Threat Library

Flowise, a popular low-code LLM/agent orchestration platform, returns decrypted credential secrets in plaintext via its credentials API because its redaction logic only masks fields explicitly typed as 'password', missing string-typed fields that commonly hold database URLs, private keys, and API keys. Any authenticated user with 'credentials:view' permission can retrieve full secrets for connection strings, cloud service accounts, and other integrations configured in the workspace, enabling lateral movement into downstream systems the agent platform connects to.

This is a release note describing a legitimate new feature in datasette-apps that lets an AI agent open an app in a hidden, non-interactive iframe and run agent-provided JavaScript to smoke-test it. There is no evidence in this data of a vulnerability, exploit, or malicious use; it is a feature announcement rather than a threat report. Severity is rated low because no genuine security issue is described.

IBM Langflow, an open-source framework used to build AI agent and LLM workflows, contains a path traversal flaw in versions 1.0.0 through 1.10.1. A remote, unauthenticated attacker can craft a URL request with '../' sequences to read arbitrary files on the host system, potentially exposing credentials, API keys, or configuration data used by connected agents and tools.

IBM Langflow OSS versions 1.0.0 through 1.10.1 contain an improper access control flaw that lets authenticated users view and manipulate other users' agent flow build jobs and logs, and exposes some build endpoints without authentication at all. This is a genuine vulnerability with a moderate-high CVSS score (7.1), primarily impacting confidentiality and integrity of multi-tenant Langflow deployments rather than enabling remote code execution directly.

Pydantic AI's protection against SSRF to cloud metadata endpoints can be bypassed when an application allows local/private URL downloads, because the IP blocklist fails to recognize IPv6-encoded forms (IPv4-mapped, 6to4, NAT64) of metadata service addresses. On dual-stack or NAT64-translated networks, this lets an attacker-controlled URL reach the cloud metadata service and potentially steal short-lived IAM credentials. This only affects apps that explicitly opt into 'force_download=allow-local' on URLs influenced by untrusted input; the issue has been patched in version 1.99.0.

A REST endpoint in the n8n workflow automation platform is registered before authentication middleware is applied, letting any unauthenticated network caller cancel another user's active test webhook if they know the workflow ID. The impact is limited to disrupting in-progress test sessions; production webhooks and stored data are unaffected. This is a low-complexity availability/harassment issue rather than a data breach or compromise vector.

n8n's JavaScript task runner shared a single module cache across all users' Code-node executions on the same instance, allowing one user to poison a cached module and affect other users' automations. This is a multi-tenant isolation failure rather than a sandbox escape or remote code execution, but it can compromise confidentiality, integrity, or availability of other tenants' workflow logic.

n8n's HTML preview feature renders workflow output into an iframe without a sandbox attribute, allowing a sanitizer bypass to execute attacker-controlled script in the same origin as the editor. Since n8n orchestrates automated workflows and often integrates with AI agents and external data sources, this could let an attacker with low-privilege access (global:member) hijack an authenticated user's session to call privileged APIs. The vendor has released patched versions and interim mitigations via CSP hardening.

n8n's Resource Locator UI passes a workflow-persisted URL field (cachedResultUrl) directly into window.open() without validating the URI scheme, allowing a malicious workflow to execute attacker-controlled JavaScript in a victim's browser when they interact with a crafted link. This is a stored XSS issue in the n8n web application rather than a direct compromise of an AI agent's reasoning, but since n8n is widely used to orchestrate AI/LLM agent workflows, exploitation could let an attacker pivot from the browser context into workflow credentials, connected integrations, or agent control surfaces. Official patches are available (1.123.64, 2.29.8, 2.30.1).

n8n, a workflow automation platform commonly used to orchestrate AI agent and API integrations, incorrectly embedded the full PEM private key of a Google Service Account inside the 'kid' field of a JWT header instead of a key identifier. Because JWT headers are only Base64-encoded (not encrypted), any system that logged, proxied, or inspected these tokens could recover the private key and impersonate the service account against Google Cloud resources. This is a genuine credential-exposure vulnerability with a clear patch, not a novel agentic-AI attack technique, but it is highly relevant to agent pipelines that rely on n8n for tool/API orchestration.

