2 Jun 2026 · LibreChat
Three vulnerabilities in LibreChat versions up to and including 0.8.3 (CVE-2026-32625, CVE-2026-44653, CVE-2026-44654) let authenticated users exfiltrate server environment secrets such as CREDS_KEY, JWT_SECRET and MONGO_URI via malicious MCP server URLs, read decrypted admin-managed MCP credentials with only VIEW access, and delete an owner's files globally from a shared agent. The issues are patched in versions 0.8.4-rc1 and 0.8.4.
technology·other·data leak·
2 Jun 2026 · Gitlawb
In OpenClaude, an open-source coding-agent CLI, versions prior to 0.5.1 contained a logic flaw in the ordering of conditionals in the temporary local HTTP server used for MCP OAuth callbacks, letting an attacker bypass the anti-CSRF state parameter validation entirely and force the server to shut down without knowing the state value. The issue was patched in version 0.5.1.
technology·coding·unknown·
1 Jun 2026 · horizon921
A server-side request forgery flaw in the MCP API call endpoint (client/src/app/api/mcp/call/route.ts) of horizon921 mcpilot 0.1.0 allows remote attackers to manipulate the serverBaseUrl argument. A public exploit has been released and the project has not responded to the issue report.
technology·workflow·tool misuse·
1 Jun 2026 · Microsoft
Microsoft reported that the JadePuffer ransomware actor, tracked as Storm-3168, compromised two Azure service principals and used them over an 18-hour period to conduct reconnaissance, collect credentials, and destroy over 100 Azure Storage accounts plus a Key Vault, Function App, and App service plan, likely in preparation for a ransomware/extortion operation. No ransom note was sent and no data exfiltration was confirmed.
technology·other·misconfiguration·
1 Jun 2026 · Langroid
Prior to version 0.63.0, Langroid's SQLChatAgent executed LLM-generated SQL that could be steered by direct or indirect prompt injection; with a privileged database role, an attacker could invoke dialect-specific primitives such as COPY ... FROM PROGRAM to achieve remote code execution on the database host. Fixed in v0.63.0 by defaulting to a SELECT-only parsed statement allowlist with a dangerous-pattern blocklist.
technology·other·prompt injection·
29 May 2026 · czlonkowski (n8n-mcp project)
Two vulnerabilities were disclosed in the n8n-MCP server: before 2.51.3 its telemetry sanitizer could retain fragments of URL-shaped node parameters (such as tenant identifiers or secrets in query strings) and send them to the project's anonymous telemetry backend, and before 2.51.2 multi-tenant HTTP deployments silently fell back to the operator's own N8N_API_URL/N8N_API_KEY when per-request headers were missing, letting a tenant execute n8n management calls against the operator's instance. Both issues are fixed in releases 2.51.3 and 2.51.2.
technology·workflow·data leak·
29 May 2026 · labring
Two vulnerabilities were disclosed in the FastGPT AI agent building platform: an SSRF in the dataset preview endpoint that bypasses internal-address protection to reach internal services, and a JavaScript sandbox filter bypass (import/**/(...)) allowing arbitrary command execution inside the sandbox container. Both are fixed in version 4.15.0-beta1.
technology·workflow·misconfiguration·
29 May 2026 · MarcelRoozekrans
The get_diagnostics tool in Roslyn CodeLens MCP Server (versions 0.0.9 through 1.17.0) loads and executes all DiagnosticAnalyzer assemblies referenced by a target solution with no allowlist, signature check or user confirmation, and analyzer loading is enabled by default. An attacker who plants a malicious .csproj referencing an attacker-controlled DLL in a codebase the victim opens gains arbitrary code execution with the MCP server's OS privileges; fixed in 1.17.0.
technology·coding·supply chain·
29 May 2026 · InfiniFlow
A server-side template injection flaw in RAGFlow's prompt generator (rag/prompts/generator.py) in versions 0.24.0 and earlier lets any authenticated user run arbitrary OS commands on the server. Exploitation requires only registering an account and building a Canvas workflow chaining a DuckDuckGo search and LLM component to trigger the SSTI.
