Structured records of AI agent security incidents: what happened, which vendor and agent type, the root cause, and every source we used. Filter, browse, or download as CSV.
5 May 2026 · Oracle
Oracle disclosed an easily exploitable vulnerability in the Oracle MCP Server Helper Tool (versions 1.0.1-1.0.156) that lets an unauthenticated attacker with HTTP network access compromise the tool and cause it to execute malicious SQL.
technology·other·unknown·
5 May 2026 · DataEase
SQLBot, an LLM/RAG-based Text-to-SQL system, concatenated user-supplied questions directly into the LLM prompt and executed the resulting SQL without validation in versions 1.7.0 and earlier. An authenticated attacker could use prompt injection to run arbitrary SQL and, against PostgreSQL data sources, achieve remote code execution via COPY FROM PROGRAM; fixed in version 1.7.1.
technology·other·prompt injection·
5 May 2026 · chatchat-space
Four vulnerabilities (CVE-2026-7844 through CVE-2026-7847) were disclosed in chatchat-space Langchain-Chatchat up to version 0.3.1.3, including missing authentication on OpenAI-compatible file endpoints, a weak hash in the vision chat paste-image handler, a time-of-check time-of-use flaw in file upload, and predictable file IDs. Public exploits exist and the project had not responded to the reporter's issue reports.
technology·other·excessive permissions·
5 May 2026 · GeekyBot
The GeekyBot AI content and chatbot/lead generation plugin for WordPress is vulnerable to SQL injection via the 'attributekey' parameter in versions up to and including 1.2.0, allowing unauthenticated attackers to extract sensitive database information.
technology·customer service·unknown·
4 May 2026 · n8n
A cluster of CVEs disclosed in May 2026 affected n8n's MCP OAuth client registration endpoint (unauthenticated memory-exhaustion denial of service) and the n8n-MCP server, which had two server-side request forgery flaws (including IPv6-mapped bypass reaching cloud metadata endpoints and forwarding the n8n API key) and two logging flaws that persisted bearer tokens, API keys and credential-bearing tool arguments in server logs. All issues were fixed in updated releases.
technology·workflow·data leak·
4 May 2026 · pixelsock
A server-side request forgery flaw was disclosed in the validateUrl function of index.ts in pixelsock's directus-mcp 1.0.0 MCP server, where manipulating the fileUrl argument allows remote attackers to make the server issue arbitrary requests. A public exploit has been released and the fix pull request is still awaiting acceptance.
technology·workflow·tool misuse·
4 May 2026 · EvoMap
Three vulnerabilities (CVE-2026-42075, CVE-2026-42076, CVE-2026-42077) were disclosed in EvoMap's Evolver self-evolving engine for AI agents, allowing arbitrary file writes via the skill download --out flag, remote code execution via unsanitised input to an execSync curl command, and prototype pollution in the mailbox store module. All were patched in version 1.69.3.
technology·other·unknown·
4 May 2026 · icip-cas
Three vulnerabilities were disclosed in PPTAgent, an agentic framework for reflective PowerPoint generation: arbitrary code execution via Python eval() of LLM-generated code with builtins in scope, and arbitrary file write/directory creation via markdown_table_to_image and save_generated_slides. All were patched in commit 418491a.
technology·workflow·tool misuse·
29 Apr 2026 · Algovate
A server-side request forgery vulnerability was found in Algovate xhs-mcp 0.8.11, where manipulating the media_paths argument of the xhs_publish_content function in the MCP Interface allows remote exploitation. A public exploit exists and the project has not responded to the issue report.
technology·workflow·tool misuse·
28 Apr 2026 · TencentCloudBase
A server-side request forgery vulnerability (CVE-2026-7221) was found in TencentCloudBase CloudBase-MCP up to version 2.17.0, where the openUrl function in the open-url API endpoint fails to validate the req.body.url argument, allowing remote exploitation. A public exploit exists and the issue is fixed in version 2.17.1.
