VulnWatch VulnWatch
← All articles
Weekly digest · Aug 31, 2026

VulnWatch Weekly: The MCP Security Crisis & Langflow RCE

This week marks a turning point for AI security with critical RCEs in Langflow and a systemic collapse of authentication in the Model Context Protocol (MCP) ecosystem. Immediate patching is required for Kubeflow, Langflow, and all exposed MCP servers.

Prompt Injection Remote Code Execution Data Leakage Auth Bypass SSRF API Abuse Agentic / MCP

Week in Review: The MCP Authentication Collapse and the Langflow Catastrophe

Week: August 24 – August 30, 2026
Total Entries Analyzed: 93
Dominant Themes: Model Context Protocol (MCP) Security Failures, Agentic RCE, Supply Chain Poisoning, SSRF via Redirects
Most Urgent Item: CVE-2026-19295 (IBM Langflow OSS Authenticated RCE)

The week of August 24, 2026, will be remembered as the moment the "Agentic Web" faced its first major security reckoning. While we tracked 93 distinct entries, the narrative is dominated by two converging crises: a catastrophic cluster of Remote Code Execution (RCE) vulnerabilities in IBM Langflow OSS, and a systemic, ecosystem-wide failure of authentication and authorization within the Model Context Protocol (MCP) specification implementations. The dominant theme is no longer just "prompt injection" but "tool execution hijacking," where attackers bypass human-in-the-loop guards to commandeer the underlying infrastructure. Security teams must treat this week's advisories not as isolated bugs, but as evidence that the default security posture of the agentic stack is fundamentally broken. The single most urgent item is CVE-2026-19295 in Langflow, which allows authenticated users to escalate to full OS-level command execution, effectively compromising any ML platform running this orchestration engine.

Top Items of the Week

The following vulnerabilities represent the highest immediate risk to AI/ML infrastructure. These items demand immediate triage and patching.

  1. CVE-2026-19295 | Critical (9.9) | IBM Langflow OSS
    Impact: Authenticated attackers can execute arbitrary OS commands by crafting a flow with a specific type field, bypassing the LANGFLOW_ALLOW_CUSTOM_COMPONENTS policy. This is a full platform compromise.
    Action: Upgrade to Langflow OSS > 1.11.1 immediately. Audit all custom components.
    Source

  2. CVE-2026-54745 | Critical (10.0) | Kubeflow Pipelines
    Impact: Unauthenticated Server-Side Request Forgery (SSRF) via the /_proxy/ route. Attackers can scan internal networks and access cluster-local metadata services without authentication.
    Action: Upgrade to Kubeflow Pipelines 2.17.0+. Restrict network access to the frontend if patching is delayed.
    Source

  3. GHSA-w3fx-mc44-mf6j | Critical (9.8) | Chainlit (MCP)
    Impact: Unauthenticated RCE via the MCP stdio transport. If features.mcp.enabled = true, attackers can inject arbitrary commands via the fullCommand parameter.
    Action: Disable MCP features in Chainlit config (features.mcp.enabled = false) or upgrade to v2.7.0+ where it is disabled by default.
    Source

  4. CVE-2026-81098 | Critical (9.3) | Telnyx MCP Server
    Impact: Unauthenticated exposure of MCP HTTP transport on all interfaces. Attackers can invoke tools using the server's own stored credentials (API keys/secrets).
    Action: Update Telnyx MCP server packages. Ensure firewalls block port 8080 (or custom MCP ports) from public access.
    Source

  5. CVE-2026-81096 | Critical (9.3) | ToolUniverse
    Impact: Sandbox escape in Python code executor. Attackers can traverse from literals to base classes to access subprocess modules, achieving RCE on an unauthenticated server.
    Action: Patch ToolUniverse immediately. Review all agent tools that execute user-supplied Python.
    Source

  6. CVE-2026-78379 | Critical (9.2) | Amazon Strands Agents Tools
    Impact: Prompt injection in python_repl tool bypasses human consent gates, allowing arbitrary Python execution via crafted prompts forwarding non_interactive_mode.
    Action: Upgrade to Amazon Strands Agents Tools v0.8.5+.
    Source

