VulnWatch VulnWatch
← All articles
Weekly digest · Aug 17, 2026

VulnWatch Weekly: Critical RCE in MindsDB & Agentic Supply Chain Risks

This week's digest highlights a CVSS 10.0 RCE in MindsDB allowing unauthenticated command execution via LLM prompts. We also analyze critical prototype pollution in Trigger.dev, template injection in Prompty, and widespread SSRF/RCE risks in the emerging Model Context Protocol (MCP) ecosystem.

Prompt Injection Supply Chain Remote Code Execution Data Leakage Auth Bypass SSRF Agentic / MCP

Week in Review: The Age of Agentic Exploitation

Executive Summary The week of August 10–16, 2026, marks a disturbing shift in the AI vulnerability landscape from theoretical prompt injection to concrete, unauthenticated Remote Code Execution (RCE) in production agent platforms. The single most urgent item is CVE-2026-73678 in MindsDB, a CVSS 10.0 vulnerability allowing attackers to execute arbitrary OS commands by submitting crafted prompts to an unprotected endpoint that directly invokes Python's exec(). Beyond this critical outlier, the dominant theme is the fragility of the "agentic" supply chain; we observed multiple high-severity flaws in orchestration layers like Trigger.dev and Flowise where missing authorization checks allow tenants to hijack workflows, pollute global prototypes, and exfiltrate data across trust boundaries. Security teams must immediately pivot from treating LLMs as stateless text processors to securing them as privileged execution engines capable of modifying host state.

Top Items of the Week

The following vulnerabilities represent the highest immediate risk to AI infrastructure. Prioritize patching or mitigating these items before the next sprint.

  1. CVE-2026-73678 (MindsDB)

    • Severity: Critical (CVSS 10.0)
    • Component: Minds Platform (Agent Scratchpad)
    • Impact: Unauthenticated Remote Code Execution. Attackers can configure their own LLM keys and submit prompts that trigger the Anton agent's scratchpad tool, executing arbitrary Python code via exec() without sandboxing.
    • Action: Upgrade to MindsDB > 26.1.0 immediately. If patching is delayed, block external access to /api/v1/responses/ and /api/v1/settings/ at the WAF level.
    • Source

  2. CVE-2026-73299 (Prompty)

    • Severity: Critical (CVSS 10.0)
    • Component: TypeScript Nunjucks Renderer
    • Impact: Server-Side Template Injection (SSTI) leading to RCE. Untrusted .prompty files are evaluated with unrestricted JavaScript member access, allowing prototype traversal and code execution in the host Node.js process.
    • Action: Update Prompty to v0.1.5 or v2.0.0-beta.5. Audit all stored prompt templates for untrusted input sources.
    • Source

  3. CVE-2026-73656 (Trigger.dev)

    • Severity: Critical (CVSS 9.9)
    • Component: Deployment Background Worker Service
    • Impact: Horizontal Privilege Escalation / Tenant Isolation Break. Attackers with a valid API key for one project can link their background workers to victim deployments by exploiting a missing environmentId predicate.
    • Action: Upgrade Trigger.dev to v4.5.6. Review logs for cross-project deployment ID enumeration.
    • Source

  4. CVE-2026-73032 (PapersGPT for Zotero)

    • Severity: Critical (CVSS 9.4)
    • Component: Views Module (window.eval)
    • Impact: RCE via Prompt Injection. Malicious code returned from an LLM endpoint is passed unsanitized to window.eval(), executing in Zotero's chrome-privileged context.
    • Action: Update PapersGPT to > 0.6.1. Disable custom LLM endpoints until patched.
    • Source

  5. CVE-2026-72776 (AgenticSeek)

    • Severity: Critical (CVSS 9.3)
    • Component: Query API (/query)
    • Impact: Unauthenticated RCE. The autonomous agent executes shell commands via subprocess.Popen(shell=True) based on unauthenticated HTTP requests, bypassing incomplete blocklists.
    • Action: Restrict network access to port 7777. Upgrade AgenticSeek immediately.
    • Source

  6. CVE-2026-73654 (Trigger.dev)

    • Severity: High (CVSS 8.5)
    • Component: Run Metadata API
    • Impact: Prototype Pollution. Attacker-controlled operation.key values allow pollution of Object.prototype, corrupting Prisma queries and breaking tenant authentication.
    • Action: Upgrade to v4.5.6. Implement strict input validation on JSON path segments.
    • Source

