VulnWatch VulnWatch
← All articles
Weekly digest · Aug 24, 2026

VulnWatch Weekly: The Week of Unsafe Eval, Agent RCE, and Active SSRF

This week's digest highlights a critical wave of Remote Code Execution (RCE) vulnerabilities in LLM inference servers, driven by unsafe deserialization and dynamic code evaluation. Most urgently, CISA has added an actively exploited MLflow SSRF flaw to its KEV catalog, demanding immediate patching for all exposed instances.

Prompt Injection Supply Chain Remote Code Execution Data Leakage Auth Bypass SSRF Agentic / MCP

Week in Review: August 17 – August 23, 2026

Executive Summary

The security landscape for AI infrastructure faced a perfect storm this week, characterized by a surge in critical Remote Code Execution (RCE) vulnerabilities within core inference and agent orchestration layers. The dominant theme is the fragility of trust boundaries in agentic systems: from unsafe eval() usage in tool parsing to pickle deserialization in distributed serving, attackers can now pivot from prompt injection to full server compromise with alarming ease. While the volume of high-severity RCEs is staggering, the single most urgent item for all CISOs and platform teams is CVE-2026-64849, a Server-Side Request Forgery (SSRF) vulnerability in MLflow that has been confirmed as actively exploited and added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Immediate isolation and patching of MLflow instances are required.

Beyond the immediate fire-fighting, this week exposed a systemic issue in the "Agentic Supply Chain." Multiple vulnerabilities in MCP (Model Context Protocol) servers and agent frameworks (Omnigent, LangBot, CodeWhale) demonstrate that granting LLMs access to shell tools or file systems without rigorous sandboxing is resulting in trivial bypasses. Whether through path traversal in file tools or argument injection in git commands, the assumption that an LLM will "follow instructions safely" has been decisively debunked by this week's CVEs.

Top Items of the Week

The following entries represent the highest impact risks identified between August 17 and August 23. These items demand immediate attention from security engineering teams.

  1. CVE-2026-64849 (MLflow SSRF - Actively Exploited)

    • Severity: High (CVSS 9.3)
    • Component: MLflow Tracking Server
    • Impact: Allows attackers to reach internal cloud metadata services and exfiltrate credentials. Status: Known Exploited.
    • Action: Patch immediately to version 3.15.0+ or restrict network access to the MLflow server. See NVD Detail.

  2. CVE-2026-61539 / GHSA-x2rj-828p-hx9m (Xinference RCE)

    • Severity: Critical (CVSS 10.0)
    • Component: Xinference (Llama3 Tool Parser)
    • Impact: Unauthenticated RCE via unsafe eval() of model-generated tool calls. An attacker can craft a prompt that forces the model to output malicious Python code, which the server then executes.
    • Action: Upgrade Xinference immediately. If patching is delayed, disable tool calling capabilities or place the service behind a strict WAF that blocks Python syntax in tool arguments. See GitHub Advisory.

  3. CVE-2026-76850 (LMDeploy Pickle Deserialization)

    • Severity: Critical (CVSS 9.3)
    • Component: LMDeploy (Disaggregated Serving)
    • Impact: RCE via pickle deserialization in peer-to-peer ZMQ messages. Any connected peer can send a malicious payload to execute code on the engine.
    • Action: Isolate LMDeploy clusters from untrusted networks. Upgrade to the patched version which implements strict message validation before deserialization. See NVD Detail.

  4. CVE-2026-39909 (llama.cpp Use-After-Free)

    • Severity: Critical (CVSS 9.2)
    • Component: llama.cpp (RPC Server)
    • Impact: Unauthenticated RCE via use-after-free in the GRAPH_RECOMPUTE handler. Allows arbitrary read/write and subsequent code execution.
    • Action: Update llama.cpp to build b8585 or later. Disable the RPC server if not strictly required. See NVD Detail.

  5. CVE-2026-75110 (MemOS Auth Bypass)

    • Severity: Critical (CVSS 9.3)
    • Component: MemOS (Memory Operating System)
    • Impact: Authentication bypass allowing unauthenticated remote attackers to gain "all" scopes if INTERNAL_SERVICE_SECRET is unset. Effectively grants full admin access.
    • Action: Ensure INTERNAL_SERVICE_SECRET is explicitly set in all deployments. Upgrade to the fixed version. See NVD Detail.

