VulnWatch VulnWatch
← All articles
Weekly digest · Sep 7, 2026

VulnWatch Weekly: The Agentic Explosion & The LiteLLM Emergency

This week marks a turning point for AI security as agentic frameworks become the primary attack surface. With a known-exploited vulnerability in LiteLLM and critical RCEs in MCP hubs, immediate patching is required.

Prompt Injection Remote Code Execution Data Leakage Model Poisoning Auth Bypass SSRF Agentic / MCP

Week in Review: The Agentic Explosion & The LiteLLM Emergency

Week of August 31 – September 6, 2026

The dominant theme of this week is the maturation of the "Agentic" attack surface. As organizations move from static chatbots to dynamic, tool-using agents, the vulnerability landscape has shifted dramatically from simple prompt injection to complex orchestration failures, unauthorized tool execution, and supply-chain compromises in agent bundles. The single most urgent item for all CISOs and platform teams is CVE-2026-59822 in BerriAI LiteLLM, which is now confirmed as known-exploited in the wild; this authentication bypass allows unauthenticated attackers to hijack MCP sessions and steal provider credentials. Simultaneously, we are seeing a cascade of critical Remote Code Execution (RCE) vulnerabilities in Model Context Protocol (MCP) hubs and agent runtimes, suggesting that the infrastructure designed to connect LLMs to the real world is currently the weakest link in the AI stack. Immediate action is required to patch agent orchestration layers and audit multi-tenant access controls.

Top Items of the Week

The following entries represent the highest impact risks identified this week. Priority is given to active exploitation, critical severity, and widespread adoption of the affected components.

  1. CVE-2026-59822 (BerriAI LiteLLM)

    • Severity: High (CVSS 8.8) | Status: KNOWN EXPLOITED
    • Component: MCP Streamable HTTP Endpoint
    • Impact: Improper authentication allows unauthenticated attackers to establish sessions with arbitrary Bearer tokens, leading to full compromise of upstream provider keys.
    • Action: Upgrade LiteLLM immediately to the latest patched version. Rotate all exposed API keys and audit MCP session logs for anomalous token usage.
    • Source

  2. CVE-2026-79748 (MCPHub)

    • Severity: Critical (CVSS 9.9)
    • Component: Server Orchestration API (/api/servers)
    • Impact: Authenticated non-admin users can spawn arbitrary stdio processes via child_process.spawn due to missing authorization and command sanitization. This is a trivial path to container or host RCE.
    • Action: Upgrade MCPHub to v0.12.15+. Implement strict network policies to isolate MCP server processes from internal networks.
    • Source

  3. CVE-2026-85694 (LaVague)

    • Severity: Critical (CVSS 9.2)
    • Component: PythonFromMarkdownExtractor
    • Impact: Indirect prompt injection via malicious web pages leads to arbitrary Python code execution (eval) on the operator's host. This validates the "browse-to-rce" threat model.
    • Action: Disable automatic code execution in LaVague extractors. Sanitize all external URL inputs before processing.
    • Source

  4. GHSA-79wm-x847-7cvg (Claude Code Templates)

    • Severity: High (CVSS 8.8)
    • Component: Claude Code Studio Server (--studio)
    • Impact: Unauthenticated RCE via shell injection in Express endpoints bound to 0.0.0.0. Any network-accessible instance is vulnerable to immediate takeover.
    • Action: Stop using --studio mode in production or bind strictly to localhost with a reverse proxy enforcing authentication.
    • Source

  5. CVE-2026-80098 (Microsoft Copilot Studio)

    • Severity: Critical (CVSS 9.3)
    • Component: Cryptographic Signature Verification
    • Impact: Failure to verify signatures allows unauthorized privilege escalation over the network, potentially allowing attackers to modify bot logic or access sensitive data.
    • Action: Apply Microsoft's emergency security update for Copilot Studio immediately.
    • Source

  6. GHSA-4mvj-m6j5-pmf7 (unstructured)

    • Severity: Critical (CVSS 9.3)
    • Component: URL Partitioning (partition())
    • Impact: Full-read SSRF allowing access to loopback admin APIs and cloud metadata. Affects LangChain, LlamaIndex, and Chainlit integrations.
    • Action: Upgrade unstructured library. Implement allow-lists for external URLs and block private IP ranges at the network egress level.
    • Source

