VulnWatch VulnWatch
← All articles
Weekly digest · Oct 26, 2026

VulnWatch Weekly: Agentic RCE Epidemic & vLLM DoS Storm

This week saw a surge in critical agentic vulnerabilities allowing unauthenticated RCE via shell tools. Simultaneously, vLLM faced a wave of DoS vectors targeting multimodal processors.

Prompt Injection Remote Code Execution Data Leakage Auth Bypass SSRF API Abuse Agentic / MCP

Week in Review: The Agentic Explosion and the vLLM Avalanche

Executive Summary The week of October 19–25, 2026, will be remembered as a watershed moment for AI infrastructure security, defined by two dominant themes: the catastrophic failure of "agentic" safety guards and a coordinated wave of denial-of-service vectors targeting high-performance inference engines. The most urgent item demanding immediate CISO attention is CVE-2026-75128 in Langchain-Chatchat, a critical vulnerability allowing unauthenticated remote code execution (RCE) via a exposed shell tool, which sets a dangerous precedent for the week's broader trend of agentic over-permissioning. Security teams must assume that any AI agent with access to system tools is currently compromised if exposed to the internet.

Beyond the immediate RCE risks, the ecosystem faced a deluge of stability threats. The vLLM inference engine was hit with over a dozen distinct vulnerabilities ranging from resource exhaustion to engine crashes, highlighting the fragility of current multimodal processing pipelines. Simultaneously, the Model Context Protocol (MCP) and Agent-to-Agent (A2A) standards showed significant growing pains, with multiple authentication bypasses and session isolation failures reported across major SDKs. This retrospective details the highest-impact findings, analyzes the thematic shifts toward agentic exploitation, and provides a concrete mitigation roadmap for the week ahead.

Top Items of the Week

The following vulnerabilities represent the highest risk to AI/ML operations based on severity, exploitability, and potential impact.

  1. CVE-2026-75128 (Langchain-Chatchat)

    • Severity: Critical (CVSS 9.3)
    • Component: POST /tools/call API endpoint
    • Impact: Unauthenticated Remote Code Execution. Attackers can invoke the built-in shell tool to run arbitrary OS commands as the server user (often root in Docker).
    • Action: Immediately restrict network access to Langchain-Chatchat instances or upgrade to a patched version if available. Disable the shell tool in configuration.
    • Source: NVD CVE-2026-75128

  2. CVE-2026-114612 (LiteLLM)

    • Severity: Critical (CVSS 9.9)
    • Component: Proxy cryptographic context and MCP stdio endpoint
    • Impact: Privilege Escalation to Administrator. Authenticated internal users can forge administrator credentials by replaying ciphertext, gaining arbitrary command execution via MCP.
    • Action: Upgrade LiteLLM to version 1.104.0-rc.3 or later immediately. Rotate all proxy admin keys.
    • Source: NVD CVE-2026-114612

  3. CVE-2026-109442 (piflow)

    • Severity: Critical (CVSS 9.3)
    • Component: DeepAgents chat agent (/chat endpoints)
    • Impact: Unauthenticated RCE. Lack of authentication allows attackers to instruct the agent to execute exec_shell, exposing API keys and database credentials.
    • Action: Place piflow instances behind a strict WAF or reverse proxy with authentication. Disable exec_shell capabilities.
    • Source: NVD CVE-2026-109442

  4. CVE-2026-102503 (Google OSS Agent Mesh)

    • Severity: Critical (CVSS 9.3)
    • Component: /libp2p-http ingress server
    • Impact: Authentication Bypass. Unauthenticated peers can bypass Biscuit capability policies to invoke arbitrary backend services, including MCP servers.
    • Action: Upgrade Google OSS Agent Mesh (SAM) to version 0.1.0-alpha.3 or later. Review libp2p peer allowlists.
    • Source: NVD CVE-2026-102503

  5. CVE-2026-115727 (AgenticSeek)

    • Severity: Critical (CVSS 9.2)
    • Component: Flask llm_server/app.py
    • Impact: RCE via Debug Mode. Hardcoded Flask debug mode exposes the Werkzeug debugger, allowing PIN-based code execution.
    • Action: Upgrade AgenticSeek. Ensure production deployments never enable debug mode or bind to 0.0.0.0.
    • Source: NVD CVE-2026-115727

  6. CVE-2026-114053 (vLLM)

    • Severity: Critical (CVSS 9.2)
    • Component: Multimodal processor (mm_processor_kwargs)
    • Impact: RCE via trust_remote_code. Attackers can force the loading of malicious model revisions to execute arbitrary Python in the API process.
    • Action: Upgrade vLLM to 0.31.0+. Disable trust_remote_code unless absolutely necessary and strictly audit model repositories.
    • Source: NVD CVE-2026-114053