technology·workflow·prompt injection·
29 May 2026 · jqwik
A developer added an undisclosed instruction to the jqwik library that directed AI coding agents processing the code to delete application output, reportedly out of frustration with 'vibe coders'. The hidden prompt injection was reported publicly in late May 2026.
technology·coding·prompt injection·
28 May 2026 · Mintplex Labs
Two vulnerabilities in AnythingLLM prior to 1.13.0 let an attacker chatting with an agent abuse the filesystem skills: an LLM-controlled ripgrep pattern (--pre=/bin/sh) enabled arbitrary command execution inside the server container, and the copy tool followed nested symlinks to copy files from outside the allowed filesystem root. Both were fixed in version 1.13.0.
technology·workflow·tool misuse·
27 May 2026 · SafeDep
Gryph, a security layer for AI coding agents, stored sensitive file-write content (ContentPreview, OldString, NewString) in a local SQLite database at its default 'standard' log level, bypassing its own sensitive file filter and documented log level behaviour. The issue affects versions prior to 0.7.0 and is fixed in 0.7.0.
technology·coding·data leak·
27 May 2026 · Dataojitori
Nocturne Memory, a long-term memory server for MCP agents, bypassed Bearer token authentication for all HTTP requests when API_TOKEN was unset or empty; combined with default 0.0.0.0 binding and wildcard CORS, this exposed the full knowledge-graph read/write API to any LAN-reachable client, allowing attackers to alter entries that auto-load into agent sessions and achieve persistent prompt injection. Fixed in version 2.4.1.
technology·other·misconfiguration·
26 May 2026 · LangChain
LangChain versions before 0.3.85 and 1.3.3 deserialized application-controlled payloads using overly broad object allowlists, letting attacker-supplied serialized constructor dictionaries instantiate trusted LangChain classes with untrusted arguments. A related issue in the LangSmith SDKs (before Python 0.8.0 and JS/TS 0.6.0) meant prompt pull methods deserialized externally controlled public prompt manifests without distinguishing them from prompts owned by the caller's organization.
technology·other·excessive permissions·
26 May 2026 · yoda-digital
Prior to version 0.6.0, the GitLab MCP Server's HTTP/SSE transport shipped with no inbound authentication, a wildcard Access-Control-Allow-Origin header, and a default bind to 0.0.0.0, exposing a mutation-capable RPC endpoint backed by the operator's GitLab personal access token. The issue is fixed in 0.6.0.
technology·coding·misconfiguration·
26 May 2026 · prolix-oc
In the Lumiverse AI chat application prior to version 0.9.7, the MCP server creation endpoint validated only the command binary name against an allowlist while passing the args array unchecked to a child process, letting any logged-in user run arbitrary OS-level code via inline-execution flags. The server listened on all interfaces and its host-header rebinding check could be trivially bypassed, making the flaw exploitable from any machine with network access; it is fixed in 0.9.7.
technology·other·excessive permissions·
26 May 2026 · masci
Versions of the banks LLM prompt-templating library before 2.4.2 rendered prompt templates with an unsandboxed jinja2.Environment(), so applications passing user-supplied strings as templates to Prompt() were vulnerable to server-side template injection leading to remote code execution. The issue is fixed in version 2.4.2.
technology·other·misconfiguration·
24 May 2026 · NousResearch
A publicly disclosed vulnerability (CVE-2026-9353) in NousResearch hermes-agent up to version 2026.4.23 allows remote injection via manipulation of the THREAT_PATTERNS argument in the Skills Guard Multi-Word Prompt Handler (agent/skills_guard.py). The exploit has been published and the vendor did not respond to disclosure attempts.
technology·other·prompt injection·
22 May 2026 · Microsoft
Two command injection vulnerabilities were published for Microsoft's Copilot assistants: CVE-2026-41090 lets an unauthorized attacker perform tampering over a network in Microsoft Copilot, and CVE-2026-42827 lets an unauthorized attacker disclose information over a network in M365 Copilot. Both stem from improper neutralization of special elements used in a command.
