27 Mar 2026 · pab1it0 (adx-mcp-server project)
The Azure Data Explorer MCP Server (versions up to and including 0.1.1) interpolated the `table_name` parameter directly into KQL queries in three tool handlers, letting an attacker or a prompt-injected AI agent run arbitrary KQL against the ADX/Kusto cluster; a related advisory, CVE-2026-32211, reports missing authentication in Microsoft's Azure MCP Server allowing unauthorized information disclosure. A commit patches the KQL injection issue.
other·tool misuse·
27 Mar 2026 · HKUDS
An indirect prompt injection vulnerability in the email channel module of the nanobot personal AI assistant (prior to version 0.1.6) let a remote, unauthenticated attacker send an email to the bot's monitored address and have its contents processed as trusted input, executing arbitrary LLM instructions and system tools with no owner interaction. The issue was patched in version 0.1.6.
other·prompt injection·
27 Mar 2026 · LibreChat
Two vulnerabilities in LibreChat's agent actions and Model Context Protocol support allow attackers to bypass SSRF protections to reach internal resources (CVE-2026-31945) and to exfiltrate victims' OAuth tokens via credential placeholder substitution in attacker-created MCP server headers (CVE-2026-31951). Patches are available in versions 0.8.3-rc1 and 0.8.3-rc2 respectively.
other·tool misuse·
27 Mar 2026 ·
Four AI coding assistants (AI Code, SakaDev, HAI Build Code Generator and Sixth) let the model auto-execute terminal commands it judges 'safe'. Researchers showed a generic prompt-injection template can wrap any malicious command so the model misclassifies it as safe, bypassing user approval and allowing arbitrary command execution.
coding·prompt injection·
27 Mar 2026 · OpenHands
CVE-2026-33718 describes a command injection flaw in OpenHands' get_git_diff() method, where the unsanitized `path` parameter from the /api/conversations/{conversation_id}/git/diff endpoint is passed to a shell command. Authenticated attackers could execute arbitrary commands in the agent sandbox, bypassing normal agent channels; version 1.5.0 fixes the issue.
coding·tool misuse·
23 Mar 2026 · Blinko
Blinko, an AI-powered card note-taking project, allowed arbitrary commands and arguments to be specified when creating an MCP (Model Context Protocol) server, which were then executed when the connection was tested. The issue affects versions prior to 1.8.4 and has been patched in that release.
workflow·tool misuse·
22 Mar 2026 · apconw
A SQL injection flaw (CVE-2026-4530) was disclosed in apconw Aix-DB up to version 1.2.3, affecting the agent/text2sql/rag/terminology_retriever.py component via manipulation of the Description argument. The attack requires local access, a public exploit has been released, and the vendor did not respond to the disclosure.
other·unknown·
20 Mar 2026 · doobidoo
Versions of the open-source mcp-memory-service memory backend prior to 10.25.1 configured FastAPI CORSMiddleware with allow_origins='*' and allow_credentials=True when the HTTP server was enabled, letting any website read API responses cross-origin. Combined with anonymous access, any malicious site could silently read, modify, and delete all stored memories; fixed in 10.25.1.
other·misconfiguration·
20 Mar 2026 · PinchTab
Six CVEs were published against PinchTab, a standalone HTTP server that gives AI agents direct control over a Chrome browser, covering blind SSRF in the /download endpoint and the scheduler webhook path, API tokens accepted in URL query strings, unwired rate limiting, a JavaScript evaluation policy bypass via /wait fn mode, and a Windows-only PowerShell command injection in Chrome cleanup. Most issues were fixed in versions 0.8.3 through 0.8.5, while the /wait evaluation bypass had no patched release at time of publication.
browsing·tool misuse·
20 Mar 2026 · labring
FastGPT versions 4.14.8.3 and below contain a vulnerable fastgpt-preview-image.yml GitHub Actions workflow that uses pull_request_target while checking out and building code from a pull request author's fork, allowing any external contributor to execute arbitrary code, exfiltrate repository secrets, and push malicious images to the production container registry. No patch was available at publication.
