (validatePythonCodeForDataFrame) was trivially bypassed using Unicode homoglyphs (CVE-2026-70470), allowing arbitrary code execution within the Pyodide environment. Because Pyodide was configured with access to the Node.js js bridge, attackers could break out of the Python sandbox entirely, importing child_process and executing OS commands as the root user running the container.

The attack surface extended far beyond code execution nodes. The SQLite Record Manager node (CVE-2026-69259) allowed authenticated attackers to overwrite the database path, writing arbitrary files to sensitive locations like /etc/chromium/. Similarly, the TypeORM DataSource configuration (CVE-2026-69251) permitted arbitrary connection options, facilitating database takeover. Perhaps most alarming was the exposure of credentials; the OAuth2 token refresh endpoint (CVE-2026-70478) was unauthenticated, allowing attackers to steal access tokens for connected services simply by knowing a credential ID. Furthermore, the /api/v1/upsert-history endpoint (CVE-2026-70473) leaked server-wide vector store configurations, including Qdrant URLs and collection names, to any authenticated user.

Supply chain risks within Flowise were also evident. The mitigation for a previous MCP vulnerability (CVE-2025-8943) was completely bypassed (CVE-2026-69263) by using npm_config_yes=true instead of the blocked --yes flag, reinstating the risk of arbitrary package installation during MCP server startup. Additionally, SSRF protections were rendered useless (CVE-2026-69257) due to a failure to normalize IPv4-mapped IPv6 addresses, allowing attackers to access cloud metadata services and localhost endpoints.

Active Exploitation: The Langflow Emergency

While Flowise represents a potential disaster, IBM Langflow represents an active one. The inclusion of CVE-2026-9198 in the CISA Known Exploited Vulnerabilities (KEV) catalog changes the posture required for this software from "patch when convenient" to "incident response now." This vulnerability allows unauthenticated attackers to inject and execute arbitrary code on default Langflow deployments.

The scope of the Langflow issues this week is breathtakingly broad, indicating a fragile security architecture. Multiple vectors exist for authenticated attackers to escalate privileges or execute code, including improper validation of Python code during AST scanning (CVE-2026-17632), cryptographic weaknesses in component validation (CVE-2026-9201), and command injection via MCP server configurations (CVE-2026-17623). Data leakage is also rampant; the MemoryComponent suffers from an authorization bypass (CVE-2026-9130) allowing cross-user chat history access, while path traversal vulnerabilities (CVE-2026-8183, CVE-2026-7646) allow reading of JWT secrets and environment variables. The presence of SSRF vulnerabilities in the Ollama provider validation (CVE-2026-9081) further exposes internal networks. Organizations must assume that any Langflow instance exposed to the internet prior to patching is compromised.

Model Serving & Infrastructure Instability

The foundational layer of local AI inference, llama.cpp, faced a severe reliability crisis this week. Multiple critical memory corruption vulnerabilities were disclosed affecting builds between b1283 and b9060. The most dangerous of these, CVE-2026-43631 and CVE-2026-43632, involve use-after-free conditions in the llama-server vocab handling, specifically triggered when the --sleep-idle-seconds feature is active. These race conditions can be weaponized for remote code execution. Additionally, heap buffer overflows in the KV cache state restore path (CVE-2026-43629) and integer overflows in batch initialization (CVE-2026-43627) provide attackers with reliable primitives to crash servers or hijack execution flow. Android-specific bindings also suffered from integer overflows (CVE-2026-70638) and double-free errors (CVE-2026-43622), threatening mobile AI applications.

Beyond llama.cpp, other infrastructure components showed significant weaknesses. LightRAG shipped with authentication disabled by default on all interfaces (CVE-2026-61808), a configuration error that essentially invites data exfiltration. Milvus vector database installations were found vulnerable to unauthenticated denial of service via a protected management endpoint (CVE-2026-69111), allowing attackers to shut down proxy and query nodes remotely. Emlog Pro disabled TLS certificate validation entirely (CVE-2026-67598), exposing API keys and model weights to man-in-the-middle attacks on any network path.

Agentic Risks and Supply Chain Poisoning

As AI agents become more autonomous, the attack surface expands into the tools they wield. The Model Context Protocol (MCP) ecosystem saw several critical failures. FrontMCP's sandbox escape (CVE-2026-67531) via Zod schema manipulation is a stark reminder that JavaScript sandboxes are fragile. Meta Ads MCP (CVE-2026-48039) and IBM Langflow MCP (CVE-2026-8446) both suffered from authentication bypasses, allowing unauthorized control over ad spend and internal tooling. Amazon Strands Agents faced prompt injection risks in shell tools (CVE-2026-18733) and insecure direct object references in memory tools (CVE-2026-19111), enabling cross-tenant data access.

Supply chain integrity remains a primary concern. Hugging Face PEFT libraries (CVE-2026-71281) were found to use torch.load() without weights_only=True, allowing malicious LoRA adapters to execute code upon loading. NLTK's downloader (CVE-2026-12261) is vulnerable to model poisoning, where attackers could replace legitimate resources with compromised versions. Even development workflows are at risk, with PraisonAI's GitHub Actions vulnerable to command injection (CVE-2026-48168) and Mistral Vibe susceptible to RCE via malicious git hooks (CVE-2026-67623).

What to Do This Week

  1. Emergency Langflow Response: If you run IBM Langflow OSS, treat it as compromised. Isolate instances from the internet immediately. Apply patches for CVE-2026-9198 and the associated cluster of auth/code injection flaws. Rotate all API keys, database credentials, and JWT secrets stored on or accessible by the Langflow instance.
  2. Upgrade Flowise Immediately: Move all Flowise deployments to version 3.1.3 or later. The combination of RCE, SSRF, and auth bypasses makes previous versions untenable. Audit existing chatflows for any custom code nodes that may have been injected by attackers.
  3. Harden Model Serving: Update llama.cpp to the latest build. Disable --sleep-idle-seconds until you have confirmed the patch level. Ensure llama-server is not exposed directly to untrusted networks without a reverse proxy handling authentication.
  4. Audit MCP Configurations: Review all Model Context Protocol server configurations. Ensure that authentication is explicitly enabled and that environment variables do not contain sensitive credentials that could be leaked via error messages or debug endpoints.
  5. Validate TLS Settings: Check configurations for Emlog Pro and other AI plugins to ensure CURLOPT_SSL_VERIFYPEER is enabled. Man-in-the-middle attacks on AI traffic are now trivial if this is neglected.

What to Watch Next Week

Next week, expect a surge in automated scanning tools targeting the specific unauthenticated endpoints identified in Flowise and Langflow. We anticipate seeing ransomware groups attempting to leverage the RCE chains in llama.cpp and Flowise to encrypt model weights and vector databases. Additionally, monitor for new disclosures regarding data poisoning in the Hugging Face ecosystem, as the torch.load vulnerability may lead to widespread contamination of shared adapters. Finally, keep an eye on the Model Context Protocol specification itself; the frequency of implementation errors suggests the standard may need stricter security mandates for sandboxing and authentication.

Covered entries (116)