Structured records of AI agent security incidents: what happened, which vendor and agent type, the root cause, and every source we used. Filter, browse, or download as CSV.
24 Apr 2026 · Mintplex Labs
AnythingLLM versions prior to 1.12.1 rendered chart captions from LLM output through a markdown renderer without DOMPurify sanitisation, allowing stored DOM-level XSS. An attacker who could influence the model's output, typically via indirect prompt injection in a shared workspace document, could execute script in other users' browsers when they opened the conversation.
other·prompt injection·
23 Apr 2026 · Microsoft
A URL redirection to untrusted site ('open redirect') vulnerability in Microsoft 365 Copilot allows an unauthorized attacker to elevate privileges over a network. The issue is tracked as CVE-2026-33102 and documented in Microsoft's MSRC update guide.
other·unknown·
23 Apr 2026 · Paperclip
Two vulnerabilities in @paperclipai/server, a Node.js/React platform that orchestrates a team of AI agents to run a business, allow remote code execution on the server host: one lets an attacker with an Agent API key inject shell commands via a self-updatable adapterConfig provisionCommand field, and another lets an unauthenticated attacker chain six API calls for full RCE on default 'authenticated' mode deployments. Both are fixed in version 2026.416.0.
workflow·excessive permissions·
23 Apr 2026 · OpenClaw
OpenClaw versions before 2026.3.28 contain a vulnerability that lets LLM agents silently disable execution approval through the config.patch parameter. Remote attackers can abuse this to bypass security controls and run unauthorized operations without user consent.
other·excessive permissions·
21 Apr 2026 · DayuanJiang
Next AI Draw.io versions prior to 0.4.15 accumulated entire HTTP request bodies into memory in three POST handlers (/api/state, /api/restore, /api/history-svg) of its embedded sidecar, so a large payload (e.g. 500 MiB) could exhaust the Node.js heap and crash the MCP server. The issue is fixed in version 0.4.15.
other·misconfiguration·
21 Apr 2026 · haris-musa
CVE-2026-40576: excel-mcp-server versions up to and including 0.1.7 fail to confine file operations to the EXCEL_FILES_PATH directory, letting an unauthenticated network attacker read, write and overwrite arbitrary files via crafted filepath arguments to any of its 25 MCP tool handlers when run in SSE or Streamable-HTTP mode. Fixed in version 0.1.8.
workflow·misconfiguration·
21 Apr 2026 · FlowiseAI
Three vulnerabilities in FlowiseAI's Flowise LLM flow builder prior to version 3.1.0 allow remote code execution on the server: unauthenticated attackers can use prompt injection against chatflows using the CSV Agent or Airtable Agent nodes to have the LLM emit unsandboxed Python that runs attacker commands, while an authenticated user can abuse unsafe serialization of stdio commands in the MCP adapter to execute arbitrary commands. All three are fixed in Flowise 3.1.0.
workflow·prompt injection·
20 Apr 2026 · ericc-ch
Public disclosures describe two vulnerabilities in the open-source copilot-api project (versions up to 0.7.0): a permissive cross-domain policy in the cors function of src/server.ts at the token endpoint, and reliance on reverse DNS resolution via a manipulated Host header on the /token endpoint. Both are remotely exploitable and exploit details have been made public.
coding·misconfiguration·
17 Apr 2026 · labring
FastGPT, an AI agent building platform, contained two NoSQL injection vulnerabilities (CVE-2026-40351 and CVE-2026-40352) in versions before 4.14.9.5. The login endpoint accepted MongoDB query operators as a password, letting unauthenticated attackers log in as any user including the root administrator, while the password change endpoint allowed bypassing old-password verification for full account takeover and persistence. Both were fixed in version 4.14.9.5.