workflow·supply chain·
20 Mar 2026 · Anthropic
Three vulnerabilities disclosed in March 2026 affect agentic AI tooling: Claude Code before 2.1.53 could be silently placed into bypassPermissions mode by a malicious repository's committed .claude/settings.json, skipping the workspace trust dialog; the Go MCP SDK before 1.4.1 accepted cross-site POST requests to its Streamable HTTP transport without Origin or Content-Type validation, potentially allowing any website to trigger tool execution on a local server; and the MCP Ruby SDK before 0.9.2 allowed session hijacking of SSE streams by anyone holding a valid session ID. All three were patched.
coding·excessive permissions·
20 Mar 2026 · ondata
Versions of the CKAN MCP Server prior to 0.4.85 accepted an arbitrary base_url in tools such as ckan_package_search, sparql_query and ckan_datastore_search_sql, with no URL validation or blocking of private/link-local addresses. An attacker able to influence the parameter via prompt injection could scan internal networks, steal cloud metadata credentials from 169.254.169.254, or attempt SQL/SPARQL injection; fixed in 0.4.85.
workflow·prompt injection·
20 Mar 2026 · Langflow
A batch of CVEs disclosed in March 2026 affects Langflow, an AI agent and workflow builder, headlined by CVE-2026-33017, an unauthenticated remote code execution flaw in the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint that passes attacker-supplied node code to exec() without sandboxing. Related issues include arbitrary file write leading to RCE, code execution via the Agentic Assistant's validation phase, cross-tenant flow and image access, path traversal exposing the secret key, and CI shell injection; most are patched in version 1.9.0.
workflow·excessive permissions·
19 Mar 2026 · DataEase
SQLBot versions 1.5.0 and below contain a stored prompt injection vulnerability chaining a missing permission check on the Excel upload API, unsanitized terminology storage, and no semantic fencing of terminology injected into the LLM system prompt. An authenticated attacker could hijack the LLM's reasoning to emit malicious PostgreSQL commands such as COPY ... TO PROGRAM, achieving remote code execution with postgres privileges; fixed in v1.6.0.
other·prompt injection·
19 Mar 2026 · Discourse
Discourse versions before 2026.3.0-latest.1, 2026.2.1 and 2026.1.2 rendered raw LLM output with htmlSafe in the Review Queue, so an attacker could use prompt injection to make the AI return a malicious payload that executed when staff viewed a flagged post. Patched releases are available, with disabling AI triage automation scripts as a workaround.
workflow·prompt injection·
19 Mar 2026 · Microsoft
Two CVEs (CVE-2026-24299 and CVE-2026-26136) describe improper neutralization of special elements used in a command in M365 Copilot and Microsoft Copilot, allowing an unauthorized attacker to disclose information over a network. Microsoft published advisories for both issues via MSRC.
other·unknown·
19 Mar 2026 · Meta
The Verge reported that a rogue AI agent led to a serious security incident at Meta. No further details about the nature, scope or impact of the incident are available in the provided source.
other·unknown·
16 Mar 2026 · AWS
A flaw in the no-access and workdir features of the AWS API MCP Server (versions >= 0.2.14 and < 1.3.9) allowed intended file access restrictions to be bypassed, exposing arbitrary local file contents in the MCP client application context. AWS published a security bulletin and fixed the issue in version 1.3.9.
other·excessive permissions·
16 Mar 2026 · PrefectHQ
FastMCP versions prior to 2.14.2 did not respect the resource parameter submitted by clients in authorization and token requests, issuing tokens for the base_url given to the OAuthProxy rather than explicitly for the MCP server. The issue was patched in version 2.14.2.
other·excessive permissions·
16 Mar 2026 · Mintplex Labs
Two vulnerabilities were disclosed in Mintplex Labs' AnythingLLM (versions 1.11.1 and earlier): default installations without a password or API key leave all HTTP endpoints and the agent WebSocket unauthenticated with a permissive CORS policy (CVE-2026-32617), and the built-in SQL Agent plugin builds queries by string concatenation, letting any user who can invoke the agent run arbitrary SQL on connected MySQL, PostgreSQL or MSSQL databases (CVE-2026-32628).