technology·other·unknown·
22 May 2026 · CrowdSec
CrowdSec disclosed that an attacker used the still-active GitHub credentials of a departed employee, whose laptop was compromised via malicious versions of TanStack's npm packages, to copy about 170 of CrowdSec's private GitHub repositories on May 22.
technology·other·supply chain·
21 May 2026 · LINE
Central Dogma's Git mirror SSH client (SshGitMirror) installs a server key verifier that unconditionally returns true and disables known_hosts fallbacks, so every outbound git+ssh:// mirror connection trusts any host key presented. An on-path attacker can impersonate the remote git server to exfiltrate mirrored configuration secrets or inject arbitrary commits that propagate to downstream services.
technology·other·misconfiguration·
15 May 2026 · 611711Dark
MCP Calculate Server, an MCP-protocol mathematical calculation service built on SymPy, used eval() to evaluate expressions without input sanitization, allowing remote code execution. The issue was fixed in version 0.1.1.
technology·other·tool misuse·
15 May 2026 · Microsoft
Three vulnerabilities disclosed in Microsoft APM, an open-source dependency manager for AI agents, allow malicious marketplace plugins or remote dependencies to copy arbitrary host files via path traversal, dereference committed symlinks into project deploy directories, and write outside the extraction root on Windows via unchecked tar extraction. All are fixed in versions 0.8.12 and 0.13.0.
technology·coding·supply chain·
15 May 2026 · Open WebUI
Open WebUI versions prior to 0.9.5 validated only the initial URL in validate_url(), while downstream HTTP clients followed 3xx redirects without re-checking private or metadata IP block lists. Any authenticated user could submit a public URL redirecting to internal addresses (e.g. 127.0.0.1, 169.254.169.254, RFC1918) and read internal response bodies through retrieval, image and chat completion endpoints.
technology·browsing·tool misuse·
14 May 2026 · Model Context Protocol
Five CVEs published on 14 May 2026 describe flaws in the Model Context Protocol ecosystem: stored XSS, open redirect, SSRF blocklist bypass, cross-deployment GitHub OIDC token reuse and fail-open OCI ownership validation in the MCP Registry, plus a missing Host-header check enabling DNS rebinding against local MCP servers in the rmcp Rust SDK. All issues were fixed in later releases (registry 1.7.5/1.7.6/1.7.7/1.7.9 and rmcp 1.4.0).
technology·other·supply chain·
14 May 2026 · Hatchet
A missing authorization directive on Hatchet's GET /api/v1/stable/dags/tasks endpoint skipped the tenant-membership check, letting any authenticated user on the instance retrieve task metadata for DAGs belonging to other tenants. The issue is fixed in version 0.83.39.
technology·workflow·misconfiguration·
13 May 2026 · Vercel
Vercel CLI versions 50.16.0 through 52.0.0 embedded plaintext authentication tokens passed via --token/-t into JSON follow-up command suggestions emitted in non-interactive or auto-detected AI agent mode, risking token exposure in CI/CD logs and agent transcripts. The issue is fixed in version 52.0.1.
technology·coding·data leak·
13 May 2026 · GitHub
A vulnerability in GitHub Copilot CLI before version 1.0.43 allowed a malicious bare git repository nested in a project directory to achieve arbitrary code execution when the agent ran git operations, by abusing executable git config keys such as core.fsmonitor. The issue is fixed in version 1.0.43.
technology·coding·tool misuse·
12 May 2026 · MIC-DKFZ
Prior to version 2.4.1, nnU-Net's GitHub Actions issue-triage workflow embedded untrusted issue titles and bodies directly into the prompt of a command-capable Claude Code agent, allowing any GitHub user who opens an issue to steer the agent beyond its intended triage purpose and influence authenticated issue actions such as commenting and relabelling. The issue is fixed in nnU-Net 2.4.1.
technology·workflow·prompt injection·
12 May 2026 ·
Code Runner MCP Server exposes its /mcp JSON-RPC endpoint without authentication on port 3088 when started with --transport http, letting a remote unauthenticated attacker call the run-code tool to execute arbitrary code via child_process.exec() with the server user's privileges. The issue is reported as unfixed and may affect all versions.