other·unknown·
17 Apr 2026 · Anthropic
Two vulnerabilities were disclosed in Anthropic's agentic coding tool Claude Code: CVE-2026-35603, where Windows versions before 2.1.75 loaded a system-wide settings file from a world-writable ProgramData path letting a low-privileged local user plant malicious configuration, and CVE-2026-39861, where versions before 2.1.64 allowed a sandbox escape via symlinks that the unsandboxed process followed to write outside the workspace, triggerable through prompt injection. Both issues were fixed in the noted releases.
coding·prompt injection·
17 Apr 2026 · neo4j-contrib
In mcp-neo4j-cypher versions before 0.6.0, an MCP server for running Cypher queries against Neo4j, the read_only mode enforcement could be bypassed using APOC CALL procedures, potentially enabling unauthorized write operations or server-side request forgery. The issue is fixed in version 0.6.0.
other·excessive permissions·
17 Apr 2026 · Red Hat
A log injection flaw in the AAP MCP server lets an unauthenticated remote attacker send crafted input to the `toolsetroute` parameter, which is written to logs unsanitised. Injected newlines and ANSI escape sequences can hide real log entries and forge new ones, enabling social engineering of operators into running dangerous commands or visiting malicious URLs.
workflow·unknown·
17 Apr 2026 · Apache
Apache Doris MCP Server versions before 0.6.1 contain an improper neutralization flaw in query context handling that could allow execution of unintended SQL statements and bypass of query validation and access restrictions via the MCP query execution interface. The issue is fixed in version 0.6.1.
other·tool misuse·
16 Apr 2026 · QuantGeekDev
In mcp-framework 0.2.21 and below, the HTTP transport's readRequestBody() concatenates request body chunks without enforcing the maxMessageSize setting, letting a remote unauthenticated attacker crash any mcp-framework HTTP server with a single large POST to /mcp via memory exhaustion. The issue was fixed in version 0.2.22.
other·supply chain·
15 Apr 2026 · Agent Zero
Agent Zero 0.9.8 allows users to define External MCP Servers via JSON configuration with arbitrary command and args values that are executed without sufficient validation. A malicious MCP configuration can therefore run arbitrary operating system commands with the privileges of the Agent Zero process.
other·tool misuse·
15 Apr 2026 · Jaaz
Jaaz version 1.0.30 contains a remote code execution flaw in its MCP STDIO command execution handling, allowing a remote attacker to send crafted network requests to the network-accessible application and run arbitrary commands in the context of the Jaaz service. Successful exploitation could lead to full compromise of the affected system.
other·tool misuse·
15 Apr 2026 · Windsurf
A prompt injection vulnerability in Windsurf 1.9544.26 lets remote attackers embed malicious instructions in HTML content that the AI coding tool processes, causing it to modify the local MCP configuration and register a malicious MCP STDIO server. This results in arbitrary command execution on the victim system without further user interaction.
coding·prompt injection·
15 Apr 2026 · Splunk
In Splunk MCP Server app versions below 1.0.3, session and authorization tokens were recorded in clear text where a user with access to the Splunk `_internal` index or the `mcp_tool_admin` capability could view them. Exploitation requires local access to log files or administrative access to internal indexes, and the issue is addressed in version 1.0.3.
workflow·data leak·
15 Apr 2026 · Flux159
Versions 3.4.0 and earlier of mcp-server-kubernetes, a Model Context Protocol server for Kubernetes cluster management, built a kubectl command by string concatenation and naive space-splitting in the port_forward tool, allowing attackers to inject arbitrary kubectl flags. This could expose internal Kubernetes services to the network (via --address=0.0.0.0) or target other namespaces, and could be triggered indirectly through prompt injection against connected AI agents; fixed in version 3.5.0.
workflow·tool misuse·
15 Apr 2026 · Upsonic
Upsonic 0.71.6 contains a remote code execution flaw in its MCP server/task creation feature, where an allowlist still permits commands (npm, npx) whose argument flags can run arbitrary OS commands. Maliciously crafted MCP tasks can execute code with the privileges of the Upsonic process.
