30 Jun 2026 · IBM
IBM Langflow OSS versions 1.0.0 through 1.9.6 contain a server-side request forgery flaw in the legacy RSSReaderComponent and SearXNG component, which make unvalidated HTTP requests to user-controlled URLs and bypass SSRF protections added in 1.9.3. An authenticated attacker, or an attacker using prompt injection against agentic workflows where the components are exposed as tools, can reach internal resources such as cloud metadata services and potentially exfiltrate IAM credentials.
workflow·prompt injection·
30 Jun 2026 · GitHub
A missing authorization flaw in the GitHub Copilot pull request description diff summary endpoint in GitHub Enterprise Server let any authenticated user render cross-repository comparison diffs and read source code from private repositories they had no access to. It affected all versions prior to 3.21 and was fixed in 3.17.17, 3.18.11, 3.19.8 and 3.20.4.
coding·excessive permissions·
30 Jun 2026 · Presenton
Presenton before 0.8.8-beta exposed its bundled MCP server unauthenticated at /mcp because the nginx front-end did not apply the auth_request gate and the MCP server auto-minted a valid internal session token. Remote unauthenticated attackers could invoke MCP tools such as generate_presentation, consuming the operator's LLM API keys and creating presentations in their instance.
workflow·misconfiguration·
30 Jun 2026 · HKUDS
DeepTutor before 1.4.10 contained an authorization bypass in its multi-user tool access control, where allowed_mcp_tools returned None instead of a denial when mcp_tools was omitted from a user's grant. Low-privilege users or prompt-injected content in a user session could enumerate and invoke any configured MCP tool, including filesystem, shell, and browser servers.
other·excessive permissions·
29 Jun 2026 · Anthropic
Anthropic's Claude Code agentic coding tool had two disclosed flaws: CVE-2026-46406, where the /copy command wrote responses to a predictable world-readable path (/tmp/claude/response.md) allowing local users to read secrets or plant symlinks to overwrite files, and CVE-2026-55607, where worktree handling allowed git directory confusion and symlink abuse to overwrite home-directory files and execute code outside the seatbelt sandbox. Both were fixed in later releases (2.1.128 and 2.1.163 respectively).
coding·misconfiguration·
29 Jun 2026 · Devolutions
Devolutions PowerShell Universal 2026.2.0 serializes App Tokens in plaintext within AI Agent job API responses, allowing an authenticated user with AI Agent read access to obtain reusable, potentially higher-privileged authentication tokens.
workflow·data leak·
29 Jun 2026 · CherryHQ
A vulnerability in CherryHQ cherry-studio up to version 1.9.6 affects the MCP OAuth Local Callback Server (src/main/services/mcp/oauth/callback.ts), where manipulation of the 'code' argument leads to improper authorization and can be triggered remotely. The exploit has been publicly disclosed and a fix pull request is still awaiting acceptance.
other·excessive permissions·
28 Jun 2026 · FlowiseAI
Flowise before 3.1.3 compared Custom MCP stdio environment variable names against a denylist case-sensitively, so on Windows an authenticated user could supply 'node_options' to bypass the NODE_OPTIONS block. This allowed injection of NODE_OPTIONS --require and arbitrary code execution in the Flowise server context.
workflow·tool misuse·
26 Jun 2026 · Mattermost
Mattermost versions 10.11.x <= 10.11.18, 11.6.x <= 11.6.3 and 11.5.x <= 11.5.6 fail to validate attachment URLs against internal or private IP ranges in the Mattermost Agents plugin MCP server. An attacker with access to the MCP server in stdio mode can supply internal URLs as file attachments in post creation requests to perform server-side request forgery and exfiltrate data from internal network services.
workflow·tool misuse·
26 Jun 2026 · Significant Gravitas
A vulnerability in AutoGPT's AITextSummarizerBlock prior to version 0.6.32 allowed malicious users to amplify input (e.g. 10K of content causing ~50G of memory consumption), exhausting server memory and causing denial of service. The issue is fixed in version 0.6.32.