  7. CVE-2026-73487 (Flowise)

    • Severity: Critical (CVSS 9.0)
    • Component: CSV and Airtable Agent Nodes
    • Impact: Validator Bypass leading to SSRF/Data Exfiltration. Regex-based validation fails to block malicious pandas functions like pd.read_json() injected via prompts.
    • Action: Upgrade Flowise to v3.1.3+. Disable unauthenticated prediction APIs.
    • Source

  8. CVE-2026-72642 (Elasticsearch)

    • Severity: High (CVSS 8.8)
    • Component: Native Inference Process
    • Impact: Heap Corruption / Potential RCE. Crafted ML models can compute memory addresses outside allocation bounds during inference.
    • Action: Restrict model upload privileges. Apply vendor patches for Elasticsearch ML modules.
    • Source

Theme: The Agentic Supply Chain Crisis

The most alarming trend this week is the systemic failure of isolation mechanisms in AI agent orchestration platforms. As organizations adopt tools like Trigger.dev, Flowise, and AutoGPT to chain LLM calls with external tools, the attack surface has expanded from the model itself to the glue code binding them.

Trigger.dev suffered a trifecta of vulnerabilities this week. Beyond the critical tenant isolation break (CVE-2026-73656), we identified CVE-2026-73654, a classic Prototype Pollution vulnerability in the metadata handling logic. By injecting __proto__ keys into the operation.key field, an authenticated attacker can corrupt the shared Node.js runtime, affecting all tenants on the instance. Furthermore, CVE-2026-73658 reveals a path traversal issue in the S3 presigning logic, where URL normalization allows attackers to access objects outside their designated bucket prefixes. Finally, CVE-2026-73655 demonstrates an account takeover vector via Google OAuth, where the platform fails to verify email_verified claims, allowing attackers to link unverified emails to existing accounts.

Similarly, Flowise continues to struggle with the complexity of sanitizing dynamic code execution within its agent nodes. CVE-2026-73487 highlights the danger of regex-based allowlists; attackers simply switched from blocked functions to allowed pandas methods that still facilitate SSRF or file reads. This is compounded by CVE-2026-71962, where a missing authorization check in the OpenAI Assistants file download endpoint allows unauthenticated users to retrieve private files from any chatflow on the instance simply by guessing IDs.

AutoGPT also exposed a significant logic flaw in CVE-2026-72922. The webhook ingress router selects the verification manager based on an untrusted URL segment. An attacker can force the system to use a "no-op" verifier instead of the strict signature checker, effectively bypassing webhook security entirely. These incidents collectively suggest that the "low-code" agent builders are currently outpacing their security maturity, creating high-risk environments for enterprise data.

Theme: Model Context Protocol (MCP) & Tooling Risks

The Model Context Protocol (MCP) is rapidly becoming the standard for connecting LLMs to local resources, but this week's entries reveal it is also becoming a primary vector for local privilege escalation and SSRF.

Multiple MCP servers were found to blindly trust user input when executing system commands. GHSA-49mq-fc6q-3h46 in token-optimizer-mcp allows OS command injection via the username parameter in a shell command constructed with execAsync(). Similarly, GHSA-49m4-vp58-wgc9 in stata-mcp permits Stata command injection through the package argument, leading to full OS-level execution. These vulnerabilities underscore a critical development error: treating LLM-generated or user-supplied strings as safe for interpolation into shell contexts.

SSRF remains a pervasive issue in this category. CVE-2026-49857 in auth-fetch-mcp demonstrates a subtle bypass of IPv6 protection logic; by using IPv4-mapped IPv6 addresses (e.g., ::ffff:127.0.0.1), attackers can trick the server into accessing localhost resources. CVE-2026-19753 in mcp-rdf-explorer and CVE-2026-73498 in MCP Atlassian further illustrate how file path and URL parameters are often passed directly to underlying APIs without validation, enabling data exfiltration.

Even established IDEs are not immune. Cursor IDE had two high-severity issues: CVE-2026-73217 allows an agent in sandbox mode to replace the Python executable in a virtual environment, escaping the sandbox, while CVE-2026-73218 allows the agent to launch privileged Docker containers mounting the host's home directory. These bugs effectively neutralize the "sandbox" promise of AI coding assistants.