workflow·tool misuse·
14 Apr 2026 · Microsoft
A command injection weakness (improper neutralization of special elements used in a command) in GitHub Copilot and Visual Studio Code allows an authorized attacker to disclose information over a network. The issue is tracked as CVE-2026-23653 with a Microsoft security update guide advisory.
coding·tool misuse·
13 Apr 2026 · Apache Software Foundation
Apache SkyWalking MCP 0.1.0 contains a server-side request forgery vulnerability triggered through the SW-URL header. The issue is fixed in version 0.2.0, which users are advised to upgrade to.
other·tool misuse·
11 Apr 2026 · aws-mcp-server
Two vulnerabilities (CVE-2026-5058 and CVE-2026-5059) in aws-mcp-server stem from improper validation of user-supplied strings against the allowed commands list before executing system calls, letting remote unauthenticated attackers run arbitrary code in the context of the MCP server.
workflow·tool misuse·
10 Apr 2026 · labring
Two vulnerabilities were disclosed in the FastGPT AI agent building platform: an unauthenticated SSRF via the /api/core/app/mcpTools/runTool endpoint (CVE-2026-40100, fixed in 4.14.10.3) and a broken access control (IDOR/BOLA) issue allowing any authenticated team to access and execute other teams' applications (CVE-2026-40252, fixed in 4.14.10.4). Both enable access to resources beyond the attacker's authorisation, including cross-tenant data exposure and execution of private AI workflows.
workflow·excessive permissions·
10 Apr 2026 · OpenClaw
OpenClaw versions 2026.2.13 through 2026.3.24 are vulnerable to ANSI escape sequence injection, where untrusted tool metadata such as malicious tool titles can carry control sequences into approval prompts and permission logs to spoof terminal output. The issue was addressed in a fix commit and a GitHub security advisory.
coding·prompt injection·
9 Apr 2026 · AGiXT
In AGiXT versions prior to 1.9.2, the safe_join() function in the essential_abilities extension did not verify that resolved paths stayed inside the agent workspace, letting an authenticated attacker use directory traversal to read, write or delete arbitrary files on the host. The issue is fixed in release 1.9.2.
workflow·excessive permissions·
9 Apr 2026 · awwaiid
A command injection vulnerability was disclosed in the MCP server mcp-server-taskwarrior up to version 1.0.1, where manipulation of the Identifier argument in the server.setRequestHandler function of index.ts allows local command injection. The exploit was publicly disclosed and the maintainer released a patched version.
workflow·tool misuse·
9 Apr 2026 · LangChain
Two vulnerabilities were disclosed in the LangChain ecosystem: incomplete f-string prompt-template validation in LangChain (CVE-2026-40087) allowed attribute-access and nested replacement-field expressions to be evaluated during formatting, fixed in langchain-core 0.3.84 and 1.2.28; and LangChain-ChatChat 0.3.1 (CVE-2026-30617) allowed a remote attacker to configure an MCP STDIO server via an exposed management interface and execute arbitrary commands when agents run.
other·tool misuse·
9 Apr 2026 · Apollo GraphQL
Apollo MCP Server before version 1.7.0 failed to validate the Host header on StreamableHTTP transport requests, allowing a malicious website to use DNS rebinding to reach a locally running MCP server and invoke its tools or access its resources on behalf of the user. The issue does not affect stdio transport and is fixed in version 1.7.0.
workflow·misconfiguration·
8 Apr 2026 · agentfront
Versions of the FrontMCP framework prior to 2.3.0 dereferenced $ref pointers in OpenAPI specifications via @apidevtools/json-schema-ref-parser without URL restrictions or custom resolvers, so a malicious spec could make the server fetch internal addresses, cloud metadata endpoints or local files during initialize(). The issue enables server-side request forgery and local file read and is fixed in version 2.3.0.