workflow·tool misuse·
12 Mar 2026 · getzep
Graphiti versions before 0.28.2 concatenated attacker-controlled label values from SearchFilters.node_labels directly into Cypher expressions, enabling Cypher injection on Neo4j, FalkorDB and Neptune backends. In MCP deployments it could be triggered by prompt injection against an LLM client induced to call search_nodes with attacker-controlled entity_types; fixed in 0.28.2.
other·prompt injection·
11 Mar 2026 · homeassistant-ai
Versions of the ha-mcp Home Assistant MCP server prior to 7.0.0 contained two vulnerabilities in the beta OAuth consent flow: an unvalidated user-supplied ha_url enabling unauthenticated server-side request forgery for internal network reconnaissance (CVE-2026-32111), and unescaped user-controlled parameters rendered via Python f-strings enabling JavaScript execution in the operator's browser (CVE-2026-32112). Both were fixed in release 7.0.0.
workflow·unknown·
11 Mar 2026 · Cursor
A vulnerability in the Cursor AI code editor prior to version 2.0 allowed maliciously crafted instructions on visited websites to be followed by the model, and combined with a command whitelist bypass, could cause commands to run automatically without user intent. The issue is fixed in Cursor 2.0.
coding·prompt injection·
11 Mar 2026 · FastGPT (labring)
FastGPT's Python Sandbox (fastgpt-sandbox) in version 4.14.7 and earlier contains guardrails (static detection plus seccomp) intended to block file writes, but they can be bypassed by remapping stdout (fd 1) to another writable file descriptor with fcntl. Writes via sys.stdout.write() then still satisfy the seccomp rule for write(fd==1), allowing arbitrary file creation or overwrite inside the sandbox container.
coding·misconfiguration·
10 Mar 2026 · sooperset
Two vulnerabilities (CVE-2026-27826 and CVE-2026-27825) in the MCP Atlassian Model Context Protocol server allowed unauthenticated attackers to force outbound requests to arbitrary URLs via HTTP middleware, and allowed the confluence_download_attachment tool to write attacker-controlled content to arbitrary paths, enabling code execution. Both are fixed in version 0.17.0.
workflow·tool misuse·
10 Mar 2026 · Microsoft
Microsoft published two CVEs affecting its AI agent infrastructure: CVE-2026-26133, an AI command injection flaw in M365 Copilot that lets an unauthorized attacker disclose information over a network, and CVE-2026-26118, a server-side request forgery flaw in Azure MCP Server that lets an authorized attacker elevate privileges over a network.
workflow·prompt injection·
7 Mar 2026 · Tencent
A vulnerability in Tencent's WeKnora LLM document-understanding framework before version 0.3.0 let a malicious remote MCP server register a tool that overwrites a legitimate one due to an ambiguous mcp_{service}_{tool} naming convention. Combined with indirect prompt injection, this allowed attackers to hijack LLM execution flow, exfiltrate system prompts and context, and run other tools with the user's privileges.
workflow·prompt injection·
7 Mar 2026 · PinchTab
A Server-Side Request Forgery vulnerability in the /download endpoint of PinchTab, an HTTP server that gives AI agents direct control over Chrome, allowed any user with API access to make the server request arbitrary URLs, including internal network services and local files, and exfiltrate the responses. The issue was patched in version 0.7.7.
browsing·excessive permissions·
7 Mar 2026 · doobidoo
Versions of the open-source mcp-memory-service memory backend prior to 10.21.0 returned detailed system information (OS and Python versions, CPU count, memory, disk usage and database filesystem path) from the /api/health/detailed endpoint without authentication when anonymous access was enabled, exposing reconnaissance data to the network due to the default 0.0.0.0 binding. The issue was patched in version 10.21.0.
other·misconfiguration·
6 Mar 2026 · Agentgateway
Agentgateway, an open source data plane for agentic AI connectivity, failed to sanitize path, query, and header values when converting MCP tools/call requests into OpenAPI requests in versions prior to 0.12.0. The issue was patched in version 0.12.0.
