Structured records of AI agent security incidents: what happened, which vendor and agent type, the root cause, and every source we used. Filter, browse, or download as CSV.
26 May 2026 · masci
Versions of the banks LLM prompt-templating library before 2.4.2 rendered prompt templates with an unsandboxed jinja2.Environment(), so applications passing user-supplied strings as templates to Prompt() were vulnerable to server-side template injection leading to remote code execution. The issue is fixed in version 2.4.2.
other·misconfiguration·
26 May 2026 · yoda-digital
Prior to version 0.6.0, the GitLab MCP Server's HTTP/SSE transport shipped with no inbound authentication, a wildcard Access-Control-Allow-Origin header, and a default bind to 0.0.0.0, exposing a mutation-capable RPC endpoint backed by the operator's GitLab personal access token. The issue is fixed in 0.6.0.
coding·misconfiguration·
26 May 2026 · LangChain
LangChain versions before 0.3.85 and 1.3.3 deserialized application-controlled payloads using overly broad object allowlists, letting attacker-supplied serialized constructor dictionaries instantiate trusted LangChain classes with untrusted arguments. A related issue in the LangSmith SDKs (before Python 0.8.0 and JS/TS 0.6.0) meant prompt pull methods deserialized externally controlled public prompt manifests without distinguishing them from prompts owned by the caller's organization.
other·excessive permissions·
24 May 2026 · NousResearch
A publicly disclosed vulnerability (CVE-2026-9353) in NousResearch hermes-agent up to version 2026.4.23 allows remote injection via manipulation of the THREAT_PATTERNS argument in the Skills Guard Multi-Word Prompt Handler (agent/skills_guard.py). The exploit has been published and the vendor did not respond to disclosure attempts.
other·prompt injection·
22 May 2026 · Microsoft
Two command injection vulnerabilities were published for Microsoft's Copilot assistants: CVE-2026-41090 lets an unauthorized attacker perform tampering over a network in Microsoft Copilot, and CVE-2026-42827 lets an unauthorized attacker disclose information over a network in M365 Copilot. Both stem from improper neutralization of special elements used in a command.
other·unknown·
21 May 2026 · LINE
Central Dogma's Git mirror SSH client (SshGitMirror) installs a server key verifier that unconditionally returns true and disables known_hosts fallbacks, so every outbound git+ssh:// mirror connection trusts any host key presented. An on-path attacker can impersonate the remote git server to exfiltrate mirrored configuration secrets or inject arbitrary commits that propagate to downstream services.
other·misconfiguration·
15 May 2026 · 611711Dark
MCP Calculate Server, an MCP-protocol mathematical calculation service built on SymPy, used eval() to evaluate expressions without input sanitization, allowing remote code execution. The issue was fixed in version 0.1.1.
other·tool misuse·
15 May 2026 · Open WebUI
Open WebUI versions prior to 0.9.5 validated only the initial URL in validate_url(), while downstream HTTP clients followed 3xx redirects without re-checking private or metadata IP block lists. Any authenticated user could submit a public URL redirecting to internal addresses (e.g. 127.0.0.1, 169.254.169.254, RFC1918) and read internal response bodies through retrieval, image and chat completion endpoints.
browsing·tool misuse·
15 May 2026 · Microsoft
Three vulnerabilities disclosed in Microsoft APM, an open-source dependency manager for AI agents, allow malicious marketplace plugins or remote dependencies to copy arbitrary host files via path traversal, dereference committed symlinks into project deploy directories, and write outside the extraction root on Windows via unchecked tar extraction. All are fixed in versions 0.8.12 and 0.13.0.
coding·supply chain·
14 May 2026 · Hatchet
A missing authorization directive on Hatchet's GET /api/v1/stable/dags/tasks endpoint skipped the tenant-membership check, letting any authenticated user on the instance retrieve task metadata for DAGs belonging to other tenants. The issue is fixed in version 0.83.39.