other·misconfiguration·
8 Apr 2026 · Zammad
A server-side template injection vulnerability in Zammad's AI Agent feature prior to version 7.0.1 could lead to remote code execution. Exploitation requires an attacker to control or influence type_enrichment_data, typically limited to high-privilege administrative configuration, and the issue is fixed in 7.0.1.
customer service·unknown·
7 Apr 2026 · Model Context Protocol
Versions of the official Model Context Protocol Java SDK prior to 1.0.0 contain a DNS rebinding vulnerability that lets an attacker reach a local or network-private MCP server through a victim's browser and invoke any tool call as if they were a locally connected AI agent. The issue is fixed in version 1.0.0.
other·misconfiguration·
6 Apr 2026 · imprvhub
A server-side request forgery vulnerability was disclosed in the imprvhub mcp-browser-agent MCP server (versions up to 0.8.0), where manipulation of the request.params.name/request.params.arguments values handled by CallToolRequestSchema in src/handlers.ts allows remote attackers to trigger SSRF. The exploit has been publicly disclosed and the vendor did not respond to the disclosure.
browsing·tool misuse·
6 Apr 2026 · Mobile Next
The mobile_open_url tool in the mobile-mcp MCP server passed user-supplied URLs directly to Android's intent system without scheme validation, allowing execution of arbitrary intents such as USSD codes, phone calls, SMS messages and content provider access. The issue affects versions prior to 0.0.50 and is fixed in 0.0.50.
workflow·tool misuse·
5 Apr 2026 · Fosowl
A code injection vulnerability was disclosed in Fosowl agenticSeek 0.1.0 affecting the PyInterpreter.execute function in sources/tools/PyInterpreter.py via the query endpoint, allowing remote exploitation. A public exploit has been disclosed and the vendor did not respond to contact about the disclosure.
coding·tool misuse·
3 Apr 2026 · PraisonAI
Eight CVEs disclosed in April 2026 affect the PraisonAI and PraisonAIAgents multi-agent frameworks, including an MCP authentication bypass accepting any bearer token, shell command injection via agent workflows and lifecycle hooks, arbitrary file read, SSRF in web crawl tools, unsanitized HTML output enabling XSS, and full environment-variable inheritance by MCP subprocesses that can leak API keys. Several are exploitable through prompt injection and all are fixed in versions 4.5.97/4.5.121/4.5.128 and 1.5.128.
workflow·tool misuse·
3 Apr 2026 · PrefectHQ
FastMCP versions prior to 3.2.0 allow command injection on Windows when a server name containing shell metacharacters is passed to `fastmcp install claude-code` or `fastmcp install gemini-cli`, because the target CLIs resolve to .cmd wrappers executed through cmd.exe. The issue was patched in FastMCP 3.2.0.
coding·tool misuse·
2 Apr 2026 · priyankark
A server-side request forgery flaw was found in the A11yServer function of src/index.js in priyankark's a11y-mcp MCP server up to version 1.0.5, exploitable from a local position. The vendor patched it in version 1.0.6 while noting the server is local stdio-only and not network-accessible.
other·tool misuse·
2 Apr 2026 · PrefectHQ
Two vulnerabilities were disclosed in PrefectHQ's FastMCP framework prior to version 3.2.0: CVE-2026-32871, where unencoded path parameters in the OpenAPIProvider's RequestDirector allowed path traversal and authenticated SSRF against backend APIs using configured authorization headers, and CVE-2026-27124, where the OAuthProxy failed to validate user consent when handling GitHub authorization codes, creating a confused deputy issue. Both were patched in FastMCP 3.2.0.
other·tool misuse·
31 Mar 2026 · 1millionbot
A prompt injection vulnerability (CVE-2026-4399) in the 1millionbot Millie chatbot lets attackers bypass chat restrictions using Boolean prompt injection techniques, causing the bot to return prohibited or out-of-context information. Successful exploitation could allow abuse of 1millionbot's resources and/or OpenAI API key for unintended tasks.