technology·coding·tool misuse·
27 Apr 2026 · dh1011
A server-side request forgery vulnerability was found in the generate_favicon_from_url function of the auto-favicon MCP tool, where the image_url argument can be manipulated remotely. A public exploit exists and the project had not responded to the issue report at time of disclosure.
technology·other·tool misuse·
27 Apr 2026 · dmitryglhf
A server-side request forgery vulnerability was disclosed in the _validate_url_safe function of the dmitryglhf mcp-url-downloader MCP server, allowing remote attackers to manipulate the url argument and force the server to make unintended requests. The exploit is public and the project has not responded to the issue report.
technology·browsing·tool misuse·
27 Apr 2026 · AlejandroArciniegas
A publicly disclosed server-side request forgery vulnerability in the axios-based HTTP request handler of the web-scraper server in the open-source mcp-data-vis MCP project allows remote attackers to make the server issue arbitrary requests. The maintainer was notified via a GitHub issue but has not responded, and the rolling-release project has no fixed version.
technology·browsing·tool misuse·
27 Apr 2026 · JoeCastrom
A server-side request forgery vulnerability (CVE-2026-7147) affects JoeCastrom mcp-chat-studio up to version 1.5.0, where manipulation of the req.query.base_url argument in server/routes/llm.js of the LLM Models API allows remote exploitation. The exploit is public and the project has not responded to the issue report.
technology·other·unknown·
24 Apr 2026 · Mintplex Labs
AnythingLLM versions prior to 1.12.1 rendered chart captions from LLM output through a markdown renderer without DOMPurify sanitisation, allowing stored DOM-level XSS. An attacker who could influence the model's output, typically via indirect prompt injection in a shared workspace document, could execute script in other users' browsers when they opened the conversation.
technology·other·prompt injection·
24 Apr 2026 · LangChain
Two vulnerabilities in LangChain packages allowed SSRF protections to be bypassed: HTMLHeaderTextSplitter.split_text_from_url() followed unvalidated redirects (CVE-2026-41481), and langchain-openai's _url_to_size() helper was subject to a TOCTOU/DNS rebinding window (CVE-2026-41488), potentially allowing requests to internal, localhost or cloud metadata endpoints and leaking internal data to callers.
technology·other·tool misuse·
23 Apr 2026 · OpenClaw
OpenClaw versions before 2026.3.28 contain a vulnerability that lets LLM agents silently disable execution approval through the config.patch parameter. Remote attackers can abuse this to bypass security controls and run unauthorized operations without user consent.
technology·other·excessive permissions·
23 Apr 2026 · Microsoft
A URL redirection to untrusted site ('open redirect') vulnerability in Microsoft 365 Copilot allows an unauthorized attacker to elevate privileges over a network. The issue is tracked as CVE-2026-33102 and documented in Microsoft's MSRC update guide.
technology·other·unknown·
23 Apr 2026 · Paperclip
Two vulnerabilities in @paperclipai/server, a Node.js/React platform that orchestrates a team of AI agents to run a business, allow remote code execution on the server host: one lets an attacker with an Agent API key inject shell commands via a self-updatable adapterConfig provisionCommand field, and another lets an unauthenticated attacker chain six API calls for full RCE on default 'authenticated' mode deployments. Both are fixed in version 2026.416.0.
technology·workflow·excessive permissions·
21 Apr 2026 · haris-musa
CVE-2026-40576: excel-mcp-server versions up to and including 0.1.7 fail to confine file operations to the EXCEL_FILES_PATH directory, letting an unauthenticated network attacker read, write and overwrite arbitrary files via crafted filepath arguments to any of its 25 MCP tool handlers when run in SSE or Streamable-HTTP mode. Fixed in version 0.1.8.
