Threat Library

AgenticMail's inbound-mail bridge lets any external email trigger a full resume of the operator's Claude Code agent session in an unrestricted 'bypassPermissions' mode, without verifying the sender is actually the operator. Because the attacker-controlled email subject, sender, and preview text are inserted verbatim into the resumed agent's prompt, this is a straightforward indirect prompt injection path into a fully privileged agent capable of Bash, file edits, web fetches, and other MCP tools. This is a critical, easily exploitable vulnerability with a vendor-supplied fix.

IBM Langflow, a popular open-source visual builder for LLM/agent workflows, ships with hard-coded credentials (password or cryptographic key) used for inbound authentication, outbound service communication, or internal data encryption. Because these secrets are static and embedded in the codebase across versions 1.0.0-1.10.1, any attacker who knows or extracts them can authenticate as a legitimate component, decrypt protected data, or impersonate trusted internal services. The maximum CVSS score of 9.8 reflects the potential for full compromise of confidentiality, integrity, and availability with low attack complexity and no privileges required.

Langflow's APIRequest component, when its 'Save to File' feature is enabled, trusts filenames supplied by an external HTTP server's Content-Disposition header without sanitizing them. A malicious or compromised remote endpoint can inject path traversal sequences to write arbitrary files outside the intended temporary directory, potentially leading to full remote code execution on the host running the agent flow.

IBM Langflow versions 1.0.0 through 1.10.0 contain a critical vulnerability allowing any authenticated user to escalate privileges to superuser by directly manipulating the underlying database. This grants attackers full control over the Langflow service, enabling arbitrary system command execution and complete system compromise. Given Langflow's role as an agent orchestration/flow-building platform, this is a severe supply-chain and framework-level risk for any AI agent pipelines built on it.

IBM Langflow, an open-source visual builder for AI agent/LLM workflows, contains a critical remote code execution flaw in its code validation API. Any authenticated user can submit Python code that is run directly via exec() with no sandboxing, granting them full control over the server process. Given a 9.9 CVSS score, this is a near-maximum severity issue requiring immediate patching or mitigation.

IBM Langflow's disk caching component deserializes cached objects using Python's unsafe pickle.loads() without any validation or authentication. An attacker who can influence cache contents—via crafted workflow inputs, custom components, or API calls—can trigger arbitrary code execution with the privileges of the Langflow server, leading to full system compromise.

IBM Langflow versions 1.0.0 through 1.10.0 contain a vulnerability allowing remote code execution due to incomplete validation of MCP server configuration files. An attacker who can supply or modify an MCP server config could execute arbitrary code on the Langflow host, fully compromising the agent runtime and any connected tools or data.

IBM Langflow OSS versions 1.0.0 through 1.10.1 expose a public flow build endpoint that allows unauthenticated remote code execution due to an incomplete security denylist. Attackers can construct flows using code-execution-capable agent components (OpenDsStarAgent, CodeActAgentSmolagents, CSVAgent) that are not blocked by the validation function, achieving arbitrary code execution without any authentication.

IBM Langflow contains a vulnerability where its ToolGuard security policy fails to validate dynamically generated Python code fields, allowing attackers with flow creation privileges to inject and execute arbitrary code on the backend despite custom component restrictions being disabled. The flaw is worsened by an MCP tool that accepts attacker-controlled user IDs, enabling cross-tenant injection into other users' flows, and can require little to no authentication under common misconfigurations.

Langflow, a widely used low-code framework for building AI agent workflows, ships with an AUTO_LOGIN feature enabled by default that issues long-lived superuser bearer tokens to any unauthenticated network requester hitting a specific login endpoint. Combined with permissive CORS settings, this allows a remote attacker with no credentials to obtain full administrative control over the Langflow instance, including any agents, flows, and connected tools/credentials it manages. This is a critical, actively exploitable misconfiguration in a default deployment rather than a subtle logic flaw.

IBM Langflow OSS versions 1.0.0-1.10.0 allow unauthenticated attackers to register new user accounts that, under the common NEW_USER_IS_ACTIVE=true configuration, are immediately active without admin approval. This lets attackers authenticate and reach code-execution endpoints, effectively bypassing intended access controls even when AUTO_LOGIN is disabled. Given the critical CVSS score of 9.8, this is a genuine and severe vulnerability requiring urgent patching.

IBM Langflow versions 1.0.0 through 1.10.0 contain a critical vulnerability chain allowing any unauthenticated network attacker to obtain superuser credentials and execute arbitrary code on the server. This affects default deployments of a widely used AI agent-building platform, giving attackers full control of the host and any connected agent workflows, data, or credentials.

Claude Code Action, prior to version 1.0.74, checked out attacker-controlled pull request branches and blindly loaded and enabled any MCP servers defined in a PR's .mcp.json file. This allowed an external attacker to open a malicious pull request that, once processed by the Claude Code action, achieved arbitrary code execution on the GitHub Actions runner and exfiltrated CI secrets such as API keys and tokens.

LiteLLM 1.18.10 allows any user who can submit MCP server configuration JSON to specify arbitrary OS commands and arguments that are executed unvalidated on the host. This gives an attacker remote code execution with the privileges of the LiteLLM process, a critical risk given the 9.8 CVSS score and the ease of exploitation.

Agentic-Flow's MCP server tools passed user- and agent-supplied parameters (agent, task, name, language, agentdb) directly into shell commands via execSync() without sanitization, enabling arbitrary OS command execution. Any client, upstream agent, or automated caller able to invoke these MCP tools could achieve full remote code execution at the privilege level of the MCP server process. This is a critical, unauthenticated-adjacent injection flaw affecting core orchestration and swarm tooling.

The Fay AI agent framework (version 4.3.1) exposes its MCP server management interface without adequate access control, allowing remote attackers to register a malicious MCP STDIO server with attacker-controlled commands. This results in full arbitrary command execution on the host running the Fay service, making it a critical, easily exploitable remote code execution vulnerability.

n8n-MCP, an MCP server exposing n8n workflow automation to AI assistants, failed to isolate workflow version history backups between tenants when multi-tenancy was enabled. Any authenticated tenant could read, delete, or destroy other tenants' backup snapshots, which contained full node definitions, credential references, and authorization headers. This is a severe cross-tenant data exposure and destruction flaw fixed in version 2.56.1.

Penpot's MCP server component exposed an unauthenticated HTTP endpoint bound to all network interfaces that allowed arbitrary JavaScript execution on the host. Any network-adjacent attacker could remotely execute code without credentials, making this a critical, easily exploitable vulnerability in an agent-tooling component.

Cursor's browser-enabled Cloud Agent exposed a local agent control endpoint without authentication, allowing malicious web content encountered by the agent's browsing capability to reach it from inside the sandbox. This let attacker-controlled pages trigger code execution within the agent's session and steal repository files, environment variables, credentials, and GitHub App tokens. The vendor fixed the issue by requiring authentication on the endpoint.

Flowise, a popular low-code AI agent/LLM workflow builder, ships with hardcoded fallback JWT secrets, audience, and issuer values that activate silently when operators fail to set the corresponding environment variables. An attacker who knows these public default values can forge valid JWTs to impersonate any user, including administrators, granting full control over the agent platform and any connected tools, credentials, or workflows.