Threat Library

Multiple Siemens industrial and engineering software products bundling the IAM Client SDK are affected by an untrusted/unquoted search path vulnerability that could allow an authenticated local attacker to escalate privileges. Siemens has released patched versions for most affected products and recommends updating as soon as possible, with fixes pending for remaining products.

The n8n computer-use package's shell tool was supposed to restrict filesystem and network access via a sandbox, but this enforcement only worked on macOS. On Linux and Windows, any command executed by the agent's shell tool ran with full, unrestricted access to the host filesystem and network, defeating the intended containment. This is only relevant to deployments that explicitly enable the computer-use package.

n8n's GraphQL node failed to enforce the 'Allowed HTTP Request Domains' restriction that is applied to HTTP-based credentials, unlike its HTTP Request node counterpart. An authenticated user with workflow editing rights could exploit this gap to point the GraphQL node at an attacker-controlled server and exfiltrate credentials that were supposed to be domain-restricted. This is a moderate-severity authorization bypass affecting multi-tenant or shared-credential n8n deployments, fixed in recent releases.

A REST endpoint in the n8n workflow automation platform is registered before authentication middleware is applied, letting any unauthenticated network caller cancel another user's active test webhook if they know the workflow ID. The impact is limited to disrupting in-progress test sessions; production webhooks and stored data are unaffected. This is a low-complexity availability/harassment issue rather than a data breach or compromise vector.

n8n workflows using LLM sub-nodes (OpenAI, Anthropic, Lemonade) with custom HTTP header credentials write those header values in plaintext into stored execution data, even though the n8n UI masks them. Any user with access to execution logs or exports can recover API keys and secrets, which may persist in the database well after the workflow run completes.

n8n's JavaScript task runner shared a single module cache across all users' Code-node executions on the same instance, allowing one user to poison a cached module and affect other users' automations. This is a multi-tenant isolation failure rather than a sandbox escape or remote code execution, but it can compromise confidentiality, integrity, or availability of other tenants' workflow logic.

The n8n PostgresTrigger node, commonly used by AI agent and automation workflows to connect to PostgreSQL databases, failed to properly escape user-supplied identifier fields (channel, function, trigger names) before embedding them in SQL statements. This allowed authenticated n8n users to inject arbitrary SQL, gaining full read/write access to the connected database using the workflow's configured credentials. The issue has been patched; the main risk is privilege escalation by low-trust authenticated users within multi-tenant or shared n8n deployments.

The n8n Snowflake node's Execute Query operation directly interpolates workflow expression values into raw SQL strings instead of using parameterized queries, creating a classic SQL injection risk. Exploitation requires a workflow author to have already wired untrusted external data (e.g., from a webhook) into the raw query, so it is a secondary/contributing weakness rather than a directly remotely exploitable flaw on its own. This is a traditional application security bug in an automation tool that is increasingly used as an agentic tool-calling backend, not an AI-specific attack technique.

LiteLLM's Skills feature fails to validate file paths when extracting uploaded ZIP archives, allowing an authenticated user with access to the Skills API to write files outside the intended directory. This 'zip-slip' style vulnerability could lead to arbitrary file write and potentially remote code execution depending on server configuration. The issue is fixed in version 1.83.7-stable.

This advisory is a withdrawn duplicate of GHSA-9r8p-h6cc-6qhm, describing an n8n bug where the full Google Service Account PEM private key was mistakenly written into the JWT header's 'kid' field instead of a key identifier. Since JWT headers are only Base64-encoded (not encrypted), anything that logs or inspects the token could recover the private key, allowing impersonation of the associated Google Cloud service account. Impact is limited to n8n instances configured with Google Service Account credentials, and the issue is fixed in versions 1.123.64, 2.29.8, and 2.30.1.

n8n, a workflow automation platform commonly used to orchestrate AI agent and API integrations, incorrectly embedded the full PEM private key of a Google Service Account inside the 'kid' field of a JWT header instead of a key identifier. Because JWT headers are only Base64-encoded (not encrypted), any system that logged, proxied, or inspected these tokens could recover the private key and impersonate the service account against Google Cloud resources. This is a genuine credential-exposure vulnerability with a clear patch, not a novel agentic-AI attack technique, but it is highly relevant to agent pipelines that rely on n8n for tool/API orchestration.