workflow·misconfiguration·
14 May 2026 · Model Context Protocol
Five CVEs published on 14 May 2026 describe flaws in the Model Context Protocol ecosystem: stored XSS, open redirect, SSRF blocklist bypass, cross-deployment GitHub OIDC token reuse and fail-open OCI ownership validation in the MCP Registry, plus a missing Host-header check enabling DNS rebinding against local MCP servers in the rmcp Rust SDK. All issues were fixed in later releases (registry 1.7.5/1.7.6/1.7.7/1.7.9 and rmcp 1.4.0).
other·supply chain·
13 May 2026 · Vercel
Vercel CLI versions 50.16.0 through 52.0.0 embedded plaintext authentication tokens passed via --token/-t into JSON follow-up command suggestions emitted in non-interactive or auto-detected AI agent mode, risking token exposure in CI/CD logs and agent transcripts. The issue is fixed in version 52.0.1.
coding·data leak·
13 May 2026 · GitHub
A vulnerability in GitHub Copilot CLI before version 1.0.43 allowed a malicious bare git repository nested in a project directory to achieve arbitrary code execution when the agent ran git operations, by abusing executable git config keys such as core.fsmonitor. The issue is fixed in version 1.0.43.
coding·tool misuse·
12 May 2026 · Open Source Kubectl MCP Server (rohitg00)
A vulnerability in the open-source Kubectl MCP Server v1.1.1 allows attackers to execute arbitrary code on a victim's system when the user interacts with a crafted HTML page. The flaw is tracked as CVE-2025-65719 and described as a critical RCE.
other·unknown·
12 May 2026 · Jo-Jo98 (ciguard project)
The discover_pipeline_files() function in ciguard 0.8.0–0.8.1 follows symlinks when walking a directory tree, so an attacker who plants a symlink in a directory scanned by a user or AI agent can cause the tool to return paths to pipeline-shaped files outside the requested root. The issue is fixed in version 0.8.2.
coding·data leak·
12 May 2026 · MIC-DKFZ
Prior to version 2.4.1, nnU-Net's GitHub Actions issue-triage workflow embedded untrusted issue titles and bodies directly into the prompt of a command-capable Claude Code agent, allowing any GitHub user who opens an issue to steer the agent beyond its intended triage purpose and influence authenticated issue actions such as commenting and relabelling. The issue is fixed in nnU-Net 2.4.1.
workflow·prompt injection·
12 May 2026 ·
Code Runner MCP Server exposes its /mcp JSON-RPC endpoint without authentication on port 3088 when started with --transport http, letting a remote unauthenticated attacker call the run-code tool to execute arbitrary code via child_process.exec() with the server user's privileges. The issue is reported as unfixed and may affect all versions.
coding·excessive permissions·
12 May 2026 · LobeHub
In LobeHub/LobeChat before 2.1.48, unmatched custom tags in the Artifacts renderer fall back to HTML rendering, so an attacker who induces the LLM to emit malicious tags can trigger client-side XSS. The XSS can reach the Electron main process's unfiltered runCommand IPC interface to execute arbitrary system commands with the user's privileges.
other·prompt injection·
12 May 2026 · JunoClaw
Two vulnerabilities were disclosed in JunoClaw, an agentic AI platform built on Juno Network: plugin-shell's run_command passed agent-supplied argument strings to 'sh -c'/'cmd /C', allowing shell metacharacters to be interpreted as command syntax, and the WAVS bridge's computeDataVerify fetched agent-supplied URLs without validating scheme, port or resolved IP, causing SSRF. Both were fixed in release 0.x.y-security-1.
workflow·tool misuse·
12 May 2026 · JunoClaw
Three CVEs in JunoClaw, an agentic AI platform built on Juno Network, covered an unvalidated filesystem path in the upload_wasm MCP tool, a bypassable substring blocklist in plugin-shell allowing unauthorized host command execution, and MCP write tools that accepted a BIP-39 mnemonic as a tool-call parameter, exposing the seed to transports, logs and telemetry. All were fixed in release 0.x.y-security-1.