workflow·unknown·
26 Jun 2026 · GitHub
In GitHub's official MCP Server versions 0.22.0 through 1.1.1, running in HTTP mode with --lockdown-mode enabled caused the RepoAccessCache to be a process-global singleton initialized with the first authenticated user's GraphQL client, so all later users' lockdown-related GraphQL queries ran under the first user's credentials. The issue is fixed in version 1.1.2.
coding·excessive permissions·
25 Jun 2026 · LibreChat
Two vulnerabilities were disclosed in LibreChat: CVE-2026-54027, where the POST /api/files/images endpoint let any authenticated user upload files into any agent's tool_resources without ownership or EDIT permission checks, and CVE-2026-54030, where the MCP OAuth implementation failed to validate the RFC 9728 resource parameter against the configured MCP server URL, allowing a malicious MCP server to steal access tokens. Both are fixed in versions 0.8.4-rc1 and 0.8.5 respectively.
other·excessive permissions·
25 Jun 2026 · ToolJet
Three vulnerabilities (CVE-2026-55411/55412/55413) disclosed in ToolJet, the open-source platform for internal tools, workflows and AI agents, allowed any authenticated user to decrypt other organisations' data-source secrets, reach cloud metadata endpoints via SSRF to steal Azure managed identity tokens, and overwrite shared marketplace plugins with server-side JavaScript for RCE and supply-chain compromise. All are fixed in versions 3.20.1780-lts and 3.20.178-lts.
workflow·excessive permissions·
25 Jun 2026 · Cursor
Two vulnerabilities in Cursor prior to version 3.0 let a malicious AI agent escape the terminal command sandbox — by manipulating the working_directory parameter or by forcing path canonicalization to fail via an in-workspace symlink — to write arbitrary files outside the workspace under the user's privileges, enabling non-sandboxed remote code execution. Both issues are fixed in Cursor 3.0.
coding·excessive permissions·
24 Jun 2026 · Jenkins
A missing permission check in the Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier allows attackers with Item/Read permission to read the Pipeline replay scripts of jobs they can access. The issue was published as CVE-2026-57300 alongside a Jenkins security advisory.
workflow·excessive permissions·
24 Jun 2026 · Warp
Seven CVEs disclosed against Warp, an agentic development environment, covering command execution policy and permission-check bypasses in its agent tools, command injection in branch selector, Linux editor launcher and legacy SSH paths, unconfirmed local file writes via OSC 1337 payloads, clipboard access from terminal output, and opening executable local files from Markdown links. All were fixed in release 0.2026.05.06.15.42.stable_01.
coding·tool misuse·
24 Jun 2026 · Twenty
Prior to version 2.9.0, Twenty's AI agent monitor AgentTurnResolver looked up agent turns by agentId/turnId without checking workspaceId, allowing any authenticated user with the AI settings flag to read another workspace's full AI agent chat history, including raw chat text, tool calls and tool outputs, and to trigger evaluations on the victim's turns. The issue is fixed in Twenty 2.9.0.
other·excessive permissions·
23 Jun 2026 · Langflow
NVD published a batch of Langflow advisories covering flaws in the AI agent/workflow builder, including unauthenticated remote code execution via the "Shareable Playground" public flow route, IDOR issues letting authenticated users read, delete or execute other users' data and flows, path traversal and arbitrary file read, and a denial-of-service via unauthenticated file upload. All are fixed in releases between 1.0.19 and 1.10.0, and one IDOR (CVE-2026-55255) is listed in CISA's Known Exploited Vulnerabilities catalog.
workflow·excessive permissions·
23 Jun 2026 · Anthropic
In Claude Code versions 0.2.54 through 2.1.162, the pre-approved bare hostname huggingface.co allowed any path on that domain—including attacker-controlled model repositories—to be fetched by WebFetch without a permission prompt or --allowedTools enforcement. An attacker able to inject untrusted content into the context could use HuggingFace download counts as an out-of-band channel to exfiltrate files, environment variables or command output; fixed in 2.1.163.
coding·excessive permissions·
23 Jun 2026 · Daytona
Six CVEs were published for Daytona, an infrastructure runtime for AI-generated code execution and agent workflows, covering cross-tenant authorization flaws in its notification WebSocket gateway and organization role endpoints, unverified-email invitation acceptance, stale sandbox preview visibility caching, a volume path-traversal bind-mount issue, and git clone with TLS certificate verification disabled that could leak Git credentials. All issues are fixed in releases 0.184.0 through 0.186.