  6. CVE-2026-77776 (Headroom LLM Proxy IDOR)

    • Severity: Critical (CVSS 9.3)
    • Component: Headroom LLM Proxy
    • Impact: Broken Access Control. Attackers can read/write other users' LLM memory by simply spoofing the x-headroom-user-id header.
    • Action: Upgrade Headroom proxy. Implement strict header validation at the load balancer level to strip or verify user identity headers. See NVD Detail.

  7. CVE-2026-75625 (Kraken Agent Supply Chain Poisoning)

    • Severity: Critical (CVSS 9.1)
    • Component: Kraken Agents (P2P Blob Download)
    • Impact: Supply chain poisoning. Agents fail to verify SHA-256 digests, relying only on CRC32, allowing attackers to inject malicious container layers.
    • Action: Patch Kraken agents to enforce cryptographic hash verification. Audit existing cached blobs for integrity. See NVD Detail.

  8. CVE-2026-62674 / CVE-2026-62675 (Omnigent Agent RCE)

    • Severity: Critical/High (CVSS 9.0/8.8)
    • Component: Omnigent Framework
    • Impact: Multiple vectors for RCE including shared agent bundle manipulation and arbitrary Python path execution in tool specs.
    • Action: Upgrade Omnigent to v0.3.0+. Review all custom agent bundles for unsafe tool definitions. See NVD Detail.

Theme: Inference Server RCE & Unsafe Deserialization

The backbone of the modern AI stack—the inference server—proved to be remarkably fragile this week. The recurring pattern is the treatment of model output or peer messages as "trusted" data, leading to direct code execution.

Xinference suffered a CVSS 10.0 vulnerability (CVE-2026-61539) where the Llama3 tool-call parser passed model-generated strings directly to Python's eval(). This is a textbook case of why dynamic evaluation must never be used on untrusted input, even if that input comes from a "local" model. The model itself becomes the weapon, coerced via prompt injection to output malicious payloads.

Similarly, LMDeploy (CVE-2026-76850) fell victim to the dangers of pickle. In its disaggregated serving mode, the engine deserializes peer messages using pickle.loads() before validating the message type. This order of operations is fatal; by the time the code checks if the message is a valid request, the malicious payload has already executed. This highlights a critical lesson for distributed ML systems: serialization formats must be safe (e.g., JSON, Protobuf) or deserialization must happen in a strictly isolated sandbox.

The llama.cpp RPC server also joined the list with a severe use-after-free bug (CVE-2026-39909) in its graph recompute handler. This allows unauthenticated attackers to achieve arbitrary read/write access, a precursor to full RCE. With llama.cpp being a ubiquitous dependency for local LLM runners, this vulnerability potentially exposes thousands of edge devices and internal dev boxes to remote compromise.

Theme: The Agentic Attack Surface (MCP & Tool Use)

If inference servers are the brain, agents are the hands. This week revealed that giving LLMs "hands" without gloves is a disaster. The Model Context Protocol (MCP) and various agent frameworks introduced numerous vectors for escaping intended boundaries.

Omnigent was particularly hard hit, with a trilogy of vulnerabilities (CVE-2026-62674, CVE-2026-62675, CVE-2026-62677). Attackers could manipulate shared agent bundles to inject stdio MCP servers, specify arbitrary Python callables (like subprocess.check_output), or traverse file paths to escape the workspace. The root cause is a lack of strict allow-listing for tool capabilities and insufficient validation of agent configuration objects.

LangBot (CVE-2026-54449) and Splunk MCP Server (CVE-2026-76404) similarly allowed authenticated users to configure STDIO MCP servers that execute arbitrary OS commands. In LangBot's case, any authenticated user could spin up a shell on the server. This suggests that the "admin" boundary in many AI platforms is too broad; the ability to configure tools should be heavily restricted and audited.

CodeWhale presented a sophisticated supply-chain-style attack vector (CVE-2026-75911, CVE-2026-75913, CVE-2026-75858). By committing a malicious config file or leveraging argument injection in git tools, an attacker could trick the agent into executing shell commands or writing files to sensitive locations (like ~/.ssh). The "auto-approve" settings on certain tools meant these actions happened without user consent, turning the coding assistant into a Trojan horse.