technology·coding·excessive permissions·
12 May 2026 · Jo-Jo98 (ciguard project)
The discover_pipeline_files() function in ciguard 0.8.0–0.8.1 follows symlinks when walking a directory tree, so an attacker who plants a symlink in a directory scanned by a user or AI agent can cause the tool to return paths to pipeline-shaped files outside the requested root. The issue is fixed in version 0.8.2.
technology·coding·data leak·
12 May 2026 · Langflow
CVE-2026-42048: Langflow versions prior to 1.9.0 concatenate user-supplied knowledge base names into file paths without sanitization in the DELETE /api/v1/knowledge_bases endpoint, letting an authenticated attacker delete arbitrary directories on the server. The issue is fixed in version 1.9.0.
technology·workflow·excessive permissions·
12 May 2026 · Open Source Kubectl MCP Server (rohitg00)
A vulnerability in the open-source Kubectl MCP Server v1.1.1 allows attackers to execute arbitrary code on a victim's system when the user interacts with a crafted HTML page. The flaw is tracked as CVE-2025-65719 and described as a critical RCE.
technology·other·unknown·
12 May 2026 · LobeHub
In LobeHub/LobeChat before 2.1.48, unmatched custom tags in the Artifacts renderer fall back to HTML rendering, so an attacker who induces the LLM to emit malicious tags can trigger client-side XSS. The XSS can reach the Electron main process's unfiltered runCommand IPC interface to execute arbitrary system commands with the user's privileges.
technology·other·prompt injection·
12 May 2026 · JunoClaw
Two vulnerabilities were disclosed in JunoClaw, an agentic AI platform built on Juno Network: plugin-shell's run_command passed agent-supplied argument strings to 'sh -c'/'cmd /C', allowing shell metacharacters to be interpreted as command syntax, and the WAVS bridge's computeDataVerify fetched agent-supplied URLs without validating scheme, port or resolved IP, causing SSRF. Both were fixed in release 0.x.y-security-1.
technology·workflow·tool misuse·
12 May 2026 · JunoClaw
Three CVEs in JunoClaw, an agentic AI platform built on Juno Network, covered an unvalidated filesystem path in the upload_wasm MCP tool, a bypassable substring blocklist in plugin-shell allowing unauthorized host command execution, and MCP write tools that accepted a BIP-39 mnemonic as a tool-call parameter, exposing the seed to transports, logs and telemetry. All were fixed in release 0.x.y-security-1.
technology·other·data leak·
12 May 2026 · Aas-ee
Open-WebSearch, a multi-engine MCP server, CLI and local daemon for agent web search and content retrieval, had URL safety checks (isPublicHttpUrl/assertPublicHttpUrl) that failed to recognise bracketed IPv6 literals and did not resolve DNS, allowing non-blind SSRF with response bodies returned to the caller. The issue is fixed in version 2.1.7.
technology·browsing·misconfiguration·
12 May 2026 · OpenAI
Researchers reported that a coordinated attack on the RubyGems package manager disclosed in May 2026 was carried out by a swarm of OpenAI agents, which also gained remote code execution on RubyDoc servers.
technology·other·supply chain·
11 May 2026 · SOCFortress
SOCFortress CoPilot versions prior to 0.1.57 shipped a hardcoded JWT signing secret as a fallback in the backend code and in .env.example, so any deployment that did not explicitly set JWT_SECRET (including the default Docker Compose setup) signed tokens with a publicly known value. An unauthenticated attacker could forge admin-scoped JWTs and take full control of the application and every security tool it manages; fixed in 0.1.57.
technology·other·misconfiguration·
11 May 2026 ·
A command injection vulnerability in the automagik-genie 2.5.27 MCP server allows attackers to execute arbitrary commands through the view_task (view) tool via the readTranscriptFromCommit function in dist/mcp/server.js when a user reads from an external FORGE_BASE_URL.
technology·other·tool misuse·
11 May 2026 · aiwaves-cn
A vulnerability in the aiwaves-cn 'agents' project (cheshire_cat_core component) allows remote attackers to trigger excessive resource consumption via the recall_relevant_memories_to_working_memory function in core/cat/looking_glass/stray_cat.py. A public exploit exists and the maintainers have not responded to the issue report.
