VulnWatch VulnWatch
← All articles
Weekly digest · Nov 2, 2026

VulnWatch Weekly: The Langflow Tsunami and the MCP Security Crisis

This week saw an unprecedented flood of critical RCEs in IBM Langflow and a systemic collapse of security boundaries in the Model Context Protocol (MCP) ecosystem. Immediate patching is required for Langflow instances and any MCP server exposing tools to untrusted networks.

Prompt Injection Remote Code Execution Data Leakage Auth Bypass SSRF Agentic / MCP

Week in Review: The Langflow Tsunami and the MCP Security Crisis

Week: October 26 – November 1, 2026
Total Entries Analyzed: 120

The AI security landscape this week was defined by two catastrophic themes: a massive, coordinated disclosure of Remote Code Execution (RCE) vulnerabilities in IBM Langflow, and a systemic failure of isolation primitives across the burgeoning Model Context Protocol (MCP) ecosystem. The dominant narrative is one of "trust boundary collapse." In Langflow, the assumption that visual workflow builders are inherently safe was shattered by over a dozen critical flaws allowing authenticated users to escape sandboxes and execute arbitrary code. Simultaneously, the rapid adoption of MCP servers has introduced a new class of agentic vulnerabilities, where simple configuration errors—such as missing authentication on local HTTP endpoints or unsafe path sanitization—allow attackers to pivot from a compromised agent to the underlying host OS.

The single most urgent item for CISOs and platform engineers is CVE-2026-120338 in Prefab UI and the broader IBM Langflow cluster (CVE-2026-107329, CVE-2026-107328, etc.). These are not theoretical; they represent immediate, full-compromise vectors for any organization running these platforms. If you are running Langflow OSS versions 1.0.0 through 1.12.8, you must assume your environment is compromised if exposed to untrusted users. Second only to this is the urgent need to audit all MCP servers (MoLing, AnkiMCP, Gearboy, etc.) for exposed HTTP ports and missing authorization checks, as the "local-first" design pattern has repeatedly failed to prevent remote exploitation.

Top Items of the Week

The following vulnerabilities represent the highest immediate risk to AI infrastructure. Priority should be given to patching or isolating these components immediately.

  1. CVE-2026-120338 | Critical (CVSS 10.0) | Prefab UI

    • Component: Generative UI Sandbox (Pyodide/Deno)
    • Impact: Complete sandbox escape. The Deno subprocess runs with unrestricted file and network permissions (--allow-read, --allow-write, --allow-net), and the Pyodide JS proxy exposes these capabilities to Python code. An attacker supplying LLM-generated UI code can read/write arbitrary files on the server.
    • Action: Upgrade to Prefab UI > 0.20.2 immediately. If patching is not possible, disable the Generative UI feature or run the service in a strictly isolated container with no host volume mounts.
    • Source

  2. CVE-2026-107329 / CVE-2026-107328 / CVE-2026-110186 | Critical (CVSS 9.9) | IBM Langflow OSS

    • Component: Code Generation & Eval/Exec Neutralization
    • Impact: Remote authenticated attackers can execute arbitrary code. The platform fails to neutralize code in eval/exec contexts and improperly controls code generation components, allowing low-privileged users to break out of the workflow sandbox.
    • Action: Upgrade IBM Langflow OSS to version 1.12.9 or later immediately. Review all custom components for unsafe code execution patterns.
    • Source 1 | Source 2 | Source 3

  3. CVE-2026-63377 | Critical (CVSS 9.8) | TAKO AI Agent for Okta

    • Component: Initial Setup Routine (/api/auth/setup)
    • Impact: Pre-authentication Account Takeover. The setup endpoint allows unauthenticated network attackers to create the first administrator account before the legitimate owner completes initialization. Default Docker configurations expose this port to all interfaces.
    • Action: Ensure Docker containers are not bound to 0.0.0.0 during initial setup. Upgrade to TAKO AI Agent 3.0.1-beta or later.
    • Source

  4. CVE-2026-116692 | Critical (CVSS 9.8) | MLflow

    • Component: Third-Party Scorer Deserialization
    • Impact: Arbitrary Code Execution via Deserialization. The scorer validation logic accepts descendants of allowed modules rather than exact matches, allowing attackers to place malicious Python modules in writable directories and trigger execution via the /ajax-api/3.0/mlflow/scorer/invoke endpoint.
    • Action: Upgrade MLflow to version 3.17.0 or later. Restrict network access to MLflow artifact endpoints.
    • Source

