VulnWatch VulnWatch
← All articles
Weekly digest · Oct 12, 2026

VulnWatch Weekly: The Week of Mass RCE in AI Agents and Orchestration

This week saw an unprecedented wave of Critical RCEs in AI orchestration tools like Langflow and PraisonAI, driven by unsandboxed code execution and prompt injection. Immediate patching is required for agent platforms, MCP servers, and model inference engines to prevent total host compromise.

Prompt Injection Supply Chain Remote Code Execution Data Leakage Auth Bypass SSRF API Abuse Agentic / MCP

Week in Review: The Great Agent Escape

Week: October 5 – October 11, 2026
Total Entries: 120
Dominant Themes: Agentic RCE, Prompt Injection to Code Execution, Supply Chain Poisoning, Insecure MCP Defaults

The week of October 5th, 2026, will likely be remembered as a turning point for AI infrastructure security, marking the transition from theoretical prompt injection risks to widespread, trivial Remote Code Execution (RCE) in production agent platforms. The dominant theme was the catastrophic failure of "sandboxing" assumptions in popular agentic frameworks, particularly Langflow and PraisonAI, where multiple Critical vulnerabilities allowed attackers to escape container boundaries, exfiltrate environment secrets, and execute arbitrary code with root privileges. The single most urgent item for CISOs and platform teams is the immediate remediation of GHSA-2xv2-w8cq-5gxw and the suite of Langflow RCEs, as these vulnerabilities render default deployments of these platforms completely hostile to untrusted input.

Top Items of the Week

The following vulnerabilities represent the highest immediate risk to AI/ML infrastructure. These items are ranked by exploitability, severity, and the breadth of affected deployments.

  1. GHSA-2xv2-w8cq-5gxw (PraisonAI: CodeAgent Secret Leak & RCE)

    • Severity: Critical (CVSS 10.0)
    • Component: praisonai-agents CodeAgent
    • Impact: LLM-generated code executes with full host environment access (os.environ), allowing total secret exfiltration and arbitrary code execution, ignoring sandbox=True flags.
    • Action: Upgrade to the latest patched version immediately; disable CodeAgent usage until architectural review confirms sandbox enforcement.
    • View Advisory

  2. GHSA-w794-rj3p-xv45 / CVE-2026-105697 (Langflow: MCP Command Injection)

    • Severity: Critical (CVSS 9.9)
    • Component: Langflow MCP Stdio Transport
    • Impact: Authenticated users can define MCP servers with arbitrary OS commands (bash -c), leading to immediate RCE on the Langflow host.
    • Action: Upgrade Langflow to v1.10.3+; audit all configured MCP servers for malicious command strings.
    • View Advisory

  3. GHSA-9mp3-24cc-77mg (PraisonAI: AICoder Arbitrary File Write)

    • Severity: Critical (CVSS 9.9)
    • Component: PraisonAI AICoder UI Component
    • Impact: Via prompt injection, attackers can write files to any path (e.g., /root/.ssh/authorized_keys) and execute commands, as Docker containers run as root.
    • Action: Restrict network access to PraisonAI UIs; apply vendor patches; run containers as non-root users.
    • View Advisory

  4. CVE-2026-108263 (Astron Agent: LocalExecutor Privilege Escalation)

    • Severity: Critical (CVSS 9.9)
    • Component: Astron Agent Workflow Engine
    • Impact: Default LocalExecutor runs dynamic code with full Python builtins as root, allowing low-privilege tenants to compromise the core workflow container.
    • Action: Upgrade to Astron Agent v1.1.2+; enforce strict CODE_EXEC_TYPE configurations.
    • View Advisory

  5. GHSA-8qpj-27x8-pwpq (Langflow: PythonREPL RCE)

    • Severity: Critical (CVSS 9.9)
    • Component: Langflow PythonREPLComponent
    • Impact: Authenticated users can execute arbitrary Python code in-process, enabling privilege escalation to superuser via database manipulation.
    • Action: Upgrade Langflow; disable PythonREPLComponent for non-admin users.
    • View Advisory

  6. CVE-2026-93034 (SGLang: Pickle Deserialization RCE)

    • Severity: Critical (CVSS 9.8)
    • Component: SGLang ZMQ Message Decoder
    • Impact: Unconditional pickle.loads() on ZMQ messages allows remote code execution, especially when data-parallel attention is enabled.
    • Action: Isolate SGLang instances; apply patches to prevent unpickling of untrusted data.
    • View Advisory

  7. CVE-2026-103663 (Ollama: Path Traversal to RCE)

    • Severity: Critical (CVSS 9.4)
    • Component: Ollama /api/pull Endpoint
    • Impact: Path traversal via layer digests allows writing malicious binaries to /usr/lib/ollama, achieving RCE as root on restart.
    • Action: Upgrade Ollama; restrict write access to model store directories.
    • View Advisory

  8. GHSA-cf6m-vc3m-7cgm (Langflow: Webhook Auth Bypass)

    • Severity: Critical (CVSS 9.8)
    • Component: Langflow Webhook Authentication
    • Impact: WEBHOOK_AUTH_ENABLE=False (default) allows unauthenticated execution of any flow via UUID guessing, leading to RCE.
    • Action: Set WEBHOOK_AUTH_ENABLE=True; rotate all exposed flow UUIDs.
    • View Advisory