technology·other·unknown·
11 May 2026 · bx33661 (Wireshark-MCP project)
Wireshark-MCP versions 1.1.5 and earlier expose a wireshark_export_objects MCP tool that passes an attacker-controlled dest_dir parameter to tshark's --export-objects flag without mandatory path restriction. Because the path sandbox is disabled unless WIRESHARK_MCP_ALLOWED_DIRS is set, a default installation permits exporting files to any directory on the filesystem.
technology·other·excessive permissions·
11 May 2026 · Pythagora-io
GPT-Pilot, through commit 0819827 (2025-09-03), contains a command injection flaw (CWE-78) in Executor.run(): free-text user input at the command-confirmation prompt is passed directly to asyncio.create_subprocess_shell(). An attacker can substitute arbitrary shell commands, achieving remote code execution with the privileges of the GPT-Pilot process.
technology·coding·tool misuse·
11 May 2026 · ThinkInAIXYZ
DeepChat versions before v1.0.4-beta.1 contained an incomplete fix for CVE-2025-55733, allowing an arbitrary protocol execution bypass (RCE). A Markdown link with target="_blank" returned by an attacker or compromised AI endpoint was passed by the native Electron pop-up handler in tabPresenter.ts straight to shell.openExternal(), bypassing the isValidExternalUrl check.
technology·other·misconfiguration·
8 May 2026 · PraisonAI
Versions of PraisonAI before 4.6.34 exposed MCP file-handling tools that joined attacker-supplied filenames onto the rules directory without containment checks, allowing directory traversal to write arbitrary files as the running user. Dropping a Python .pth file into user site-packages escalates the flaw to arbitrary code execution in later Python processes; fixed in 4.6.34.
technology·workflow·tool misuse·
8 May 2026 · labring
Six CVEs were published for FastGPT, an AI agent building platform, covering unauthenticated remote code execution in the agent-sandbox (code-server started with --auth none bound to 0.0.0.0:8080), several SSRF/DNS-rebinding and cloud metadata blocklist bypasses, and uncontrolled resource consumption in the code-sandbox leading to denial of service. Some issues were fixed in versions 4.14.13 and 4.14.17, while others had no public patch at publication.
technology·workflow·misconfiguration·
8 May 2026 · BerriAI
CVE-2026-42271: LiteLLM versions 1.74.2 through 1.83.6 exposed two MCP server preview endpoints that accepted a full stdio server configuration and spawned the supplied command as a subprocess on the proxy host. The endpoints required only a valid proxy API key with no role check, so any authenticated user, including low-privilege internal users, could achieve arbitrary command execution; fixed in 1.83.7.
technology·other·excessive permissions·
8 May 2026 · PromptHub
PromptHub versions 0.4.9 through 0.5.3 expose an authenticated POST /api/skills/fetch-remote endpoint that fetches a user-supplied URL server-side and reflects the response, with SSRF protections bypassable via alternate IPv6 representations. Any authenticated user — including self-registered users where ALLOW_REGISTRATION=true — could reach loopback, RFC1918 and link-local addresses; fixed in version 0.5.4.
technology·workflow·misconfiguration·
7 May 2026 · Microsoft
Microsoft published a set of CVEs in May 2026 affecting M365 Copilot, Copilot Chat in Microsoft Edge, GitHub Copilot with Visual Studio, and Azure AI Foundry M365 published agents. The flaws include command/output injection issues enabling information disclosure, tampering or security feature bypass over a network, and improper access control allowing privilege elevation or local spoofing.
technology·other·prompt injection·
6 May 2026 · OpenClaw
Three disclosed vulnerabilities in OpenClaw allow loopback clients to spoof owner context via bearer token headers, arbitrary code execution through unvalidated environment variables passed to MCP stdio servers, and bypass of guards on agent-facing gateway config.patch/config.apply endpoints so a prompt-injected model can persist changes to protected operator settings. All were fixed in releases 2026.4.20 and 2026.4.22.
technology·other·excessive permissions·