  7. CVE-2026-86169 (Axolotl)

    • Severity: High (CVSS 8.7)
    • Component: Model Loading (trust_remote_code)
    • Impact: Defaulting trust_remote_code to None instead of False allows malicious Hugging Face models to execute arbitrary code during loading.
    • Action: Explicitly set trust_remote_code=False in all model loading configurations. Audit base models used in fine-tuning pipelines.
    • Source

  8. GHSA-jrrm-9hc7-2v3h (Omnigent)

    • Severity: Critical (CVSS 9.0)
    • Component: Agent Bundle Upload
    • Impact: Authenticated users can overwrite shared/template agents with malicious bundles containing attacker-controlled stdio servers, leading to RCE in future runner sessions.
    • Action: Restrict write permissions on shared agent templates. Implement integrity checks on agent bundles.
    • Source

The Agentic Orchestration Crisis

The most alarming trend this week is the sheer volume of critical vulnerabilities in Model Context Protocol (MCP) hubs and agent orchestration layers. As companies rush to deploy agents that can "do things" (access files, run commands, query databases), the software glue holding these systems together—MCPHub, Omnigent, and various custom runners—has proven fragile.

MCPHub alone accounted for six distinct high-severity entries this week. The pattern is consistent: authentication is present, but authorization is absent or flawed. In CVE-2026-79748, any authenticated user could spawn OS processes. In CVE-2026-79750, non-admin users could invoke tools on servers owned by others, breaking multi-tenant isolation. Perhaps most insidiously, CVE-2026-79746 revealed a logic flaw where bearer keys scoped to specific servers granted access to entire groups if any server in the group matched, effectively bypassing least-privilege constraints.

Similarly, Omnigent (GHSA-jrrm-9hc7-2v3h) demonstrated how agent supply chains can be poisoned. By allowing a user to overwrite a "shared" agent template, an attacker ensures that every subsequent session using that template executes their malicious code. This is the agentic equivalent of a compromised CI/CD pipeline.

The root cause across these entries is the assumption that "authenticated" equals "trusted." In agentic systems, the principle of least privilege must be enforced at the tool level, not just the session level. Engineers must assume that any user with login access might be compromised or malicious, and therefore, the agent's ability to execute code or access external resources must be strictly gated by role-based access control (RBAC) that is re-evaluated for every tool invocation.

Indirect Prompt Injection & The "Browse-to-RCE" Reality

Theoretical fears about indirect prompt injection have materialized into concrete, exploitable RCE vectors. This week, we saw multiple instances where an LLM's interaction with untrusted external data led directly to code execution on the host.

LaVague (CVE-2026-85694) is the poster child for this risk. Its PythonFromMarkdownExtractor blindly evaluated Python code found in markdown content fetched from the web. An attacker simply needs to host a webpage with a hidden code block to compromise the agent's host. This confirms that data ingestion pipelines are now execution boundaries. If your agent reads from the web, emails, or untrusted documents, that content must be treated as executable code until proven otherwise.

Eclipse Theia (CVE-2026-82217) and CodeWhale (GHSA-7j5w-7r7x-9v27, GHSA-c6mw-8xh8-gpq6) further illustrate the danger of trusting model outputs for file system operations. In Theia, an agent could be tricked via indirect injection into writing files outside the workspace (e.g., ../.bashrc). In CodeWhale, argument injection in git tools allowed arbitrary file reads and writes. These vulnerabilities highlight that tool arguments derived from LLM output must be strictly validated against an allow-list, not just sanitized. The "intent" of the model is irrelevant; the resulting system call must be constrained by the OS and the application logic.

The SSRF Epidemic in AI Infrastructure

Server-Side Request Forgery (SSRF) remains the most pervasive vulnerability class in AI infrastructure, particularly in components designed to fetch external data or connect to model repositories. This week's entries show that basic URL validation is insufficient against modern bypass techniques.

The unstructured library (GHSA-4mvj-m6j5-pmf7) vulnerability is particularly severe because of its ubiquity in RAG (Retrieval-Augmented Generation) pipelines. The lack of host validation in partition() allows attackers to force the server to read internal metadata endpoints (like AWS EC2 IMDS), exposing cloud credentials.