Agentic Orchestration: The New Attack Surface

The most alarming trend this week is the systemic collapse of security boundaries in agentic orchestration platforms. Langflow suffered a historic week with over a dozen Critical and High severity vulnerabilities, effectively turning the platform into an RCE-as-a-Service for authenticated attackers. The root cause across multiple advisories (e.g., GHSA-w794-rj3p-xv45, GHSA-8qpj-27x8-pwpq, GHSA-w584-2h2r-2hvf) is the blind trust placed in user-supplied code and commands. The MCP (Model Context Protocol) integration, intended to extend agent capabilities, became a primary vector for OS command injection, where bash -c wrappers executed arbitrary strings with zero validation.

Similarly, PraisonAI demonstrated how "agent" features can bypass traditional security controls. The CodeAgent vulnerability (GHSA-2xv2-w8cq-5gxw) is particularly insidious because it explicitly ignores the sandbox=True configuration, executing LLM-generated code with the full parent process environment. This renders the concept of a "sandboxed agent" moot unless the underlying execution engine is hardened. The AICoder component (GHSA-9mp3-24cc-77mg) further exacerbates this by allowing prompt injection to drive arbitrary file writes, effectively granting attackers root access in default Docker deployments.

Other platforms were not spared. Astron Agent (CVE-2026-108263) defaulted to a LocalExecutor that ran code as root, while OpenStack Mistral (CVE-2026-93858) allowed arbitrary command execution via SSH proxy configurations. The common thread is the assumption that "authenticated" users are benign, ignoring the reality of compromised credentials or insider threats in multi-tenant AI environments.

Model Serving and Inference Risks

Beyond orchestration, the inference layer itself showed significant fragility. SGLang's use of pickle.loads() for ZMQ message decoding (CVE-2026-93034) is a textbook example of dangerous deserialization in a high-performance context, allowing remote attackers to execute code simply by sending crafted messages. Ollama faced a severe path traversal issue (CVE-2026-103663) where malicious layer digests could overwrite system libraries, leading to persistent root access upon service restart.

vLLM also saw multiple Denial of Service (DoS) vectors (CVE-2026-105756, CVE-2026-105754), where crafted requests could crash the shared EngineCore, disrupting service for all tenants. These vulnerabilities highlight the need for strict input validation and isolation at the inference engine level, treating model inputs as untrusted data regardless of their source.

Supply Chain and Data Leakage

Supply chain risks continue to evolve, with Docling (CVE-2026-105745) loading external plugins even when disabled, and fsspec (GHSA-27vj-qcqg-25rc) allowing Server-Side Template Injection (SSTI) via Jinja2 rendering in reference filesystems. These issues demonstrate how dependencies can introduce RCE vectors deep in the data processing pipeline.

Data leakage remains a critical concern, particularly with Langflow's weak Fernet key derivation (GHSA-jxw3-mjmx-3pqm), which allows attackers to decrypt stored credentials if the SECRET_KEY is known. Additionally, Katanemo Plano (CVE-2026-108863) exposed LLM provider API keys in plaintext via an unauthenticated Envoy admin interface, underscoring the danger of exposed management ports in AI gateways.

Known Exploited Items

Fortunately, no entries this week were flagged with is_exploited=true. However, the sheer number of Critical RCEs with low authentication requirements (often just "authenticated user" or "network adjacent") suggests that active exploitation is highly probable in the wild. The window for defensive action is narrowing rapidly.

What to Do This Week

  1. Patch Agentic Platforms Immediately: Prioritize upgrading Langflow (to v1.10.3+), PraisonAI, and Astron Agent. These platforms are currently ground zero for RCE.
  2. Audit MCP Configurations: Review all Model Context Protocol server definitions in Langflow and other agents. Remove any custom commands or scripts that are not strictly necessary and verified.
  3. Enforce Network Segmentation: Isolate AI orchestration tools (Langflow, PraisonAI, Ollama) from the public internet and sensitive internal networks. Use firewalls to restrict access to trusted IPs only.
  4. Disable Dangerous Components: If immediate patching is not possible, disable PythonREPL, CodeAgent, and MCP features in your configuration files.
  5. Rotate Secrets: Assume that any secrets stored in Langflow or exposed via environment variables in PraisonAI may have been compromised. Rotate API keys, database credentials, and cloud tokens immediately.
  6. Run as Non-Root: Ensure all AI containers and services are running as non-root users to limit the impact of potential file write vulnerabilities.

What to Watch Next Week

Next week, expect deeper analysis into the Model Context Protocol (MCP) ecosystem, as its rapid adoption has outpaced security best practices. We anticipate more disclosures regarding MCP server authentication and tool definition validation. Additionally, monitor for follow-up exploits targeting vLLM and SGLang as researchers refine their RCE primitives against inference engines. The focus will likely shift from "can we escape the sandbox?" to "how fast can we pivot from the AI agent to the cloud metadata API?"

Covered entries (120)