VulnWatch VulnWatch
← All articles
Weekly digest · Sep 14, 2026

VulnWatch Weekly: The Agentic Apocalypse & The Langflow Meltdown

This week marks a turning point for AI security as critical RCEs plague agentic frameworks like Mistral Vibe and Langflow. With 89 new entries, the dominant theme is the collapse of trust boundaries in autonomous agents and model serving pipelines.

Prompt Injection Supply Chain Remote Code Execution Data Leakage Auth Bypass SSRF API Abuse Agentic / MCP

Week in Review: The Agentic Apocalypse & The Langflow Meltdown

Week: September 7 – September 13, 2026
Total Entries: 89
Dominant Themes: Agentic RCE, Model Supply Chain Poisoning, Inference Server DoS, MCP Transport Flaws

The security landscape for AI systems underwent a seismic shift this week, moving from theoretical prompt injections to catastrophic, unauthenticated Remote Code Execution (RCE) in production-grade agentic frameworks. The single most urgent item is the cluster of critical vulnerabilities in Mistral Vibe and IBM Langflow, which collectively dismantle the security boundaries between the LLM and the host operating system. These are not mere data leaks; they are full system compromises triggered by standard agent interactions. Simultaneously, the Model Context Protocol (MCP) ecosystem is showing its age, with multiple transport-level flaws allowing DNS rebinding and unauthenticated SQL execution. For CISOs and ML Platform teams, the message is clear: the "agent" abstraction layer has become the new attack surface, and current sandboxing mechanisms are failing to contain it.

Top Items of the Week

The following vulnerabilities represent the highest immediate risk to AI infrastructure. Immediate patching or mitigation is required.

  1. Mistral Vibe: The Permission Bypass Cascade

    • Identifiers: CVE-2026-87987, CVE-2026-87986, CVE-2026-87985, CVE-2026-87984, CVE-2026-87983
    • Severity: Critical (CVSS 10.0 / 9.3)
    • Affected Component: Mistral Vibe Agent Framework
    • Impact: Complete bypass of command permission checks via environment variable injection, ANSI-C quoting, and shell construct parsing errors. Allows arbitrary code execution and file system access outside the workspace without user approval.
    • Recommended Action: Upgrade Mistral Vibe immediately. If patching is delayed, disable all external tool usage and restrict the agent to read-only modes within a strictly containerized environment.
    • Source: NVD CVE-2026-87987

  2. IBM Langflow: The Authentication & Execution Collapse

    • Identifiers: CVE-2026-85025, CVE-2026-81204, CVE-2026-79724
    • Severity: Critical (CVSS 9.8)
    • Affected Component: IBM Langflow OSS (v1.0.0 – v1.11.5)
    • Impact: Unauthenticated attackers can execute arbitrary code via public MCP project endpoints due to broken session isolation. Additionally, graph construction flaws allow code injection and OS command execution.
    • Recommended Action: Take public Langflow instances offline immediately. Upgrade to the latest patched version and audit all custom components for unsafe eval() or subprocess calls.
    • Source: NVD CVE-2026-85025

  3. MySQL MCP Server: DNS Rebinding to SQL Injection

    • Identifier: GHSA-rqfv-2mw9-78g2
    • Severity: Critical (CVSS 10.0)
    • Affected Component: mysql_mcp_server (SSE Transport Mode)
    • Impact: Missing Origin/Host validation in SSE transport enables DNS rebinding attacks. Attackers can trick the server into connecting to a malicious host, leading to unauthenticated SQL execution.
    • Recommended Action: Disable SSE transport mode (MCP_TRANSPORT=sse) until patched. Force usage of stdio mode or implement strict network segmentation for MCP servers.
    • Source: GitHub Advisory GHSA-rqfv-2mw9-78g2