customer service·prompt injection·
31 Mar 2026 · LangChain
Prior to langchain-core 1.2.22, functions in langchain_core.prompts.loading read files from paths embedded in deserialized prompt configs without validating against directory traversal or absolute paths, letting an attacker supplying user-influenced configs to load_prompt() or load_prompt_from_config() read arbitrary files (limited to .txt, .json and .yaml extensions). The issue was patched in version 1.2.22.
other·data leak·
31 Mar 2026 · labring
FastGPT versions before 4.14.9.5 exposed an unauthenticated HTTP tools testing endpoint that acted as a full server-side HTTP proxy, and MCP tools endpoints that made server-side requests to user-supplied URLs without internal-address validation, enabling SSRF against internal networks, cloud metadata services, MongoDB and Redis. Both issues were patched in version 4.14.9.5.
workflow·misconfiguration·
31 Mar 2026 · Nhost
Prior to version 1.41.0, the Nhost CLI MCP server applied no inbound authentication and did not enforce strict CORS when explicitly configured to listen on a network port, letting a malicious website invoke privileged MCP tools with the developer's local credentials. Exploitation required two non-default configuration steps; the issue was patched in version 1.41.0.
coding·misconfiguration·
31 Mar 2026 · Model Context Protocol
Two vulnerabilities disclosed in the official Model Context Protocol SDKs: the Java SDK shipped a hardcoded wildcard CORS policy (CVE-2026-34237) and the Go SDK did not enable DNS rebinding protection by default for HTTP-based servers (CVE-2026-34742), letting a malicious website reach an unauthenticated local MCP server and invoke its tools or resources. Both issues were patched in updated SDK releases.
other·misconfiguration·
31 Mar 2026 · Anthropic
The local filesystem memory tool in the Anthropic Claude SDK for TypeScript (versions 0.79.0 to before 0.81.0) validated model-supplied paths with a string prefix check lacking a trailing path separator, so a model steered by prompt injection could read and write files in sibling directories outside the sandboxed memory root. The issue was patched in version 0.81.0.
other·prompt injection·
31 Mar 2026 · Giskard
Giskard, an open-source Python library for testing and evaluating agentic systems, passed the string argument of ChatWorkflow.chat(message) directly to a non-sandboxed Jinja2 environment, so any user input reaching that method could achieve remote code execution via Jinja2 class traversal. The issue (CVE-2026-34172) was patched in versions 0.3.4 and 1.0.2b1.
other·misconfiguration·
31 Mar 2026 · agentic-context-engine project
A directory traversal flaw in the agentic-context-engine project (versions up to 0.7.1) lets the checkpoint_dir parameter in OfflineACE.run escape the intended directory because save_to_file in ace/skillbook.py does not normalise or validate paths. Attackers can overwrite arbitrary files accessible to the application process, potentially causing corruption, privilege escalation or code execution.
other·tool misuse·
30 Mar 2026 · Nginx UI
Nginx UI versions 2.3.5 and prior expose an /mcp_message Model Context Protocol endpoint that is protected only by an IP whitelist which defaults to empty and is treated as allow-all, letting any network attacker invoke all MCP tools without authentication. This permits restarting nginx and creating, modifying or deleting nginx configuration files with automatic reloads, amounting to complete service takeover; no patch was available at publication.
workflow·misconfiguration·
28 Mar 2026 · PromtEngineer
A prompt injection vulnerability (CVE-2026-5002) was disclosed in PromtEngineer's localGPT, affecting the _route_using_overviews function in backend/server.py of the LLM Prompt Handler component. The flaw can be exploited remotely and the exploit has been made public; the vendor did not respond to the disclosure.
other·prompt injection·
27 Mar 2026 · Mobile Next
The @mobilenext/mobile-mcp server passed the `saveTo` and `output` parameters of its `mobile_save_screenshot` and `mobile_start_screen_recording` tools directly to filesystem operations without validation, allowing an attacker to write files outside the intended workspace. The issue was fixed in version 0.0.49.
workflow·tool misuse·