CISA added four actively exploited vulnerabilities to its KEV Catalog, one of which (CVE-2026-0770) affects Langflow, a framework used to build AI agent/LLM workflows, involving inclusion of functionality from an untrusted control sphere. The other three CVEs concern DD-WRT and WordPress and are unrelated to AI agent infrastructure. This is a legitimate, actively exploited vulnerability disclosure relevant to organizations running Langflow-based agent pipelines, warranting prompt patching per federal directive BOD 26-04.

AgenticMail, a platform that gives AI agents real email addresses and phone numbers, contained a cluster of validation and security-control weaknesses across its API and core packages. These include SQL identifier injection risks, insufficient SMTP header/envelope sanitization enabling command injection, fail-open secret handling, and TLS verification defaulting incorrectly in some configurations. Combined, these flaws could let an attacker manipulate agent-controlled email infrastructure, access or corrupt storage metadata, inject SMTP commands, or intercept traffic via weakened TLS defaults.

nono, a sandboxing framework for running AI agents with reduced privileges, failed to block access to local Unix domain sockets prior to version 0.55.0. This allowed a sandboxed AI agent to reach the per-user systemd D-Bus socket and escape the intended isolation boundary, potentially gaining broader system access than intended. Users should upgrade to 0.55.0 immediately.

Langflow's APIRequest component, when its 'Save to File' feature is enabled, trusts filenames supplied by an external HTTP server's Content-Disposition header without sanitizing them. A malicious or compromised remote endpoint can inject path traversal sequences to write arbitrary files outside the intended temporary directory, potentially leading to full remote code execution on the host running the agent flow.

IBM Langflow versions 1.0.0 through 1.10.0 contain a vulnerability allowing remote code execution due to incomplete validation of MCP server configuration files. An attacker who can supply or modify an MCP server config could execute arbitrary code on the Langflow host, fully compromising the agent runtime and any connected tools or data.

Langflow, an open-source framework used to build AI agent workflows, contains a server-side request forgery vulnerability caused by weak default configuration and incomplete SSRF protections. An attacker could exploit this to make the Langflow server issue unauthorized requests to internal or cloud-metadata endpoints, potentially exposing sensitive infrastructure or credentials. This is a genuine, credibly documented vulnerability (CVSS 7.7) rather than a speculative or low-quality report.

IBM Langflow, an open-source visual builder for AI agent workflows, contains a path traversal flaw where a malicious flow can fetch attacker-controlled content and write it to arbitrary paths on the server via a crafted Content-Disposition header. An authenticated attacker can abuse this to overwrite configuration, code, or scheduled/startup files, likely leading to full compromise of the Langflow instance. This is a serious framework-level vulnerability requiring only low-privilege authenticated access.

Langflow, a widely used low-code framework for building AI agent workflows, ships with an AUTO_LOGIN feature enabled by default that issues long-lived superuser bearer tokens to any unauthenticated network requester hitting a specific login endpoint. Combined with permissive CORS settings, this allows a remote attacker with no credentials to obtain full administrative control over the Langflow instance, including any agents, flows, and connected tools/credentials it manages. This is a critical, actively exploitable misconfiguration in a default deployment rather than a subtle logic flaw.

A concurrency flaw in IBM Cognos Analytics' Agentic AI assistant causes incorrect report summaries or processing failures when multiple authenticated users submit report tasks at the same time. This is a reliability/integrity bug rather than an exploitable attacker-controlled takeover primitive, though it could be leveraged to degrade service or corrupt report outputs relied on for decision-making.

LangChain4j's MariaDB and pgvector embedding store integrations build SQL queries by unsafely concatenating metadata filter keys (and MariaDB string values) into query strings, allowing an attacker who controls filter input to inject SQL. This can lead to blind data exfiltration, denial of service, and mass deletion of vector store data via crafted EmbeddingSearchRequest filters.