  4. DeepSeek Harness: Host Header Authentication Bypass

    • Identifier: CVE-2026-82533
    • Severity: Critical (CVSS 9.4)
    • Affected Component: DeepSeek Harness (Local HTTP Control Plane)
    • Impact: Attackers can bypass authentication by spoofing the Host header, gaining full agent control, executing privileged commands, and retrieving all stored conversations.
    • Recommended Action: Configure the web server (nginx/Apache) in front of DeepSeek to validate and strip incoming Host headers, or upgrade to v0.1.2-alpha.1+.
    • Source: NVD CVE-2026-82533

  5. vLLM: Remote Code Execution via Processor Loader

    • Identifier: CVE-2026-90553
    • Severity: High (CVSS 8.5)
    • Affected Component: vLLM (< v0.28.0)
    • Impact: The LlavaOnevision2 processor loader ignores the trust_remote_code=False setting, allowing malicious models to execute arbitrary code during loading.
    • Recommended Action: Upgrade vLLM to v0.28.0 or later. Audit all loaded models for untrusted remote code dependencies.
    • Source: NVD CVE-2026-90553

Theme: The Agentic RCE Epidemic

The most alarming trend this week is the systemic failure of agentic frameworks to enforce the principle of least privilege. We are seeing a pattern where "allowlisted" commands are trivially bypassed, turning helpful assistants into root shells.

The Mistral Vibe vulnerabilities are particularly instructive. The suite of CVEs (CVE-2026-87985 through CVE-2026-87988) reveals that the parser responsible for validating agent actions is fundamentally brittle. By exploiting edge cases in shell parsing—such as ANSI-C quoted arguments ($'...'), environment variable assignments preceding commands, and uninterpreted shell constructs—attackers can slip malicious payloads past the permission filter. This suggests that text-based command validation is insufficient for high-stakes agentic environments; structured, binary-intermediate representations of commands may be required to prevent such bypasses.

Similarly, IBM Langflow has become a honeypot for RCE. Beyond the critical authentication bypass in public flows (CVE-2026-85025), multiple vulnerabilities (CVE-2026-81204, CVE-2026-79724, CVE-2026-81941) highlight the dangers of dynamic graph construction. When users can define workflows that include custom code components or MCP tools, the platform fails to adequately sandbox these executions. CVE-2026-81941 is especially concerning as it allows non-admin users to bypass LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS controls by crafting specific MCP stdio subprocess transports. This indicates that configuration flags alone are insufficient guards against determined insider threats or compromised accounts.

We also observed critical flaws in the Amazon awslabs postgres-mcp-server (CVE-2026-87911). Here, a read-only enforcement mechanism was bypassed via a crafted COPY ... TO PROGRAM statement. This is a classic SQL injection variant adapted for the MCP era, proving that legacy database attack vectors remain potent when wrapped in modern AI protocols.

Theme: Model Supply Chain & Inference Integrity

While agents are executing code, the models themselves are becoming vectors for supply chain attacks. The trust boundary between the model weights and the inference engine is eroding.

vLLM continues to struggle with input validation in its multimodal processors. CVE-2026-90553 demonstrates that the trust_remote_code parameter, a primary defense against malicious model artifacts, is effectively ignored in the LlavaOnevision2 loader. This allows an attacker to host a model on Hugging Face that executes arbitrary Python code the moment it is loaded by a victim's inference server. Furthermore, CVE-2026-90555 and CVE-2026-90554 highlight Denial of Service (DoS) risks in audio processing, where forged headers can trigger excessive memory allocation, crashing the API server.

Hugging Face Accelerate (PYSEC-2026-3804) and Transformers (CVE-2026-9856) also revealed path traversal vulnerabilities. In Accelerate, sharded checkpoint weight maps are not sanitized, allowing attackers to read arbitrary files or cause DoS via named pipes. In Transformers, malicious chat template names in tokenizer_config.json can lead to arbitrary file writes when the tokenizer is saved. These vulnerabilities underscore the risk of treating model artifacts as data; they must be treated as executable code.

Additionally, MLflow (CVE-2026-79721) and GitPython (GHSA-284h-m62q-gf8w, GHSA-7833-fr7j-v32q) presented significant supply chain risks. MLflow allows malicious model artifacts to execute code upon loading, while GitPython's handling of .gitmodules and config files can lead to RCE or local file disclosure when cloning untrusted repositories—a common operation in ML engineering pipelines.

