Threat Library

IBM Langflow contains a vulnerability where its ToolGuard security policy fails to validate dynamically generated Python code fields, allowing attackers with flow creation privileges to inject and execute arbitrary code on the backend despite custom component restrictions being disabled. The flaw is worsened by an MCP tool that accepts attacker-controlled user IDs, enabling cross-tenant injection into other users' flows, and can require little to no authentication under common misconfigurations.

Langflow, a widely used low-code framework for building AI agent workflows, ships with an AUTO_LOGIN feature enabled by default that issues long-lived superuser bearer tokens to any unauthenticated network requester hitting a specific login endpoint. Combined with permissive CORS settings, this allows a remote attacker with no credentials to obtain full administrative control over the Langflow instance, including any agents, flows, and connected tools/credentials it manages. This is a critical, actively exploitable misconfiguration in a default deployment rather than a subtle logic flaw.

IBM Langflow OSS versions 1.0.0-1.10.0 allow unauthenticated attackers to register new user accounts that, under the common NEW_USER_IS_ACTIVE=true configuration, are immediately active without admin approval. This lets attackers authenticate and reach code-execution endpoints, effectively bypassing intended access controls even when AUTO_LOGIN is disabled. Given the critical CVSS score of 9.8, this is a genuine and severe vulnerability requiring urgent patching.

IBM Langflow versions 1.0.0 through 1.10.0 contain a critical vulnerability chain allowing any unauthenticated network attacker to obtain superuser credentials and execute arbitrary code on the server. This affects default deployments of a widely used AI agent-building platform, giving attackers full control of the host and any connected agent workflows, data, or credentials.

Claude Code Action, prior to version 1.0.74, checked out attacker-controlled pull request branches and blindly loaded and enabled any MCP servers defined in a PR's .mcp.json file. This allowed an external attacker to open a malicious pull request that, once processed by the Claude Code action, achieved arbitrary code execution on the GitHub Actions runner and exfiltrated CI secrets such as API keys and tokens.

LiteLLM 1.18.10 allows any user who can submit MCP server configuration JSON to specify arbitrary OS commands and arguments that are executed unvalidated on the host. This gives an attacker remote code execution with the privileges of the LiteLLM process, a critical risk given the 9.8 CVSS score and the ease of exploitation.

A concurrency flaw in IBM Cognos Analytics' Agentic AI assistant causes incorrect report summaries or processing failures when multiple authenticated users submit report tasks at the same time. This is a reliability/integrity bug rather than an exploitable attacker-controlled takeover primitive, though it could be leveraged to degrade service or corrupt report outputs relied on for decision-making.

Agentic-Flow's MCP server tools passed user- and agent-supplied parameters (agent, task, name, language, agentdb) directly into shell commands via execSync() without sanitization, enabling arbitrary OS command execution. Any client, upstream agent, or automated caller able to invoke these MCP tools could achieve full remote code execution at the privilege level of the MCP server process. This is a critical, unauthenticated-adjacent injection flaw affecting core orchestration and swarm tooling.

This is a follow-up disclosure from Embrace The Red detailing how an LLM agent that outputs untrusted content into a macOS Terminal could be leveraged to trigger DNS requests via crafted ANSI escape sequences, effectively exfiltrating data through DNS lookups. Apple has since fixed the underlying macOS Terminal behavior, so this report documents a resolved vulnerability rather than an active ongoing threat. Severity is moderate given the fix is already deployed, but the technique remains relevant for agents/tools still rendering raw terminal output without sanitization.

This research demonstrates that LLMs used in Security Operations Centers to analyze network/security logs can be manipulated by adversaries who embed prompt injection payloads directly into log-generating fields (e.g., user-agent strings, hostnames, request paths). Because these logs are stored and later fed verbatim into an LLM's context during analyst queries, the injection persists and executes passively, achieving up to 88.2% attack success across production models for goals like hiding malicious activity, generating false positives, exfiltrating data, or hijacking output. This is academic research with a working benchmark and demonstrated mitigations, not an observed in-the-wild exploit, but it describes a realistic and highly exploitable architectural flaw.

Academic research demonstrates that malicious instructions planted inside persistent memory files (used by agentic coding assistants like Claude Code and OpenAI Codex for cross-session context) can influence and hijack future agent sessions. This is a controlled research study, not an observed in-the-wild exploit, but it highlights a real and underexplored attack surface as agents adopt long-term memory.

This is a defensive security research paper describing FlowGuard, a detection system that identifies real vulnerabilities (like command injection and file system access risks) in MCP servers by combining semantic analysis with runtime evidence verification. It is not an active exploit or attack technique, but rather a scanner designed to help defenders find genuine risks in the MCP ecosystem, which it did find in real-world servers (523 findings across 326 servers). The paper itself poses no direct threat; it highlights that underlying vulnerabilities in MCP tool implementations are prevalent enough to warrant sophisticated detection tooling.

This is a weekly aggregated security news digest from The Hacker News covering multiple unrelated stories, including spyware disguised as game cheats, ransomware attacks that reach full encryption within 24 hours, and abuse of Chrome sync settings for tracking or session hijacking. The source material lacks technical depth on any single incident, functioning as a curated list of headlines rather than a detailed incident report.

Two members of the Scattered Spider hacking collective, Owen Flowers (18) and Thalha Jubair (20), were sentenced to five and a half years each for a 2024 cyberattack on Transport for London (TfL) that caused an estimated £29 million in losses. The attack rendered 148 TfL systems inoperable and required in-person password resets for all 27,000 employees, highlighting the operational disruption capability of social-engineering-driven threat actors against critical transit infrastructure.

A vulnerability in Anthropic's Claude for Chrome browser extension allows a malicious co-installed extension to simulate user clicks and covertly trigger Claude's predefined AI actions. Since Claude may hold authenticated access to connected services like Gmail, Google Docs, Google Calendar, and Salesforce, an attacker could abuse this to exfiltrate data or perform unauthorized actions on the user's behalf without genuine user consent.

Coca-Cola disclosed that a ransomware attack against its Fairlife dairy subsidiary has disrupted operations, forcing a temporary suspension of Fairlife product manufacturing across the United States. The incident highlights continued targeting of large food and beverage manufacturers by ransomware operators seeking to leverage operational disruption for extortion leverage.

ClickLock is a newly identified macOS information-stealing malware that forcibly terminates all visible user processes to coerce victims into entering their system login password. Once captured, this password can be used to unlock keychains, decrypt stored credentials, and gain deeper system access. The technique represents an evolution in macOS malware social engineering, exploiting user trust in system prompts.

CISA added three actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog: two OS command injection flaws in Fortinet FortiSandbox and a deserialization of untrusted data vulnerability in Microsoft SharePoint. All three are confirmed to be exploited in the wild and pose significant risk to organizations running these products, particularly federal agencies bound by BOD 26-04 remediation timelines.

A privilege escalation vulnerability exists in SALTO ProAccess Space access control software versions prior to 6.13, affecting installations using the tenancy/logical partition feature. An authenticated attacker with valid operator credentials can bypass partition boundaries to access spaces outside their assigned tenancy, potentially compromising physical access control across an organization's facilities.

Siemens has disclosed four vulnerabilities affecting SICAM 8 product firmware (CPCI85 and SICORE base systems) used in energy and critical manufacturing environments. The flaws include an exposed debugging interface, insufficient firmware update signature validation, insecure default OPC UA security settings, and unverified password changes, which combined could lead to denial of service, unauthorized access, or persistent code execution on affected devices. Siemens has released firmware updates (V26.20/V26.20.0) to remediate all four issues.