  7. GHSA-8vh3-g2qg-2h2c | Critical (9.1) | Nextcloud MCP Server
    Impact: Unauthenticated vector data deletion/corruption. The WEBHOOK_SECRET defaults to None, allowing attackers to wipe Qdrant embeddings for any user.
    Action: Set a strong WEBHOOK_SECRET environment variable immediately. Upgrade to v0.117.2+.
    Source

  8. CVE-2026-76841 | High (8.7) | Xinference
    Impact: Unconditional trust_remote_code=True in model loading. Loading models from Hugging Face executes arbitrary code without operator consent.
    Action: Upgrade to Xinference v2.12.0+ which allows disabling this behavior. Audit loaded models.
    Source

  9. GHSA-86m2-fcxq-5q7c | High (8.2) | 9router
    Impact: Authentication bypass via Host header spoofing. Remote attackers can access the /v1 LLM proxy without an API key by setting Host: localhost.
    Action: Configure 9router to validate Host headers strictly or bind only to loopback if local.
    Source

  10. CVE-2026-55580 | High (8.6) | mcp-shell
    Impact: Security disabled by default. The Security.Enabled flag defaults to false, allowing unrestricted OS command execution via the shell_exec tool.
    Action: Explicitly enable security mode in config and define strict allowlists. Upgrade to v0.6.0+.
    Source

The Agentic Apocalypse: MCP Security Failures

The most alarming trend this week is the sheer volume of critical vulnerabilities stemming from Model Context Protocol (MCP) implementations. The promise of MCP is to standardize how AI agents connect to data and tools; the reality this week is that it has standardized how to leave those tools wide open to the internet.

We observed a pattern of "default insecure" configurations across multiple vendors. Telnyx MCP Server (CVE-2026-81098), mcp-router (CVE-2026-81094), and genieacs-mcp (CVE-2026-55637) all shipped with HTTP transports bound to 0.0.0.0 (all interfaces) with no authentication required by default. In the case of Telnyx, the server not only accepted unauthenticated connections but happily forwarded the attacker's requests using the server's own stored credentials, effectively turning any exposed MCP port into a proxy for privileged API actions.

The situation is compounded by logic errors in security enforcement. mcp-shell (CVE-2026-55580, CVE-2026-55581, CVE-2026-55582) presents a case study in failed hardening. Even when "secure mode" was enabled, the allowlist validation was trivially bypassed. By passing /bin/bash -c <payload> or exploiting Git's shell alias feature (git -c alias.pwn=!<cmd>), attackers could execute arbitrary commands despite the presence of security controls. This highlights a dangerous misconception: wrapping a shell in a JSON-RPC interface does not make it safe; it merely makes it automatable by an LLM.

Furthermore, Chainlit (GHSA-w3fx-mc44-mf6j) and Nextcloud MCP Server (GHSA-8vh3-g2qg-2h2c) demonstrated that optional security features are often effectively non-existent. In Nextcloud's case, the WEBHOOK_SECRET defaulted to None, rendering the authentication check a no-op and allowing unauthenticated attackers to delete vector embeddings in Qdrant. In Chainlit, the mere act of enabling MCP opened a direct command injection vector via the stdio transport.

Recommendation: Treat any MCP server exposed to a network as compromised until proven otherwise. Audit your deployment manifests: ensure MCP servers are bound strictly to 127.0.0.1 unless absolutely necessary, enforce authentication tokens in all configurations, and disable MCP features in wrapper applications like Chainlit if not explicitly required.

Supply Chain & Model Loading Risks

The supply chain remains a critical attack surface, particularly in the realm of model loading and dependency management. Xinference (CVE-2026-76841) made headlines by hardcoding trust_remote_code=True across six different model loading paths. This means that any model pulled from Hugging Face could execute arbitrary Python code during the initialization phase, completely bypassing any sandboxing intended for the inference stage. This is a classic supply chain poisoning vector where the "model" is actually a trojanized script.

Similarly, whichllm (CVE-2026-58474) suffered from a code injection vulnerability where GGUF filenames from Hugging Face were interpolated directly into Python source code without sanitization. An attacker controlling a repository could name a file "; os.system('rm -rf /'); # and achieve RCE on any system running the whichllm CLI. Vocos (CVE-2026-79784) exhibited similar behavior, allowing arbitrary class instantiation via configuration files, enabling attackers to load and execute any importable Python class.