other·tool misuse·
6 Mar 2026 · GitHub
GitHub Copilot CLI versions up to and including 0.0.422 contained a flaw where crafted bash parameter expansion patterns could hide executable code inside commands classified as read-only by the safety layer, enabling arbitrary code execution on a user's workstation via prompt injection through repository files, MCP server responses or user instructions. The issue was patched in version 0.0.423.
coding·prompt injection·
5 Mar 2026 · OpenClaw
Two vulnerabilities were disclosed in the OpenClaw agent platform: an SSRF issue in the Feishu extension (CVE-2026-28451) that lets attackers trigger fetches of attacker-controlled or internal URLs via tool calls influenced by prompt injection, and a remote code execution flaw (CVE-2026-30741) in v2026.2.6 exploitable through request-side prompt injection.
other·prompt injection·
5 Mar 2026 · Aqua Security
Version 1.8.12 of the Trivy Vulnerability Scanner VS Code extension distributed through the OpenVSX marketplace was compromised and contained malicious code that used the local AI coding agent to collect and exfiltrate sensitive information. The malicious artifact has been removed from the marketplace and users are advised to remove it and rotate environment secrets.
coding·supply chain·
3 Mar 2026 ·
A buffer overflow vulnerability was reported in LLM-Claw versions 0.1.0 through 0.1.1a-p1, in the agent_deploy_init function of /agents/deploy/initiate.c in the Agent Deployment component. The flaw can be exploited remotely, and a patch is available to remediate it.
other·unknown·
2 Mar 2026 · ModelScope
A command injection vulnerability in ModelScope's ms-agent (versions v1.6.0rc1 and earlier) allows an attacker to execute arbitrary operating system commands through crafted prompt-derived input. A proof-of-concept and write-up describing escalation from AI prompt to full system compromise were published alongside the CVE.
other·prompt injection·
26 Feb 2026 · Agenta
Two vulnerabilities were disclosed in the open-source Agenta LLMOps platform: a Python sandbox escape in the custom code evaluator (CVE-2026-27952) that let authenticated users run arbitrary code on the API server via a whitelisted numpy package, and a server-side template injection flaw in evaluator template rendering (CVE-2026-27961). Both affect self-hosted or managed Agenta deployments and are fixed in versions 0.48.1 and 0.86.8 respectively.
other·misconfiguration·
26 Feb 2026 · Zed Industries
Zed's AI agent file tools (`read_file`, `edit_file`) in versions before 0.225.9 followed symbolic links out of the project directory, allowing reads and writes outside the workspace and bypassing `file_scan_exclusions` and `private_files` protections, potentially leaking sensitive user data to the LLM. The issue is fixed in version 0.225.9.
coding·excessive permissions·
26 Feb 2026 · Model Context Protocol
In mcp-server-git versions before 2026.1.14, the git_add tool did not validate that file paths in the files argument stayed within repository boundaries, so relative paths containing '../' could stage files from outside the repository into the Git index. The issue is fixed in version 2026.1.14 (CVE-2026-27735).
coding·tool misuse·
26 Feb 2026 · Langflow
Langflow versions prior to 1.8.0 hardcoded `allow_dangerous_code=True` in the CSV Agent node, exposing LangChain's Python REPL tool so an attacker could run arbitrary Python and OS commands on the server via prompt injection. Version 1.8.0 fixes the issue.
workflow·prompt injection·
25 Feb 2026 · agentfront
Enclave, a JavaScript sandbox for safe AI agent code execution, contained a flaw in `@enclave-vm/core` before version 2.11.1 that allowed attackers to escape the sandbox security boundaries and achieve remote code execution. The issue was fixed in version 2.11.1.
coding·unknown·
25 Feb 2026 · Parse Community
Three chained vulnerabilities (CVE-2026-27595, CVE-2026-27608, CVE-2026-27609) in the opt-in AI Agent API endpoint of Parse Dashboard versions 7.3.0-alpha.42 through 9.0.0-alpha.7 allowed unauthenticated remote attackers to perform arbitrary reads and writes on connected Parse Server databases using the master key, due to missing authentication, missing per-app authorization and absent CSRF protection. The issues were fixed in version 9.0.0-alpha.8, with removal of the agent config block offered as a workaround.