  7. CVE-2026-78162 (Apache Camel)

    • Severity: Critical (CVSS 10.0)
    • Component: camel-hazelcast component
    • Impact: RCE via Deserialization. Unrestricted Java deserialization in specific configuration paths allows remote code execution.
    • Action: Upgrade Apache Camel to 4.18.5+ or 4.22.1+. Apply JavaSerializationFilterConfig to all Hazelcast instances.
    • Source: NVD CVE-2026-78162

  8. CVE-2026-53995 (MLflow)

    • Severity: High (CVSS 8.8)
    • Component: FileStore tracking backend (/api/3.0/mlflow/traces)
    • Impact: Path Traversal / Arbitrary File Write. Unauthenticated attackers can write files outside the trace directory, potentially leading to RCE via config overwrites.
    • Action: Upgrade MLflow to 3.17.2+. Switch tracking backend to a database (SQLAlchemy) instead of FileStore if possible.
    • Source: NVD CVE-2026-53995

Theme: The Agentic RCE Epidemic

The most alarming trend this week is the systemic failure of AI agents to sanitize tool usage. The paradigm of "agents with tools" has introduced a massive attack surface where natural language inputs are directly translated into system commands without adequate guardrails.

Unauthenticated Shell Access The severity of CVE-2026-75128 in Langchain-Chatchat cannot be overstated. By exposing a POST /tools/call endpoint without authentication, the framework effectively offers a public shell to anyone who can reach the server. This is mirrored in CVE-2026-109442 (piflow) and CVE-2026-77926 (Aix-DB), where the exec_shell or deepagents execute tools are callable by remote attackers. In these cases, the "agent" acts as a perfect pivot point, executing commands with the privileges of the service account, often root in containerized environments.

Indirect Prompt Injection leading to RCE Even when direct shell access isn't exposed, indirect prompt injection remains a potent vector for code execution. CVE-2026-114107 in HKUDS Vibe-Trading demonstrates how planting instructions in documents or web pages processed by an agent can trigger subprocess.run calls. Similarly, CVE-2026-109440 in LangAlpha allows attackers to execute shell commands or Python code by injecting instructions into web content retrieved by the agent. These vulnerabilities highlight that input validation must extend beyond the user prompt to include all external data sources (URLs, files, emails) ingested by the agent.

Approval Gate Bypasses Security controls relying on "human-in-the-loop" approvals are proving fragile. CVE-2026-109444 in OpenSRE reveals an approval gate bypass where the execution_allowed() function hardcoded to True in headless modes. This allows attackers to inject commands into alerts or Slack messages that are triaged automatically, bypassing the intended human confirmation step entirely. This suggests that logical bypasses in approval workflows are as dangerous as missing authentication.

Theme: vLLM and Inference Engine Instability

While RCE grabs headlines, the sheer volume of Denial of Service (DoS) vulnerabilities in vLLM this week threatens the availability of AI services globally. The move toward multimodal support (images, audio, video) has introduced complex parsing logic that is highly susceptible to resource exhaustion.

Multimodal Resource Exhaustion A cluster of vulnerabilities (CVE-2026-116177, CVE-2026-116179, CVE-2026-114055, CVE-2026-114052) allows attackers to crash vLLM workers by manipulating mm_processor_kwargs. By sending requests with pathological image sizes, frame counts, or decompression bombs, attackers can force the server to allocate gigabytes of memory, triggering Out-Of-Memory (OOM) kills. The Nemotron-VL and MOSS-Audio processors were specifically cited for lacking bounds on these parameters.

Engine Crashes via Malformed Input Beyond memory exhaustion, specific malformed inputs can fatal-error the engine core. CVE-2026-116180 describes a scenario where prompt_logprobs against a cached prefix causes an OverflowError in the tokenizer, crashing EngineCore. Similarly, CVE-2026-116178 and CVE-2026-116172 detail how inconsistent multimodal metadata or oversized top_n values in gRPC requests can terminate the serving process. These are not just performance hiccups; they are hard crashes that require service restarts.

Cache Poisoning and Aliasing CVE-2026-114050 and CVE-2026-114054 reveal issues with cache identity. By supplying client-controlled UUIDs or EXIF data, attackers can collide cache keys, causing the engine to serve corrupted data or crash due to tensor mismatches. This undermines the integrity of the inference results and the stability of the shared cache.

Theme: Supply Chain and Model Loading Risks

The supply chain for AI models and datasets remains a critical weak point, with deserialization and dynamic code loading continuing to plague the ecosystem.