coding·excessive permissions·
23 Jun 2026 · rtk-ai
Version 1.0.0 of the @rtk-ai/rtk-rewrite plugin for OpenClaw passes attacker-influenced exec tool command input into a shell-backed execSync() template string without shell-safe escaping, leaving $() and backtick metacharacters intact. Anyone able to influence the exec tool's command parameter, such as through an LLM agent prompt or gateway tool-call input, can achieve arbitrary OS command execution with the privileges of the plugin/gateway process.
coding·tool misuse·
23 Jun 2026 · Red Hat
A session management vulnerability in the foreman-mcp-server MCP Server lets unauthenticated attackers hijack active administrative sessions, because authenticated client connections are improperly cached, session IDs are trusted without re-validating authentication tokens, and newly created session IDs are written to standard logs. Exploitation can lead to privilege escalation and infrastructure-wide code execution.
workflow·misconfiguration·
22 Jun 2026 · Apache Software Foundation
Apache Doris MCP Server contains a SQL injection flaw where a user-controlled database name is interpolated into a metadata query that is executed without the caller's authorization context, letting an authenticated (or anonymous, if auth is disabled) attacker bypass SQL security validation and read metadata outside the intended database scope. The issue is fixed in version 0.6.1.
other·excessive permissions·
22 Jun 2026 · LangChain
Several LangChain components that resolve filesystem paths or expand search patterns failed to confine resolved paths to the intended root directory, so glob patterns, symlinks and prefix-based authorization checks could expose files outside the configured boundary when path values or workspace contents were influenced by untrusted input, including an LLM. Fixed in LangChain 1.3.9.
workflow·excessive permissions·
21 Jun 2026 · BerriAI
Two server-side request forgery flaws were publicly disclosed in BerriAI LiteLLM up to version 1.82.2, affecting the MCP Server Connection Testing function _execute_with_mcp_client (CVE-2026-12774) and the MCP OpenAPI Spec Loader function load_openapi_spec_async via the spec_path argument (CVE-2026-12798). Both are remotely exploitable and public exploit details are available.
other·tool misuse·
20 Jun 2026 · FlowiseAI
Three CVEs disclosed against FlowiseAI's Flowise low-code LLM/agent workflow platform allow remote code execution on the host, including unauthenticated RCE via the Custom MCP endpoint, OS command injection through the Custom MCP Server feature, and vm2 sandbox escape via the overrideConfig option. Fixes are available in Flowise 2.1.4, 3.0.6 and 3.1.2.
workflow·excessive permissions·
19 Jun 2026 · dtwang
In versions prior to 1.1.2, the line-desktop-mcp server's --http-mode bound to 0.0.0.0 and exposed the /mcp endpoint with no MCP-layer authentication, letting any network client initialize a session and call tools that read LINE Desktop chat history or send messages through the logged-in application. Version 1.1.2 fixes the issue.
workflow·misconfiguration·
19 Jun 2026 · flipped-aurora
An authenticated attacker with access to the code-generation feature and MCP management interface of gin-vue-admin 2.9.1 can inject Go source code via POST /autoCode/addFunc and trigger a rebuild/restart via POST /autoCode/mcpStart, executing arbitrary OS commands with the application's privileges. Impacts include remote code execution, backdoor persistence and manipulation of application data and configuration; no patched version was known at publication.
coding·tool misuse·
18 Jun 2026 · Google (googleapis)
An authenticated authorization bypass in MCP Toolbox for Databases lets low-privilege clients invoke high-privilege tools by requesting an older MCP protocol version (or omitting the MCP-Protocol-Version header), because only the 2025-11-25 handler enforces per-tool scopesRequired restrictions.
workflow·excessive permissions·
18 Jun 2026 · StarTree (startreedata)
mcp-pinot, a Python Model Context Protocol server for Apache Pinot, defaulted in versions 3.0.1 and below to an HTTP MCP server bound to 0.0.0.0:8080 with no authentication, letting any network-adjacent caller invoke all MCP tools. Because the server proxies calls with server-side Pinot credentials, this confused-deputy condition granted full read/write access to the configured Pinot cluster; it was fixed in version 3.1.0.