  5. CVE-2026-62863 | Critical (CVSS 9.6) | MoLing MCP Server

    • Component: SSE Mode HTTP Endpoints
    • Impact: Unauthorized Tool Execution. In SSE mode, endpoints lack authentication and set Access-Control-Allow-Origin: *. Malicious websites can establish cross-origin connections to steal session IDs and issue arbitrary MCP tool calls (e.g., browser automation, file access) on behalf of the victim.
    • Action: Upgrade MoLing to 0.5.0+. Do not run MCP servers in SSE mode exposed to untrusted networks without a reverse proxy enforcing authentication.
    • Source

  6. CVE-2026-119050 | Critical (CVSS 9.2) | Agno

    • Component: PandasTools Reflection
    • Impact: Prompt Injection leading to RCE. Unsafe reflection allows attackers to invoke arbitrary pandas functions (e.g., read_pickle) via model-controlled function names, leading to local file reads or code execution.
    • Action: Upgrade Agno to 3.1.12+. Audit agent tools for unsafe reflection patterns.
    • Source

  7. CVE-2026-118375 | Critical (CVSS 9.2) | llama.cpp

    • Component: GGML RPC RDMA Transport
    • Impact: Stack Overflow / RCE. Unauthenticated peers can overflow the rpc-server stack by advertising RDMA capabilities and sending oversized messages, potentially leading to code execution.
    • Action: Upgrade llama.cpp to build b11865 or later. Disable RDMA transport if not strictly required.
    • Source

  8. CVE-2026-61738 | Critical (CVSS 10.0) | SOCFortress CoPilot

    • Component: ScoutSuite Report Generation
    • Impact: Path Traversal / File Write. Unsanitized filenames in multipart uploads allow attackers to write files outside the intended directory, potentially overwriting critical system files or planting web shells.
    • Action: Upgrade SOCFortress CoPilot to 0.1.77+.
    • Source

Theme: The Langflow Supply Chain Collapse

The most significant event of the week is the deluge of vulnerabilities affecting IBM Langflow OSS. This is not a single bug but a systemic failure of the platform's security architecture regarding code execution and user isolation. The sheer volume of critical CVEs suggests that the "low-code" abstraction leaked dangerously into the underlying Python runtime.

The core issue lies in how Langflow handles custom components and code generation. Vulnerabilities like CVE-2026-107328 (improper neutralization in eval/exec) and CVE-2026-104339 (OS command injection) indicate that user-supplied inputs in visual nodes were passed directly to dangerous Python primitives without adequate sanitization. Furthermore, CVE-2026-107327 and CVE-2026-110196 reveal missing authorization checks, allowing low-privileged users to configure built-in code-execution components that should have been restricted to administrators.

The impact is compounded by deserialization flaws (CVE-2026-104324, CVE-2026-104317) where untrusted data from message brokers or workflow exports could trigger arbitrary code execution. Perhaps most concerning is CVE-2026-18894, which allows attackers to trigger pre-existing stored Python component code in public workflows, effectively turning any shared flow into a persistent backdoor.

Mitigation Strategy: Organizations relying on Langflow must treat all instances running versions prior to 1.12.9 as compromised. Beyond patching, teams should audit their workflows for any custom Python code nodes and enforce strict network segmentation around the Langflow backend. The assumption that "visual programming" is safe by default must be discarded; these tools require the same rigorous security review as traditional codebases.

Theme: Agentic Chaos and the MCP Security Crisis

The Model Context Protocol (MCP) has emerged as the standard for connecting AI agents to external tools, but this week's disclosures highlight a catastrophic lack of security hygiene in its implementation. The "local-first" design philosophy has led developers to assume that binding to localhost or running inside a container provides sufficient isolation. This assumption is false.

A recurring pattern across multiple projects (MoLing, AnkiMCP, Gearboy, PDF Reader MCP) is the exposure of HTTP endpoints without authentication. CVE-2026-62863 (MoLing) and CVE-2026-61546 (AnkiMCP) demonstrate how easily a malicious webpage can interact with a locally running MCP server via cross-origin requests, stealing session tokens or issuing direct tool calls. In the case of CVE-2026-62264 (PDF Reader MCP), the server logs that authentication is enabled but fails to actually validate the API key, creating a false sense of security.

The danger is amplified by Command Injection vulnerabilities in MCP tools. Projects like hagent (CVE-2026-117573), Kali-GPT (CVE-2026-117569), esp-mcp (CVE-2026-117567), and Codefriar sf-mcp (CVE-2026-117561) all suffer from the same flaw: passing unsanitized user inputs (often derived from prompt injection) directly to subprocess.run(shell=True) or execSync. An attacker who can influence the agent's prompt can easily inject shell metacharacters to execute arbitrary commands on the host.

Furthermore, path traversal and SSRF issues plague the ecosystem. CVE-2026-118378 (Tabularis) allows SQL injection via MCP tools, while GHSA-7w82-6f9j-v9jp reveals that the mcp-sanitizer library explicitly whitelists absolute paths in /home/ and /Users/, allowing agents to read sensitive files like SSH keys and AWS credentials. CVE-2026-13451 in KServe shows that even orchestration layers are vulnerable, allowing namespace-scoped users to trigger SSRF via malicious storageUri parameters.