Theme: Server-Side Request Forgery (SSRF) & Data Leakage

As AI applications increasingly fetch external data to ground their responses, SSRF has emerged as a critical vector for cloud compromise.

Mistral.rs (GHSA-wfgq-w7cq-qj7j) and vLLM (GHSA-4hhp-h66f-j5j7) both suffer from unvalidated media fetching. Their vision and audio endpoints will blindly fetch URLs provided in user prompts, including file:// schemes and internal metadata addresses (e.g., 169.254.169.254). This allows attackers to exfiltrate cloud credentials or read sensitive local files directly from the inference server's filesystem.

Google Cloud Gemini Enterprise (CVE-2026-19486) also shipped with a high-severity SSRF in its App Builder, allowing unauthenticated attackers to leak Compute Engine service account tokens. This is a stark reminder that even managed cloud AI services are not immune to foundational web vulnerabilities.

Data leakage was also prevalent in Open WebUI (GHSA-pcvc-8vrv-8q6w), where knowledge base search filters were ignored by vector backends like Pinecone and Milvus, exposing restricted documents to unauthorized users. Langflow (CVE-2026-9225) similarly failed to enforce ownership checks on file reads, allowing low-privileged users to access other users' sensitive data.

Theme: Infrastructure & Protocol Flaws

The underlying infrastructure supporting AI workloads is also fracturing. Traefik (GHSA-f52w-8j3h-j724) revealed a subtle but dangerous routing bug where rootless HTTP request targets could bypass path-scoped middleware and access controls, potentially exposing internal AI services.

Central Dogma (GHSA-2j95-gqxf-v3vg) was found to use a hard-coded ZooKeeper replication secret (ch4n63m3), enabling trivial cluster takeover. This is a failure of basic security hygiene that could have catastrophic consequences for any organization relying on it for configuration management.

Furthermore, NVIDIA Triton Inference Server (CVE-2026-47625, CVE-2026-16497) faced issues with missing authorization and excessive iteration, leading to potential DoS and data tampering. These low-level infrastructure flaws remind us that the AI stack is only as strong as its weakest dependency.

Known Exploited Items

Fortunately, as of this writing, no entries in this week's digest are marked as is_exploited=true. However, the severity and simplicity of the exploits described—particularly the Mistral Vibe shell bypasses and the Langflow public endpoint RCE—suggest that active exploitation is imminent. The window for defensive action is closing rapidly.

What to Do This Week

  1. Patch Agentic Frameworks Immediately: Prioritize updating Mistral Vibe, Langflow, and DeepSeek Harness. These are not optional updates; they are critical survival patches.
  2. Audit MCP Implementations: If you are running MCP servers (MySQL, Postgres, etc.), verify that you are not using SSE transport without strict network controls. Audit all MCP tools for path traversal and command injection vulnerabilities.
  3. Enforce Network Segmentation: Isolate your inference servers and agent runtimes from the public internet and internal metadata services. Use egress firewalls to block requests to 169.254.169.254 and other cloud metadata endpoints.
  4. Review Model Sources: Stop loading models from untrusted sources. Implement a proxy or scanner that validates model artifacts (safetensors, configs) before they reach your inference engine to prevent supply chain RCE.
  5. Disable Dangerous Features: If you cannot patch immediately, disable features like trust_remote_code, external tool usage, and public flow sharing in your AI platforms.

What to Watch Next Week

Next week, we anticipate a wave of follow-up advisories as security researchers dig deeper into the Model Context Protocol (MCP) specification. The flaws found in MySQL and Postgres MCP servers suggest that the protocol's transport layer security is fundamentally weak. We also expect to see more research into multimodal injection attacks, where malicious payloads hidden in images or audio trigger the SSRF and RCE bugs identified in vLLM and Mistral.rs. Finally, keep an eye on vector database vendors; the access control bypasses in Open WebUI suggest that the entire RAG (Retrieval-Augmented Generation) stack may need a security overhaul.

Covered entries (89)