These incidents reinforce the principle that data is code in the AI era. Filenames, configuration parameters, and model weights must all be treated as untrusted input. The practice of eval()-ing configuration or dynamically importing classes based on user-supplied strings must be eradicated from ML infrastructure.

SSRF: The Redirect and DNS Rebinding Renaissance

Server-Side Request Forgery (SSRF) has evolved beyond simple URL parsing errors. This week's entries highlight sophisticated bypasses involving HTTP redirects and DNS rebinding.

PraisonAI (GHSA-x44h-65qv-cw74, GHSA-vg6p-v9vm-6fgj) and utcp-http (GHSA-9qhg-99ww-9mqc) both fell victim to the "validate-then-fetch" gap. These tools validated the initial URL to ensure it wasn't pointing to a private IP, but then followed HTTP redirects without re-validating the destination. An attacker could host a public URL that 302-redirects to http://169.254.169.254 (cloud metadata) or an internal database, bypassing the initial check entirely.

DNS rebinding also played a major role. genieacs-mcp (CVE-2026-55637) and tiger-slack (CVE-2026-81099) failed to validate the Host header or protect against DNS rebinding attacks. By rapidly changing the DNS resolution of a domain they control from a public IP to 127.0.0.1, attackers could trick browsers into sending requests to locally bound MCP servers, bypassing same-origin policies and network firewalls. Kubeflow (CVE-2026-54745) also suffered from a classic SSRF where the proxy middleware accepted arbitrary URLs without filtering for loopback or RFC1918 addresses, allowing full internal network scanning.

Known Exploited & Active Threats

While our telemetry indicates is_exploited=false for the majority of these newly published CVEs, the nature of these vulnerabilities suggests a very narrow window before weaponization. The Langflow RCE (CVE-2026-19295) and Kubeflow SSRF (CVE-2026-54745) are particularly prone to rapid exploitation due to the prevalence of these platforms in public-facing ML demos and cloud environments.

Notably, GitLab (CVE-2026-18252) remediated an issue where the Claude agent processed configuration from user-controlled sources, leading to arbitrary command execution in CI contexts. While marked as remediated, the presence of agentic logic in CI/CD pipelines is a nascent and high-risk area that defenders must monitor closely for copycat attacks.

What to Do This Week

  1. Patch Langflow Immediately: If you run IBM Langflow OSS, upgrade to version 1.11.2 or later today. The RCE vector is trivial to exploit for any authenticated user.
  2. Audit MCP Exposures: Scan your network for open ports running MCP servers (commonly 8080, 3000, or custom ports). Ensure they are not bound to 0.0.0.0. If they must be public, enforce strict API key authentication and TLS.
  3. Disable Dangerous Features: In Chainlit, set features.mcp.enabled = false. In Xinference, ensure trust_remote_code is not unconditionally true. In Nextcloud MCP, set WEBHOOK_SECRET.
  4. ** Harden Allowlists:** For tools like mcp-shell and ToolUniverse, review your allowlists. Ensure shell interpreters (bash, sh) are not in the allowlist unless absolutely necessary, and validate arguments, not just executables.
  5. Validate Redirects: Update any custom agent tools that fetch URLs to re-validate the destination IP address after following redirects. Do not trust the initial URL validation.

What to Watch Next Week

Next week, we anticipate a surge in "secondary" exploits targeting the dependencies of the patched systems. Watch for advisories related to Hugging Face loaders in other frameworks (LangChain, LlamaIndex) as the Xinference issue draws attention to the broader ecosystem. Additionally, expect to see proof-of-concepts for DNS rebinding attacks against local AI assistants (like Cursor, Continue, and various desktop MCP clients) as researchers realize how many of these tools bind to localhost without Host header validation. Finally, keep an eye on vector database integrations; with the Nextcloud Qdrant issue, we expect similar authorization bypasses to be found in Pinecone, Milvus, and Weaviate connectors.

Stay vigilant. The agentic web is expanding faster than its security perimeter.

Covered entries (93)