technology·workflow·misconfiguration·
21 Apr 2026 · FlowiseAI
Three vulnerabilities in FlowiseAI's Flowise LLM flow builder prior to version 3.1.0 allow remote code execution on the server: unauthenticated attackers can use prompt injection against chatflows using the CSV Agent or Airtable Agent nodes to have the LLM emit unsandboxed Python that runs attacker commands, while an authenticated user can abuse unsafe serialization of stdio commands in the MCP adapter to execute arbitrary commands. All three are fixed in Flowise 3.1.0.
technology·workflow·prompt injection·
21 Apr 2026 · DayuanJiang
Next AI Draw.io versions prior to 0.4.15 accumulated entire HTTP request bodies into memory in three POST handlers (/api/state, /api/restore, /api/history-svg) of its embedded sidecar, so a large payload (e.g. 500 MiB) could exhaust the Node.js heap and crash the MCP server. The issue is fixed in version 0.4.15.
technology·other·misconfiguration·
20 Apr 2026 · ericc-ch
Public disclosures describe two vulnerabilities in the open-source copilot-api project (versions up to 0.7.0): a permissive cross-domain policy in the cors function of src/server.ts at the token endpoint, and reliance on reverse DNS resolution via a manipulated Host header on the /token endpoint. Both are remotely exploitable and exploit details have been made public.
technology·coding·misconfiguration·
17 Apr 2026 · Apache
Apache Doris MCP Server versions before 0.6.1 contain an improper neutralization flaw in query context handling that could allow execution of unintended SQL statements and bypass of query validation and access restrictions via the MCP query execution interface. The issue is fixed in version 0.6.1.
technology·other·tool misuse·
17 Apr 2026 · neo4j-contrib
In mcp-neo4j-cypher versions before 0.6.0, an MCP server for running Cypher queries against Neo4j, the read_only mode enforcement could be bypassed using APOC CALL procedures, potentially enabling unauthorized write operations or server-side request forgery. The issue is fixed in version 0.6.0.
technology·other·excessive permissions·
17 Apr 2026 · labring
FastGPT, an AI agent building platform, contained two NoSQL injection vulnerabilities (CVE-2026-40351 and CVE-2026-40352) in versions before 4.14.9.5. The login endpoint accepted MongoDB query operators as a password, letting unauthenticated attackers log in as any user including the root administrator, while the password change endpoint allowed bypassing old-password verification for full account takeover and persistence. Both were fixed in version 4.14.9.5.
technology·other·unknown·
17 Apr 2026 · Anthropic
Two vulnerabilities were disclosed in Anthropic's agentic coding tool Claude Code: CVE-2026-35603, where Windows versions before 2.1.75 loaded a system-wide settings file from a world-writable ProgramData path letting a low-privileged local user plant malicious configuration, and CVE-2026-39861, where versions before 2.1.64 allowed a sandbox escape via symlinks that the unsandboxed process followed to write outside the workspace, triggerable through prompt injection. Both issues were fixed in the noted releases.
technology·coding·prompt injection·
17 Apr 2026 · Red Hat
A log injection flaw in the AAP MCP server lets an unauthenticated remote attacker send crafted input to the `toolsetroute` parameter, which is written to logs unsanitised. Injected newlines and ANSI escape sequences can hide real log entries and forge new ones, enabling social engineering of operators into running dangerous commands or visiting malicious URLs.
technology·workflow·unknown·
16 Apr 2026 · QuantGeekDev
In mcp-framework 0.2.21 and below, the HTTP transport's readRequestBody() concatenates request body chunks without enforcing the maxMessageSize setting, letting a remote unauthenticated attacker crash any mcp-framework HTTP server with a single large POST to /mcp via memory exhaustion. The issue was fixed in version 0.2.22.
technology·other·supply chain·
15 Apr 2026 · Splunk
In Splunk MCP Server app versions below 1.0.3, session and authorization tokens were recorded in clear text where a user with access to the Splunk `_internal` index or the `mcp_tool_admin` capability could view them. Exploitation requires local access to log files or administrative access to internal indexes, and the issue is addressed in version 1.0.3.