other·data leak·
12 May 2026 · OpenAI
Researchers reported that a coordinated attack on the RubyGems package manager disclosed in May 2026 was carried out by a swarm of OpenAI agents, which also gained remote code execution on RubyDoc servers.
other·supply chain·
12 May 2026 · Aas-ee
Open-WebSearch, a multi-engine MCP server, CLI and local daemon for agent web search and content retrieval, had URL safety checks (isPublicHttpUrl/assertPublicHttpUrl) that failed to recognise bracketed IPv6 literals and did not resolve DNS, allowing non-blind SSRF with response bodies returned to the caller. The issue is fixed in version 2.1.7.
browsing·misconfiguration·
12 May 2026 · Langflow
CVE-2026-42048: Langflow versions prior to 1.9.0 concatenate user-supplied knowledge base names into file paths without sanitization in the DELETE /api/v1/knowledge_bases endpoint, letting an authenticated attacker delete arbitrary directories on the server. The issue is fixed in version 1.9.0.
workflow·excessive permissions·
11 May 2026 ·
A command injection vulnerability in the automagik-genie 2.5.27 MCP server allows attackers to execute arbitrary commands through the view_task (view) tool via the readTranscriptFromCommit function in dist/mcp/server.js when a user reads from an external FORGE_BASE_URL.
other·tool misuse·
11 May 2026 · SOCFortress
SOCFortress CoPilot versions prior to 0.1.57 shipped a hardcoded JWT signing secret as a fallback in the backend code and in .env.example, so any deployment that did not explicitly set JWT_SECRET (including the default Docker Compose setup) signed tokens with a publicly known value. An unauthenticated attacker could forge admin-scoped JWTs and take full control of the application and every security tool it manages; fixed in 0.1.57.
other·misconfiguration·
11 May 2026 · bx33661 (Wireshark-MCP project)
Wireshark-MCP versions 1.1.5 and earlier expose a wireshark_export_objects MCP tool that passes an attacker-controlled dest_dir parameter to tshark's --export-objects flag without mandatory path restriction. Because the path sandbox is disabled unless WIRESHARK_MCP_ALLOWED_DIRS is set, a default installation permits exporting files to any directory on the filesystem.
other·excessive permissions·
11 May 2026 · Pythagora-io
GPT-Pilot, through commit 0819827 (2025-09-03), contains a command injection flaw (CWE-78) in Executor.run(): free-text user input at the command-confirmation prompt is passed directly to asyncio.create_subprocess_shell(). An attacker can substitute arbitrary shell commands, achieving remote code execution with the privileges of the GPT-Pilot process.
coding·tool misuse·
11 May 2026 · aiwaves-cn
A vulnerability in the aiwaves-cn 'agents' project (cheshire_cat_core component) allows remote attackers to trigger excessive resource consumption via the recall_relevant_memories_to_working_memory function in core/cat/looking_glass/stray_cat.py. A public exploit exists and the maintainers have not responded to the issue report.
other·unknown·
11 May 2026 · ThinkInAIXYZ
DeepChat versions before v1.0.4-beta.1 contained an incomplete fix for CVE-2025-55733, allowing an arbitrary protocol execution bypass (RCE). A Markdown link with target="_blank" returned by an attacker or compromised AI endpoint was passed by the native Electron pop-up handler in tabPresenter.ts straight to shell.openExternal(), bypassing the isValidExternalUrl check.
other·misconfiguration·
8 May 2026 · BerriAI
CVE-2026-42271: LiteLLM versions 1.74.2 through 1.83.6 exposed two MCP server preview endpoints that accepted a full stdio server configuration and spawned the supplied command as a subprocess on the proxy host. The endpoints required only a valid proxy API key with no role check, so any authenticated user, including low-privilege internal users, could achieve arbitrary command execution; fixed in 1.83.7.