Theme: Inference Engine & Data Leakage

At the infrastructure layer, inference engines and vector stores showed signs of strain under adversarial load. vLLM had a particularly rough week with multiple Denial of Service (DoS) and data leakage vectors. CVE-2026-73559 allows an authenticated user to exhaust CPU and memory by sending a request with an unbounded list of prompts, causing the engine to spawn a generator for each. More concerning is CVE-2026-73558, an integer overflow in the CUDA kernel that can cause one user's request to inadvertently receive another user's inference results—a severe multi-tenant data leakage bug.

Elasticsearch and Kibana also reported significant issues. CVE-2026-72675 in Kibana Machine Learning fails to apply space filters correctly, allowing users to access ML data across different logical spaces. In Elasticsearch, CVE-2026-72642 (mentioned above) poses a risk of heap corruption via crafted model offsets.

Data leakage was also evident in TypeBot (CVE-2026-48766), where low-privilege guests could exfiltrate stored OpenAI API keys by manipulating the baseUrl parameter in model-listing calls. This highlights the danger of dynamic configuration options in multi-tenant SaaS AI wrappers.

Theme: Prompt Injection Evolution

While RCE grabs headlines, prompt injection remains the root cause of many exploits. CVE-2026-73032 (PapersGPT) and CVE-2026-73487 (Flowise) show that injection is no longer just about tricking the model into saying something rude; it is now a reliable mechanism for driving tool use and code execution.

Notably, CVE-2026-21832 in HCL AION demonstrates "indirect" prompt injection leading to HTML injection in rendered output, proving that the attack chain can extend from the LLM input to the final user interface, potentially facilitating XSS attacks against human users. The Prompty vulnerability (CVE-2026-73299) is particularly insidious because the injection happens at the template rendering stage, before the prompt even reaches the LLM, bypassing many runtime guardrails.

Known Exploited Items

  • Status: As of this week, there are no entries in our dataset marked with is_exploited=true.
  • Analysis: While active exploitation in the wild has not yet been confirmed for these specific CVEs, the simplicity of the exploit chains (particularly for MindsDB and AgenticSeek) suggests that weaponization is imminent. The MindsDB vulnerability, for instance, requires only an HTTP POST request with a crafted JSON body. Security teams should assume these are "weaponizable" within 48 hours of disclosure.

What to Do This Week

  1. Patch MindsDB and Trigger.dev Immediately: These are your highest priority. The MindsDB RCE is trivial to exploit, and the Trigger.dev isolation breaks compromise the integrity of your entire agent workflow platform.
  2. Audit MCP Servers: Inventory all Model Context Protocol servers running in your environment. Specifically, check for versions of token-optimizer-mcp, stata-mcp, and auth-fetch-mcp. If you cannot patch immediately, disable the specific tools that accept file paths or shell arguments.
  3. Enforce Strict Input Validation on Agent Tools: Review the code for any custom tools exposed to your LLM agents. Ensure that no string interpolation is used to construct shell commands or SQL queries. Use parameterized APIs exclusively.
  4. Isolate Inference Engines: For vLLM and similar engines, implement rate limiting on the prompt array size at the load balancer level to prevent the DoS conditions described in CVE-2026-73559.
  5. Review OAuth Flows: If you use Google OAuth for agent platforms (like Trigger.dev), enforce strict email_verified checks in your identity provider configuration and application logic.

What to Watch Next Week

Next week, we anticipate a surge in reports regarding "Model Poisoning" in the open-source weight repositories. With the increased focus on supply chain security, expect researchers to publish proofs-of-concept showing how malicious tensors in Hugging Face models can trigger the memory corruption bugs seen in Elasticsearch and vLLM. Additionally, keep an eye on Cross-Tenant Prompt Leakage in multi-tenant SaaS LLM gateways, as the logic errors seen in TypeBot and Flowise are likely present in other wrapper services. Finally, monitor the PostgreSQL ecosystem closely; the type confusion vulnerability (CVE-2026-16239) reported this week could have downstream effects on any AI application using Postgres as a vector store or state backend.

Covered entries (68)