Insecure Deserialization CVE-2026-57845 in Hugging Face Datasets highlights the persistent danger of pickle deserialization. Attackers can craft malicious pickle files embedded in datasets that execute arbitrary code when loaded via datasets.load_dataset. This is a classic supply chain attack vector: poison the data, wait for the victim to load it.

Dynamic Code Loading The practice of loading remote code dynamically is inherently risky. CVE-2026-114053 (vLLM) and CVE-2026-92206 (CrewAI) both stem from allowing users or attackers to specify code revisions or module paths that are then imported and executed. In CrewAI, the load_agent_from_repository function fails to restrict user-supplied arguments before importing modules, enabling RCE if a user loads a malicious agent config.

Dockerfile Injection CVE-2026-112264 in BentoML introduces a novel supply chain risk: Dockerfile instruction injection. By embedding newlines in environment mapping keys, attackers can inject arbitrary RUN instructions during the container build process. This allows them to access build secrets and poison the resulting container image, compromising the integrity of the deployment artifact itself.

Theme: Protocol and SDK Growing Pains (MCP & A2A)

As the Model Context Protocol (MCP) and Agent-to-Agent (A2A) protocols gain traction, their implementations are revealing significant architectural flaws regarding authentication and session isolation.

Session Isolation Failures CVE-2026-115419 in Amazon Strands Agents SDK and GHSA-jm63-cq47-j5jp in the MCP TypeScript SDK both suffer from cross-tenant data leakage. In Strands, conversation state was not properly isolated by context_id, allowing one user to read another's history. In the MCP SDK, shared transport instances caused messages to be delivered to the wrong client due to ID collisions. These bugs fundamentally break the multi-tenant security model.

Authentication Bypasses in A2A The A2A Java SDK had a particularly rough week with multiple CVEs (CVE-2026-111764, CVE-2026-111765, CVE-2026-114123). Issues ranged from default configurations having no authorization (InMemoryTaskStore), to redirect vulnerabilities leaking credentials, to deployment scripts defaulting to empty API keys. CVE-2026-114123 is especially concerning as the official Azure deployment template defaulted to no authentication, leaving any deployed instance wide open.

Known Exploited Items Fortunately, our telemetry indicates that no items this week are currently marked as is_exploited=true in the wild. However, the simplicity of the exploits (e.g., sending a single HTTP request to a shell endpoint) suggests that weaponization is imminent. The lack of active exploitation today should not breed complacency; the window for patching is closing rapidly.

What to do this week

  1. Audit Agent Tooling: Immediately scan your AI agent deployments (Langchain, CrewAI, piflow, etc.) for exposed tool endpoints. Disable shell, exec, or code_interpreter tools unless strictly necessary and protected by robust authentication and allow-listing.
  2. Upgrade Inference Engines: Prioritize the upgrade of vLLM instances to version 0.31.0 or later to patch the suite of DoS and RCE vulnerabilities. If upgrading is not immediately possible, implement strict input validation at the load balancer level to reject requests with excessive mm_processor_kwargs or malformed multimodal data.
  3. Secure MCP/A2A Deployments: Review all MCP and A2A server configurations. Ensure that context_id isolation is enforced and that default authentication settings are overridden. Specifically check Amazon Strands and A2A Java SDK deployments for the default key issues.
  4. Sanitize Data Ingestion: For systems using Hugging Face Datasets or similar libraries, ensure that trust_remote_code is disabled and that pickle deserialization is blocked or sandboxed. Verify that any agent accessing external URLs (for RAG or browsing) is running in a network-restricted sandbox.
  5. Rotate Credentials: Given the severity of the LiteLLM and Langchain-Chatchat vulnerabilities, assume that any exposed instance may have had credentials or keys exfiltrated. Rotate API keys, database passwords, and internal service tokens associated with affected systems.

What to watch next week

Next week, we anticipate a shift towards data poisoning and model integrity attacks. As the perimeter hardens against direct RCE, attackers may pivot to corrupting the training data or fine-tuning datasets used by these agents. Additionally, expect deeper analysis of the MCP ecosystem, as the rapid adoption of this protocol often outpaces security maturity; we are likely to see more vulnerabilities related to tool definition injection and cross-plugin data leakage. Finally, keep an eye on quantum-resistant cryptography discussions in AI transport layers, as the long-lived nature of some model secrets makes them prime targets for "harvest now, decrypt later" strategies.

Stay vigilant, patch aggressively, and remember: in the age of agentic AI, a prompt is a command, and a command is a potential breach.

Covered entries (120)