other·excessive permissions·
8 May 2026 · PromptHub
PromptHub versions 0.4.9 through 0.5.3 expose an authenticated POST /api/skills/fetch-remote endpoint that fetches a user-supplied URL server-side and reflects the response, with SSRF protections bypassable via alternate IPv6 representations. Any authenticated user — including self-registered users where ALLOW_REGISTRATION=true — could reach loopback, RFC1918 and link-local addresses; fixed in version 0.5.4.
workflow·misconfiguration·
8 May 2026 · labring
Six CVEs were published for FastGPT, an AI agent building platform, covering unauthenticated remote code execution in the agent-sandbox (code-server started with --auth none bound to 0.0.0.0:8080), several SSRF/DNS-rebinding and cloud metadata blocklist bypasses, and uncontrolled resource consumption in the code-sandbox leading to denial of service. Some issues were fixed in versions 4.14.13 and 4.14.17, while others had no public patch at publication.
workflow·misconfiguration·
8 May 2026 · PraisonAI
Versions of PraisonAI before 4.6.34 exposed MCP file-handling tools that joined attacker-supplied filenames onto the rules directory without containment checks, allowing directory traversal to write arbitrary files as the running user. Dropping a Python .pth file into user site-packages escalates the flaw to arbitrary code execution in later Python processes; fixed in 4.6.34.
workflow·tool misuse·
7 May 2026 · Microsoft
Microsoft published a set of CVEs in May 2026 affecting M365 Copilot, Copilot Chat in Microsoft Edge, GitHub Copilot with Visual Studio, and Azure AI Foundry M365 published agents. The flaws include command/output injection issues enabling information disclosure, tampering or security feature bypass over a network, and improper access control allowing privilege elevation or local spoofing.
other·prompt injection·
6 May 2026 · OpenClaw
Three disclosed vulnerabilities in OpenClaw allow loopback clients to spoof owner context via bearer token headers, arbitrary code execution through unvalidated environment variables passed to MCP stdio servers, and bypass of guards on agent-facing gateway config.patch/config.apply endpoints so a prompt-injected model can persist changes to protected operator settings. All were fixed in releases 2026.4.20 and 2026.4.22.
other·excessive permissions·
5 May 2026 · chatchat-space
Four vulnerabilities (CVE-2026-7844 through CVE-2026-7847) were disclosed in chatchat-space Langchain-Chatchat up to version 0.3.1.3, including missing authentication on OpenAI-compatible file endpoints, a weak hash in the vision chat paste-image handler, a time-of-check time-of-use flaw in file upload, and predictable file IDs. Public exploits exist and the project had not responded to the reporter's issue reports.
other·excessive permissions·
5 May 2026 · DataEase
SQLBot, an LLM/RAG-based Text-to-SQL system, concatenated user-supplied questions directly into the LLM prompt and executed the resulting SQL without validation in versions 1.7.0 and earlier. An authenticated attacker could use prompt injection to run arbitrary SQL and, against PostgreSQL data sources, achieve remote code execution via COPY FROM PROGRAM; fixed in version 1.7.1.
other·prompt injection·
5 May 2026 · Oracle
Oracle disclosed an easily exploitable vulnerability in the Oracle MCP Server Helper Tool (versions 1.0.1-1.0.156) that lets an unauthenticated attacker with HTTP network access compromise the tool and cause it to execute malicious SQL.
other·unknown·
5 May 2026 · GeekyBot
The GeekyBot AI content and chatbot/lead generation plugin for WordPress is vulnerable to SQL injection via the 'attributekey' parameter in versions up to and including 1.2.0, allowing unauthenticated attackers to extract sensitive database information.
customer service·unknown·
4 May 2026 · icip-cas
Three vulnerabilities were disclosed in PPTAgent, an agentic framework for reflective PowerPoint generation: arbitrary code execution via Python eval() of LLM-generated code with builtins in scope, and arbitrary file write/directory creation via markdown_table_to_image and save_generated_slides. All were patched in commit 418491a.