Theme: Data Leakage, SSRF, and Identity Confusion

While RCE grabs headlines, data exfiltration remains the primary goal of many adversaries. This week's entries show how easily internal networks and sensitive data stores are being exposed.

The headline story here is MLflow. Beyond the actively exploited SSRF (CVE-2026-64849), MLflow also shipped with broken access controls in its model registry. CVE-2026-69148 (NVD) allowed users to create model versions pointing to other users' artifact directories, effectively bypassing read permissions. Furthermore, CVE-2026-69146 (NVD) allowed unauthorized injection of dataset inputs into run logs, polluting the lineage graph. These issues stem from a failure to propagate authorization checks deep into the object creation logic.

Headroom's LLM Proxy suffered from two distinct identity failures. Beyond the IDOR mentioned earlier, CVE-2026-77775 (NVD) allowed clients to specify the upstream base URL via a header (x-headroom-base-url). This turned the proxy into an open SSRF tool, allowing attackers to scan internal networks and interact with private APIs, with the proxy faithfully returning the responses.

LangChain components also leaked data. The SitemapLoader (CVE-2026-72848) failed to restrict nested sitemaps to the same domain, allowing attackers to force the loader to fetch internal URLs. Additionally, a NoSQL injection in LangChain MongoDB (GHSA-533j-2v4q-mw5h) allowed filter parameters to contain MongoDB operators, leading to cross-tenant data exposure.

Theme: Supply Chain & Model Integrity

Trust in the model supply chain was eroded this week. Kraken agents (CVE-2026-75625) were found to rely on CRC32 checksums rather than cryptographic hashes for P2P blob verification. This allows an attacker on the network path to substitute model weights or container layers with malicious versions that pass the integrity check but execute arbitrary code upon loading.

Hugging Face Transformers (CVE-2026-75104) and MONAI (GHSA-wg9g-w2j2-8pgr) both faced issues related to loading untrusted model files. Transformers failed to validate shard filenames in index files, allowing path traversal to read arbitrary files. MONAI's NumpyReader hardcoded allow_pickle=True, turning a simple data load operation into a potential RCE vector if a malicious .npy file is introduced into the dataset pipeline.

Known Exploited Vulnerabilities (KEV)

⚠️ CRITICAL ALERT:

  • CVE-2026-64849 (MLflow SSRF) is now listed in the CISA KEV catalog. Threat actors are actively scanning for and exploiting this vulnerability to harvest cloud credentials (AWS IMDS, GCP metadata, Azure IMDS). If you run MLflow without authentication or with default settings, assume you are compromised.

What to Do This Week

  1. Patch MLflow Immediately: Upgrade all MLflow instances to version 3.15.0 or later. If you cannot patch immediately, place the MLflow server behind a strict network firewall that blocks outbound access to cloud metadata IPs (e.g., 169.254.169.254) and restricts inbound access to trusted CI/CD subnets only.
  2. Audit Inference Servers: Scan your environment for Xinference, LMDeploy, and llama.cpp instances. Apply the patches released this week. For Xinference, specifically review logs for suspicious tool-call arguments containing Python code.
  3. Harden Agent Configurations: Review all MCP server configurations and agent tool definitions. Disable "auto-approve" for any tool that interacts with the filesystem or executes shell commands. Implement strict allow-lists for file paths and commands.
  4. Validate Model Inputs: Ensure that any system loading models from external sources (Hugging Face, S3, P2P networks) validates cryptographic signatures or hashes before deserialization or loading. Disable pickle support in data loaders where possible.
  5. Header Hygiene: Configure load balancers and ingress controllers to strip or validate sensitive headers like x-headroom-user-id and x-headroom-base-url to prevent header injection attacks.

What to Watch Next Week

Next week, we expect to see a ripple effect from these agent-focused vulnerabilities. Look out for new advisories regarding "sandbox escape" techniques in containerized agent runtimes, as attackers will likely try to break out of the limited environments provided by frameworks like Omnigent and LangBot. Additionally, monitor for exploits targeting the "uncensored" or "jailbroken" models that may be deployed to test these new RCE vectors. The convergence of agentic autonomy and unsafe infrastructure is creating a fertile ground for automated attack chains.

Covered entries (98)