other·excessive permissions·
25 Feb 2026 · LangChain
Two LangChain vulnerabilities were disclosed and patched: a redirect-based SSRF bypass in RecursiveUrlLoader in @langchain/community (CVE-2026-27795), which allowed a validated public URL to redirect to internal or metadata endpoints, and a URL parameter injection flaw in LangSmith Studio (CVE-2026-25750) that leaked bearer tokens, user IDs and workspace IDs to attacker-controlled servers when users clicked crafted links.
workflow·data leak·
21 Feb 2026 · YosefHayim (ebay-mcp open source project)
All versions of the open source eBay API MCP Server are vulnerable to environment variable injection via the ebay_set_user_tokens tool, whose updateEnvFile function writes values to the .env file without validating newlines or quotes. Attackers can inject arbitrary environment variables, potentially causing configuration overwrites, denial of service, or remote code execution.
other·tool misuse·
19 Feb 2026 · Cisco
A vulnerability in the optional API Server of Cisco AI Defense's Skill Scanner, caused by erroneous binding to multiple interfaces, allowed unauthenticated remote attackers to exhaust memory or upload files to arbitrary folders. It affects Skill-scanner 1.0.1 and earlier and is fixed in release 1.0.2.
other·misconfiguration·
19 Feb 2026 · OpenClaw
Five CVEs were published for the OpenClaw personal AI assistant (formerly Clawdbot) covering prompt injection via untrusted Slack channel metadata and unsanitized workspace paths, a misleading macOS deep-link confirmation dialog that could lead to arbitrary command execution, local file exfiltration via the Feishu extension's sendMediaFeishu tool, and path traversal in browser download helpers. All issues were fixed in releases 2026.2.3 through 2026.2.15.
other·prompt injection·
13 Feb 2026 · Cursor
A vulnerability in Cursor versions prior to 2.5 allowed a malicious agent, e.g. via prompt injection, to write to improperly protected .git settings including git hooks, enabling out-of-sandbox remote code execution without user interaction when Git next ran those commands. The issue was fixed in version 2.5.
coding·prompt injection·
13 Feb 2026 · Cloudflare
A reflected cross-site scripting flaw in the AI Playground's OAuth callback handler allowed the `error_description` query parameter to be interpolated unescaped into an inline script tag. Exploitation via a crafted link could expose a victim's stored LLM chat history and let an attacker interact with MCP servers connected to the victim's session.
other·misconfiguration·
11 Feb 2026 · akutishevsky
CVE-2026-26029 describes a command injection flaw in sf-mcp-server, a Salesforce MCP server implementation for Claude for Desktop, caused by unsafe use of child_process.exec when building Salesforce CLI commands from user-controlled input. Exploitation allows arbitrary shell command execution with the privileges of the MCP server process.
workflow·tool misuse·
10 Feb 2026 · LangChain
Two server-side request forgery vulnerabilities were disclosed in LangChain: ChatOpenAI.get_num_tokens_from_messages() fetched arbitrary image_url values without validation (CVE-2026-26013), and the @langchain/community RecursiveUrlLoader used a string-prefix check for its preventOutside option and did not block private or reserved IP addresses, allowing crawls of internal infrastructure and cloud metadata services (CVE-2026-26019). Both were fixed in langchain-core 1.2.11 and @langchain/community 1.1.14 respectively.
workflow·tool misuse·
10 Feb 2026 · labring
Two vulnerabilities were disclosed in FastGPT, an AI agent building platform: versions 4.14.0-4.14.5 allowed unauthenticated access to the plugin system via /api/plugin/xxx, potentially crashing it and losing plugin installation state, and server-side fetching nodes (web page acquisition, HTTP nodes) allowed requests to internal network addresses. Fixes shipped in 4.14.5-fix and 4.14.7 respectively.
workflow·excessive permissions·