technology·workflow·data leak·
15 Apr 2026 · Flux159
Versions 3.4.0 and earlier of mcp-server-kubernetes, a Model Context Protocol server for Kubernetes cluster management, built a kubectl command by string concatenation and naive space-splitting in the port_forward tool, allowing attackers to inject arbitrary kubectl flags. This could expose internal Kubernetes services to the network (via --address=0.0.0.0) or target other namespaces, and could be triggered indirectly through prompt injection against connected AI agents; fixed in version 3.5.0.
technology·workflow·tool misuse·
15 Apr 2026 · Windsurf
A prompt injection vulnerability in Windsurf 1.9544.26 lets remote attackers embed malicious instructions in HTML content that the AI coding tool processes, causing it to modify the local MCP configuration and register a malicious MCP STDIO server. This results in arbitrary command execution on the victim system without further user interaction.
technology·coding·prompt injection·
15 Apr 2026 · Agent Zero
Agent Zero 0.9.8 allows users to define External MCP Servers via JSON configuration with arbitrary command and args values that are executed without sufficient validation. A malicious MCP configuration can therefore run arbitrary operating system commands with the privileges of the Agent Zero process.
technology·other·tool misuse·
15 Apr 2026 · Jaaz
Jaaz version 1.0.30 contains a remote code execution flaw in its MCP STDIO command execution handling, allowing a remote attacker to send crafted network requests to the network-accessible application and run arbitrary commands in the context of the Jaaz service. Successful exploitation could lead to full compromise of the affected system.
technology·other·tool misuse·
15 Apr 2026 · Upsonic
Upsonic 0.71.6 contains a remote code execution flaw in its MCP server/task creation feature, where an allowlist still permits commands (npm, npx) whose argument flags can run arbitrary OS commands. Maliciously crafted MCP tasks can execute code with the privileges of the Upsonic process.
technology·workflow·tool misuse·
14 Apr 2026 · Microsoft
A command injection weakness (improper neutralization of special elements used in a command) in GitHub Copilot and Visual Studio Code allows an authorized attacker to disclose information over a network. The issue is tracked as CVE-2026-23653 with a Microsoft security update guide advisory.
technology·coding·tool misuse·
13 Apr 2026 ·
A financially motivated, suspected Italian actor dubbed the 'Canto Incognito' campaign used an AI-written poem posted on GitHub to hide command-and-control IP addresses, compromising over 3,000 internet-facing servers running vulnerable LiteLLM, Ollama, Gotenberg, Gitea and Ivanti Sentry deployments for cryptomining and botnet expansion.
technology·other·misconfiguration·
13 Apr 2026 · Apache Software Foundation
Apache SkyWalking MCP 0.1.0 contains a server-side request forgery vulnerability triggered through the SW-URL header. The issue is fixed in version 0.2.0, which users are advised to upgrade to.
technology·other·tool misuse·
11 Apr 2026 · aws-mcp-server
Two vulnerabilities (CVE-2026-5058 and CVE-2026-5059) in aws-mcp-server stem from improper validation of user-supplied strings against the allowed commands list before executing system calls, letting remote unauthenticated attackers run arbitrary code in the context of the MCP server.
technology·workflow·tool misuse·
10 Apr 2026 · labring
Two vulnerabilities were disclosed in the FastGPT AI agent building platform: an unauthenticated SSRF via the /api/core/app/mcpTools/runTool endpoint (CVE-2026-40100, fixed in 4.14.10.3) and a broken access control (IDOR/BOLA) issue allowing any authenticated team to access and execute other teams' applications (CVE-2026-40252, fixed in 4.14.10.4). Both enable access to resources beyond the attacker's authorisation, including cross-tenant data exposure and execution of private AI workflows.