other·misconfiguration·
18 Jun 2026 · Eclipse Foundation
Three vulnerabilities in Eclipse Theia versions prior to 1.71.0 allowed a malicious workspace to inject instructions into the AI chat agent via file/directory names or auto-loaded .prompts/*.prompttemplate files, and to exfiltrate workspace or conversation data through unrestricted Markdown image requests or run arbitrary commands via task definitions. Workspace trust enforcement added in v1.71.0 disables AI features in untrusted workspaces and mitigates the documented attack chain.
coding·prompt injection·
18 Jun 2026 · Microsoft
NVD published several Copilot vulnerabilities in June 2026, including missing authentication and command injection in Microsoft 365 Copilot, an open redirect in Copilot Business Chat, and a GitHub Copilot 1.372.0 flaw allowing filesystem access outside the workspace folder without user approval, enabling exfiltration via indirect prompt injection.
coding·excessive permissions·
18 Jun 2026 · PraisonAI
PraisonAI versions before 4.5.128 hardcoded approval_mode to "auto" in UI modules, overriding the PRAISON_APPROVAL_MODE administrator setting. Authenticated users could instruct the LLM agent to run arbitrary shell commands through subprocess.run with shell=True, bypassing the manual approval gate and command sanitization blocklists.
workflow·excessive permissions·
18 Jun 2026 · pgAdmin
A vulnerability in the pgAdmin 4 AI Assistant's execute_sql_query tool allowed multi-statement LLM-generated SQL to terminate the read-only transaction wrapper and run arbitrary SQL with the pgAdmin user's database privileges. Delivered via prompt injection through attacker-controlled database content, it enabled unauthorised data modification and, with superuser or pg_execute_server_program roles, remote code execution via COPY ... TO PROGRAM.
workflow·prompt injection·
17 Jun 2026 · Pydantic
Pydantic AI versions 1.56.0 through 1.101.0 and 2.0.0 betas allowed its cloud-metadata IP blocklist to be bypassed by encoding the metadata IP in IPv6 transition forms (IPv4-compatible IPv6, NAT64 local-use and operator prefixes, ISATAP) that the earlier fix for CVE-2026-46678 did not decode, potentially exposing cloud IAM short-term credentials. Exploitation requires an application to opt a URL into force_download='allow-local' and to run on a network routing the affected transition forms; the issue was fixed in version 2.0.0b3.
workflow·tool misuse·
17 Jun 2026 · Splunk
Splunk AI Toolkit versions below 5.7.4 shipped an insecure default domain allowlist that failed to restrict outbound AI agent requests, letting a low-privileged user without the 'admin' or 'power' roles force the toolkit to make HTTP requests to an attacker-controlled server and potentially exfiltrate data.
other·misconfiguration·
17 Jun 2026 · Jovancoding
Network-AI, a TypeScript/Node.js multi-agent orchestrator, shipped an MCP SSE server with an empty default secret through version 5.7.1, so its authorization check passed for any caller. Non-browser clients such as curl or SSRF requests could invoke all 22 MCP tools (including config_set, agent_spawn and blackboard_write) without credentials; fixed in version 5.7.2.
workflow·misconfiguration·
17 Jun 2026 · CursorTouch
Versions of the open-source Windows-MCP server before 0.7.5 exposed the MCP control plane over HTTP without authentication and with wildcard CORS, allowing attackers from arbitrary origins or non-browser clients to invoke a PowerShell tool and run commands as the user running Windows-MCP. The issue was fixed in version 0.7.5.
other·misconfiguration·
16 Jun 2026 · OpenClaw
OpenClaw versions before 2026.5.12 forward operator-configured custom headers during cross-origin redirects on streamable-http MCP servers. An attacker controlling or compromising an MCP endpoint can redirect requests to exfiltrate sensitive headers such as API keys or tenant-routing credentials.