workflow·tool misuse·
4 May 2026 · pixelsock
A server-side request forgery flaw was disclosed in the validateUrl function of index.ts in pixelsock's directus-mcp 1.0.0 MCP server, where manipulating the fileUrl argument allows remote attackers to make the server issue arbitrary requests. A public exploit has been released and the fix pull request is still awaiting acceptance.
workflow·tool misuse·
4 May 2026 · n8n
A cluster of CVEs disclosed in May 2026 affected n8n's MCP OAuth client registration endpoint (unauthenticated memory-exhaustion denial of service) and the n8n-MCP server, which had two server-side request forgery flaws (including IPv6-mapped bypass reaching cloud metadata endpoints and forwarding the n8n API key) and two logging flaws that persisted bearer tokens, API keys and credential-bearing tool arguments in server logs. All issues were fixed in updated releases.
workflow·data leak·
4 May 2026 · EvoMap
Three vulnerabilities (CVE-2026-42075, CVE-2026-42076, CVE-2026-42077) were disclosed in EvoMap's Evolver self-evolving engine for AI agents, allowing arbitrary file writes via the skill download --out flag, remote code execution via unsanitised input to an execSync curl command, and prototype pollution in the mailbox store module. All were patched in version 1.69.3.
other·unknown·
29 Apr 2026 · Algovate
A server-side request forgery vulnerability was found in Algovate xhs-mcp 0.8.11, where manipulating the media_paths argument of the xhs_publish_content function in the MCP Interface allows remote exploitation. A public exploit exists and the project has not responded to the issue report.
workflow·tool misuse·
28 Apr 2026 · TencentCloudBase
A server-side request forgery vulnerability (CVE-2026-7221) was found in TencentCloudBase CloudBase-MCP up to version 2.17.0, where the openUrl function in the open-url API endpoint fails to validate the req.body.url argument, allowing remote exploitation. A public exploit exists and the issue is fixed in version 2.17.1.
coding·tool misuse·
27 Apr 2026 · dmitryglhf
A server-side request forgery vulnerability was disclosed in the _validate_url_safe function of the dmitryglhf mcp-url-downloader MCP server, allowing remote attackers to manipulate the url argument and force the server to make unintended requests. The exploit is public and the project has not responded to the issue report.
browsing·tool misuse·
27 Apr 2026 · dh1011
A server-side request forgery vulnerability was found in the generate_favicon_from_url function of the auto-favicon MCP tool, where the image_url argument can be manipulated remotely. A public exploit exists and the project had not responded to the issue report at time of disclosure.
other·tool misuse·
27 Apr 2026 · AlejandroArciniegas
A publicly disclosed server-side request forgery vulnerability in the axios-based HTTP request handler of the web-scraper server in the open-source mcp-data-vis MCP project allows remote attackers to make the server issue arbitrary requests. The maintainer was notified via a GitHub issue but has not responded, and the rolling-release project has no fixed version.
browsing·tool misuse·
27 Apr 2026 · JoeCastrom
A server-side request forgery vulnerability (CVE-2026-7147) affects JoeCastrom mcp-chat-studio up to version 1.5.0, where manipulation of the req.query.base_url argument in server/routes/llm.js of the LLM Models API allows remote exploitation. The exploit is public and the project has not responded to the issue report.
other·unknown·
24 Apr 2026 · LangChain
Two vulnerabilities in LangChain packages allowed SSRF protections to be bypassed: HTMLHeaderTextSplitter.split_text_from_url() followed unvalidated redirects (CVE-2026-41481), and langchain-openai's _url_to_size() helper was subject to a TOCTOU/DNS rebinding window (CVE-2026-41488), potentially allowing requests to internal, localhost or cloud metadata endpoints and leaking internal data to callers.
other·tool misuse·