Mitigation Strategy: The agentic layer requires a zero-trust approach. MCP servers must never be exposed to untrusted networks without a robust authentication layer (e.g., OAuth2 with strict audience validation, as highlighted by CVE-2026-116684). Developers must sanitize all tool inputs rigorously, avoiding shell execution entirely in favor of structured argument passing. The mcp-sanitizer library needs immediate review in any project using it, as its default allowlists are dangerously permissive.

Theme: Inference Engine Instability and Model Poisoning

While RCE dominates the headlines, the integrity and availability of inference engines remain critical concerns. llama.cpp continues to be a focal point for memory safety issues. CVE-2026-118375 (RDMA stack overflow) and CVE-2026-116816 (heap out-of-bounds write via crafted GGUF models) highlight the risks of loading untrusted model weights. Attackers can craft malicious GGUF files that corrupt memory during loading, leading to crashes or potential code execution.

Similarly, vLLM faces a series of availability and RCE risks. CVE-2026-115915 describes a chain where attacker-controlled image bytes can trigger vulnerabilities in underlying image processing libraries (Ghostscript, Pillow), leading to RCE. CVE-2026-115912 exposes a pickle deserialization flaw in shared-memory multimodal caching, allowing authenticated users to execute arbitrary Python code. Denial of Service is also a major theme, with CVE-2026-115914 and CVE-2026-115913 showing how specific image or audio inputs can crash the engine or exhaust GPU memory.

The supply chain risk extends to model loading in Crawl4AI (CVE-2026-119120), where users can specify arbitrary HuggingFace models, including those containing malicious pickle weights. This underscores the danger of allowing users to dynamically load models from unverified sources.

Theme: Data Leakage and Configuration Errors

Beyond active exploitation, this week saw significant data leakage vulnerabilities driven by configuration errors and poor secret management. CVE-2026-110474 in CreditNirvana's Agentic AI Call Centre exposed hardcoded API keys in client-side JavaScript bundles, allowing unauthenticated attackers to retrieve call transcripts. CVE-2026-59158 in Nuxt Ollama similarly leaked cloud API keys by merging them into public runtime configurations accessible to any browser.

In MLflow, CVE-2026-116691 revealed that autologging for CrewAI agents inadvertently captured and transmitted plaintext provider API keys to the trace backend. SOCFortress CoPilot suffered from multiple information disclosure flaws (CVE-2026-61730, CVE-2026-110245), where unauthenticated endpoints exposed sensitive security reports and internal data.

These incidents highlight a recurring failure: developers treating AI infrastructure as "internal only" and neglecting basic secret hygiene. The assumption that backend configurations won't leak to the frontend, or that trace data doesn't contain secrets, is proving fatal.

Known Exploited Items

Fortunately, as of this writing, no items in this week's digest are marked as is_exploited=true. However, the severity and simplicity of many of these exploits (particularly the MCP command injections and Langflow RCEs) suggest that active exploitation in the wild is imminent. The window for defensive action is narrowing rapidly.

What to Do This Week

  1. Patch Langflow Immediately: If you run IBM Langflow OSS, upgrade to version 1.12.9+ today. Audit all existing flows for custom code components and restrict their usage to trusted administrators only.
  2. Audit MCP Servers: Inventory all MCP servers in your environment. Ensure none are bound to 0.0.0.0 without authentication. Apply patches for MoLing, AnkiMCP, and others. Review mcp-sanitizer configurations and remove absolute path allowlists.
  3. Restrict Model Loading: Configure inference engines (vLLM, llama.cpp) and RAG systems (Crawl4AI) to only load models from trusted, verified registries. Block arbitrary URL-based model loading.
  4. Scan for Secrets: Run automated scans on your AI application codebases to detect hardcoded API keys or secrets leaked into client-side bundles (check for runtimeConfig.public leaks in Nuxt/Next.js apps).
  5. Sandbox Agentic Tools: Review all tools exposed to AI agents. Replace shell=True subprocess calls with structured argument arrays. Implement strict allowlists for file paths and network destinations.

What to Watch Next Week

Next week, we anticipate a surge in "second-order" exploits targeting the fixes applied this week, particularly in the MCP ecosystem where the attack surface is vast and fragmented. We are also monitoring the potential for supply chain attacks targeting the HuggingFace model registry, leveraging the pickle deserialization vulnerabilities identified in vLLM and Crawl4AI. Finally, expect increased scrutiny on "visual coding" platforms; the Langflow incident may prompt researchers to audit similar low-code AI orchestration tools for comparable sandbox escapes.

Covered entries (120)