This is an academic paper (not an active exploit) that defines a threat model called the 'hijacked authorized agent problem' for LLM agents operating in HPC environments. It argues that agents inheriting a user's credentials to manage Slurm jobs, logs, and files can be redirected by adversarial instructions embedded in logs, tool descriptions, or peer-agent messages, even though every resulting action remains fully authenticated and permitted. The paper proposes a research agenda and a benchmark (TaskBound) rather than demonstrating a working attack.

This is an academic research paper (arXiv, not an active exploit) demonstrating that decentralized collaborative prompt optimization systems like TCPO are vulnerable to malicious clients injecting instructions that survive server-side aggregation and persist through subsequent benign optimization rounds. The authors also propose a partial defense (APAgg) but show existing defenses are largely ineffective, indicating a genuine but currently theoretical/lab-demonstrated vulnerability class relevant to multi-agent and federated LLM optimization pipelines.

German and U.S. authorities dismantled the central infrastructure of Kratos, a phishing-as-a-service platform used globally to conduct credential-theft campaigns, and arrested its developer in Indonesia. This disrupts a major toolkit used by lower-skilled threat actors to launch large-scale phishing operations against individuals and organizations.

This is an academic research paper (not an active exploit) demonstrating a novel attack against multi-hop RAG agents called 'Salience Induction,' which manipulates fact position, emphasis, and framing in retrieved documents to redirect an agent's reasoning without injecting false facts or instructions. The authors also propose a defense, Salience Normalization, that substantially reduces attack success. This is a legitimate, disclosed research contribution rather than an in-the-wild threat, but it identifies a real and previously underexplored weakness in agentic RAG reasoning pipelines.

Rapid7 researchers discovered an exposed, misconfigured delivery server belonging to a malware operator, revealing over 1,000 files including phishing lure templates, filename-spoofing tests, droppers, and builder notes. The toolkit was actively used in a campaign targeting Windows users in Mexico via a fake government ID-lookup site, delivering an infostealer through WebDAV. The exposure suggests use of AI-generated content in crafting lures, lowering the barrier for producing convincing localized phishing pages.

This is academic research (not an active exploit) demonstrating that using humor as an indirect refusal mechanism in LLMs can itself introduce hidden safety risks. The authors show that a crafted attack, HumorPIA, can covertly embed harmful or toxic content inside seemingly safe humorous outputs, significantly increasing toxicity while evading existing safety detectors.

Cybercriminals engaged in carding are increasingly seeking 'clean' residential proxies—IPs with no prior fraud flags—combined with spoofed browser fingerprints and device profiles to bypass modern fraud detection systems. This reflects an evolution in fraud tradecraft as anti-fraud vendors improve detection of traditional proxy and VPN traffic, pushing criminals toward more sophisticated identity-blending techniques.

AWS HealthOmics MCP Server's linting tools failed to properly restrict pathnames, allowing an actor who can influence the MCP agent's workflow_files input to write attacker-controlled content outside the intended workflow bundle directory via directory traversal sequences. This is a classic path traversal vulnerability exposed through an MCP tool interface rather than a novel agent-specific attack, and is fixed in version 0.0.36.

A previously undisclosed OpenSSL flaw dubbed HollowByte allows an attacker to send an 11-byte crafted TLS request that forces an unpatched server to allocate up to 131 KB of memory for a message fragment that never completes, permanently consuming that memory on glibc-based systems until the process is restarted. OpenSSL silently patched the issue in June without issuing a CVE, advisory, or changelog entry, and Okta's Red Team later identified, named, and disclosed the bug.