We also observed sophisticated bypasses involving redirects and DNS rebinding. LLaMA-Factory (CVE-2026-85673) and Ollama (CVE-2026-85180) both failed to re-validate URLs after HTTP redirects or during tensor-layer model pulls. An attacker can provide a benign URL that redirects to a private IP, or use a DNS rebinding attack (as seen in CodeWhale GHSA-6v2g-fpxh-pmmh) to swap the IP address between the validation check and the actual request. Furthermore, MCPHub (CVE-2026-79749) showed that IPv6 transition mechanisms (like NAT64 and Teredo) are often overlooked in blocklists, allowing attackers to tunnel into IPv4 private networks.

The mitigation strategy here must be defense-in-depth: validate URLs at the application layer, block private IP ranges (including IPv6 special ranges) at the library level, and enforce strict egress filtering at the network perimeter to prevent AI services from accessing internal infrastructure.

Supply Chain & Model Loading Risks

The AI supply chain extends beyond just the model weights; it includes the code used to load them, the configuration files parsed at startup, and the dependencies installed to run them.

Axolotl (CVE-2026-86169) highlighted a dangerous default in model loading: trust_remote_code was effectively enabled by default in certain paths, allowing malicious models on Hugging Face to execute code upon loading. This is a reminder that models are not just data; they are potential code carriers.

Configuration file parsing also proved risky. aider (CVE-2026-85674) automatically executed commands defined in .aider.conf.yml upon cloning a repository, turning a simple git clone into an RCE vector. Similarly, CodeWhale (GHSA-gx45-xrj5-g6c4) allowed repository config files to silently enable shell access. These vulnerabilities demonstrate that configuration files in version control must be treated as untrusted code. Auto-execution of config directives should be disabled by default, requiring explicit user consent.

Additionally, Scrapy (GHSA-76g3-c3x4-crvx, CVE-2026-84366) was found to send signed S3 requests over plaintext HTTP by default. For AI data collection pipelines scraping the web, this means credentials and scraped data could be intercepted by network attackers, leading to data poisoning or credential theft.

Known Exploited Vulnerabilities (KEV)

There is one entry this week marked as actively exploited:

  • CVE-2026-59822 (BerriAI LiteLLM): This vulnerability allows an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token. Given LiteLLM's role as a universal proxy for LLM APIs, this flaw allows attackers to intercept traffic, steal API keys, and potentially inject malicious prompts into downstream models. This is a Code Red situation. If you run LiteLLM, patch it now. If you cannot patch immediately, take the service offline or restrict network access to the proxy.

What to Do This Week

  1. Patch LiteLLM Immediately: Prioritize upgrading BerriAI LiteLLM to the latest version to mitigate CVE-2026-59822. Rotate all API keys managed by the proxy.
  2. Audit MCP Hubs: If you use MCPHub, Omnigent, or similar orchestration layers, upgrade to the latest versions. Review your RBAC policies to ensure non-admin users cannot register servers or execute tools on behalf of others.
  3. Disable Auto-Execution: Review your agent frameworks (LaVague, aider, CodeWhale) and disable any features that automatically execute code or shell commands based on config files or external data without explicit user approval.
  4. Harden Egress: Implement strict egress filtering for your AI infrastructure. Block access to cloud metadata endpoints (169.254.169.254) and internal RFC1918 ranges unless explicitly required. Ensure IPv6 transition addresses are also blocked.
  5. Validate Model Sources: Enforce trust_remote_code=False in all model loading scripts. Only load models from verified, internal registries where possible.

What to Watch Next Week

Next week, we expect to see more fallout from the "agentic" boom, specifically focusing on memory corruption in vector databases as they scale to handle massive context windows. Additionally, keep an eye on cross-tenant data leakage in multi-tenant LLM platforms; as seen in the Langflow and Helicone entries this week, isolation failures in shared environments are becoming a prime target for attackers looking to steal competitor data or API keys. Finally, watch for new variants of DNS rebinding attacks targeting local AI development tools that expose APIs to localhost.

Covered entries (101)