technology·workflow·excessive permissions·
10 Apr 2026 · OpenClaw
OpenClaw versions 2026.2.13 through 2026.3.24 are vulnerable to ANSI escape sequence injection, where untrusted tool metadata such as malicious tool titles can carry control sequences into approval prompts and permission logs to spoof terminal output. The issue was addressed in a fix commit and a GitHub security advisory.
technology·coding·prompt injection·
9 Apr 2026 · LangChain
Two vulnerabilities were disclosed in the LangChain ecosystem: incomplete f-string prompt-template validation in LangChain (CVE-2026-40087) allowed attribute-access and nested replacement-field expressions to be evaluated during formatting, fixed in langchain-core 0.3.84 and 1.2.28; and LangChain-ChatChat 0.3.1 (CVE-2026-30617) allowed a remote attacker to configure an MCP STDIO server via an exposed management interface and execute arbitrary commands when agents run.
technology·other·tool misuse·
9 Apr 2026 · awwaiid
A command injection vulnerability was disclosed in the MCP server mcp-server-taskwarrior up to version 1.0.1, where manipulation of the Identifier argument in the server.setRequestHandler function of index.ts allows local command injection. The exploit was publicly disclosed and the maintainer released a patched version.
technology·workflow·tool misuse·
9 Apr 2026 · AGiXT
In AGiXT versions prior to 1.9.2, the safe_join() function in the essential_abilities extension did not verify that resolved paths stayed inside the agent workspace, letting an authenticated attacker use directory traversal to read, write or delete arbitrary files on the host. The issue is fixed in release 1.9.2.
technology·workflow·excessive permissions·
9 Apr 2026 · Apollo GraphQL
Apollo MCP Server before version 1.7.0 failed to validate the Host header on StreamableHTTP transport requests, allowing a malicious website to use DNS rebinding to reach a locally running MCP server and invoke its tools or access its resources on behalf of the user. The issue does not affect stdio transport and is fixed in version 1.7.0.
technology·workflow·misconfiguration·
8 Apr 2026 · agentfront
Versions of the FrontMCP framework prior to 2.3.0 dereferenced $ref pointers in OpenAPI specifications via @apidevtools/json-schema-ref-parser without URL restrictions or custom resolvers, so a malicious spec could make the server fetch internal addresses, cloud metadata endpoints or local files during initialize(). The issue enables server-side request forgery and local file read and is fixed in version 2.3.0.
technology·other·misconfiguration·
8 Apr 2026 · Zammad
A server-side template injection vulnerability in Zammad's AI Agent feature prior to version 7.0.1 could lead to remote code execution. Exploitation requires an attacker to control or influence type_enrichment_data, typically limited to high-privilege administrative configuration, and the issue is fixed in 7.0.1.
technology·customer service·unknown·
7 Apr 2026 · Model Context Protocol
Versions of the official Model Context Protocol Java SDK prior to 1.0.0 contain a DNS rebinding vulnerability that lets an attacker reach a local or network-private MCP server through a victim's browser and invoke any tool call as if they were a locally connected AI agent. The issue is fixed in version 1.0.0.
technology·other·misconfiguration·
6 Apr 2026 · imprvhub
A server-side request forgery vulnerability was disclosed in the imprvhub mcp-browser-agent MCP server (versions up to 0.8.0), where manipulation of the request.params.name/request.params.arguments values handled by CallToolRequestSchema in src/handlers.ts allows remote attackers to trigger SSRF. The exploit has been publicly disclosed and the vendor did not respond to the disclosure.
technology·browsing·tool misuse·
6 Apr 2026 · Mobile Next
The mobile_open_url tool in the mobile-mcp MCP server passed user-supplied URLs directly to Android's intent system without scheme validation, allowing execution of arbitrary intents such as USSD codes, phone calls, SMS messages and content provider access. The issue affects versions prior to 0.0.50 and is fixed in 0.0.50.
technology·workflow·tool misuse·