other·data leak·
15 Jun 2026 · HKUDS
A flaw in the Research Export component of HKUDS AI-Trader allowed remote, unauthenticated access to /api/research/agents.csv, resulting in information disclosure. A public exploit exists and the vendor patched it so research export endpoints now require an authenticated agent with the research_exports capability.
other·excessive permissions·
15 Jun 2026 · Cursor
In Cursor Desktop versions prior to 3.0.0, workspace-defined Claude hook commands in .claude/settings.local.json could execute without dedicated user approval, letting a malicious workspace or agent-created file run local commands in the user's context at the end of an agent turn. The flaw could enable sandbox escape, persistence, local data access or further compromise, and was fixed in version 3.0.0.
coding·excessive permissions·
13 Jun 2026 · That1Drifter
browse-mcp versions prior to 0.8.2 allow malicious MCP clients or agents manipulated through prompt injection to write arbitrary files to the host system by bypassing path validation in browser_download, browser_save_state, and browser_load_state functions. This vulnerability could enable host code execution through writes to sensitive files like ~/.bashrc or cron configurations.
browsing·excessive permissions·
12 Jun 2026 · AgenticMail
Prior to version 0.9.27, the @agenticmail/mcp package exposed a Streamable HTTP transport (via --http or MCP_HTTP=1) whose /mcp endpoint accepted requests with no HTTP authentication, letting any remote client initialize a session and invoke tools directly. The issue was patched in version 0.9.27.
other·misconfiguration·
11 Jun 2026 · Flux159
Versions of mcp-server-kubernetes prior to 3.6.0 enforced their ALLOW_ONLY_READONLY_TOOLS, ALLOW_ONLY_NON_DESTRUCTIVE_TOOLS and ALLOWED_TOOLS restrictions only during tool discovery (tools/list), not at execution (tools/call), so any client knowing a tool name could invoke restricted Kubernetes operations. The issue was patched in version 3.6.0.
workflow·excessive permissions·
11 Jun 2026 · Flux159
Prior to version 3.7.0, the kubectl_generic tool in mcp-server-kubernetes passed user-supplied flags to kubectl without an allowlist, letting an attacker plant injected instructions in application logs so that an operator's AI agent redirects kubectl to an attacker-controlled server and leaks the operator's bearer token. The captured token could be replayed against the real Kubernetes API, granting the attacker the operator's full RBAC permissions; it was patched in version 3.7.0.
workflow·prompt injection·
9 Jun 2026 · Microsoft
A path traversal flaw (CVE-2026-45482) in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. Microsoft published an advisory for the issue in its update guide.
coding·unknown·
4 Jun 2026 · Microsoft
Three CVEs published for Microsoft Copilot products describe improper neutralization of special elements ('injection') issues: CVE-2026-42824 and CVE-2026-47644 allow unauthorized attackers to disclose information over a network in M365 Copilot and Copilot Chat (Microsoft Edge), while CVE-2026-45497 allows an authorized attacker to execute code over a network in Microsoft Copilot.
other·unknown·
2 Jun 2026 · Gitlawb
In OpenClaude, an open-source coding-agent CLI, versions prior to 0.5.1 contained a logic flaw in the ordering of conditionals in the temporary local HTTP server used for MCP OAuth callbacks, letting an attacker bypass the anti-CSRF state parameter validation entirely and force the server to shut down without knowing the state value. The issue was patched in version 0.5.1.
coding·unknown·
2 Jun 2026 · LibreChat
Three vulnerabilities in LibreChat versions up to and including 0.8.3 (CVE-2026-32625, CVE-2026-44653, CVE-2026-44654) let authenticated users exfiltrate server environment secrets such as CREDS_KEY, JWT_SECRET and MONGO_URI via malicious MCP server URLs, read decrypted admin-managed MCP credentials with only VIEW access, and delete an owner's files globally from a shared agent. The issues are patched in versions 0.8.4-rc1 and 0.8.4.
other·data leak·
1 Jun 2026 · horizon921
A server-side request forgery flaw in the MCP API call endpoint (client/src/app/api/mcp/call/route.ts) of horizon921 mcpilot 0.1.0 allows remote attackers to manipulate the serverBaseUrl argument. A public exploit has been released and the project has not responded to the issue report.
workflow·tool misuse·
