Threat Library

n8n's HTML preview feature renders workflow output into an iframe without a sandbox attribute, allowing a sanitizer bypass to execute attacker-controlled script in the same origin as the editor. Since n8n orchestrates automated workflows and often integrates with AI agents and external data sources, this could let an attacker with low-privilege access (global:member) hijack an authenticated user's session to call privileged APIs. The vendor has released patched versions and interim mitigations via CSP hardening.

n8n's Resource Locator UI passes a workflow-persisted URL field (cachedResultUrl) directly into window.open() without validating the URI scheme, allowing a malicious workflow to execute attacker-controlled JavaScript in a victim's browser when they interact with a crafted link. This is a stored XSS issue in the n8n web application rather than a direct compromise of an AI agent's reasoning, but since n8n is widely used to orchestrate AI/LLM agent workflows, exploitation could let an attacker pivot from the browser context into workflow credentials, connected integrations, or agent control surfaces. Official patches are available (1.123.64, 2.29.8, 2.30.1).

n8n's OAuth 2.1 consent flow for MCP Server Trigger workflows fails to verify that the requesting user actually owns or has access to the workflow they are authorizing. A low-privileged member-level user can register an OAuth client, self-approve consent for another user's workflow, and obtain a valid token that runs the victim's workflow using the victim's stored credentials. This breaks project/user isolation and lets an attacker read outputs and manipulate tool inputs of an MCP agent tool they should never have access to.

A vulnerability in n8n's AI Agents feature allows a low-privileged 'Project Viewer' user to escalate privileges by simply chatting with an agent that has node tools enabled. Missing authorization checks on the node-execution tool let the attacker run arbitrary workflow nodes and access stored credential secrets they should not have access to.

A vulnerability in the Ansible Lightspeed MCP server allows an attacker to use indirect prompt injection to manipulate the AI agent into writing files outside of intended directories. This path traversal flaw can expose sensitive host data and enable execution of malicious commands, potentially leading to full system compromise. The CVSS score of 6.6 reflects meaningful but not maximal severity, likely due to required conditions like agent exposure to untrusted content.

CISA added four actively exploited vulnerabilities to its KEV Catalog, one of which (CVE-2026-0770) affects Langflow, a framework used to build AI agent/LLM workflows, involving inclusion of functionality from an untrusted control sphere. The other three CVEs concern DD-WRT and WordPress and are unrelated to AI agent infrastructure. This is a legitimate, actively exploited vulnerability disclosure relevant to organizations running Langflow-based agent pipelines, warranting prompt patching per federal directive BOD 26-04.

MCP-for-Stata, an MCP server that lets AI agents drive Stata, fails to sanitize the log_file_name parameter before interpolating it into a Stata command string. An attacker (or a compromised upstream agent) can craft a malicious log_file_name to inject arbitrary Stata commands such as shell, python, or erase, achieving code execution on the host running the MCP server. The issue is patched in version 1.17.3.

The mcp-webresearch MCP server's visit_page tool fails to filter private, loopback, or cloud metadata IP ranges before directing its Playwright browser to fetch a URL. An attacker who can influence the LLM's tool arguments (e.g., via prompt injection from a webpage the agent reads) can redirect the server to internal endpoints like cloud metadata services, leaking sensitive internal data or credentials into the model's context.

Researchers identified roughly 7,600 malicious GitHub repositories, with over 800 masquerading as AI 'skills' or Model Context Protocol (MCP) servers, used to distribute the SmartLoader malware family in a campaign dubbed FakeGit. The attackers use copied projects, lookalike developer profiles, convincing READMEs, and malicious ZIP downloads to trick developers into executing malware, exploiting growing trust in AI/MCP tooling as a lure.

NextCRM's MCP server exposes product catalog management tools (create, update, archive, delete) without enforcing the same role-based restrictions applied to the normal web application. Any authenticated low-privileged user who can obtain an MCP Bearer token can tamper with the shared CRM product catalog, an action normally reserved for managers and admins. This is a broken access control flaw surfaced through an agent-facing tool interface, not a novel AI-specific attack.

AgenticMail's task API let any authenticated low-privileged agent enumerate and hijack tasks belonging to other agents by guessing/looking up their names and task IDs. This breaks the intended per-agent task isolation, allowing one agent to claim, complete, or fail work assigned to another. The vendor fixed this in version 0.9.64.

AgenticMail, a platform that gives AI agents real email addresses and phone numbers, contained a cluster of validation and security-control weaknesses across its API and core packages. These include SQL identifier injection risks, insufficient SMTP header/envelope sanitization enabling command injection, fail-open secret handling, and TLS verification defaulting incorrectly in some configurations. Combined, these flaws could let an attacker manipulate agent-controlled email infrastructure, access or corrupt storage metadata, inject SMTP commands, or intercept traffic via weakened TLS defaults.

nono, a sandboxing framework for running AI agents with reduced privileges, failed to block access to local Unix domain sockets prior to version 0.55.0. This allowed a sandboxed AI agent to reach the per-user systemd D-Bus socket and escape the intended isolation boundary, potentially gaining broader system access than intended. Users should upgrade to 0.55.0 immediately.

Network-AI's MCP SSE server ships with an empty default authentication secret, meaning every request is treated as authorized regardless of whether an Authorization header is present. Combined with a wildcard CORS policy on all responses, this lets a malicious webpage silently invoke any of the 22 exposed MCP tools on a victim's local server, including spawning agents and writing to shared blackboard state. This is a classic drive-by CSRF-style attack against a locally running privileged agent orchestrator.

The WhatsApp MCP server's local bridge API (port 8080) had no authentication, no Host header validation, and allowed arbitrary file paths in message attachments. This let any local process, sibling MCP server, or even a malicious webpage (via DNS rebinding) send WhatsApp messages as the paired user and exfiltrate sensitive local files like SSH keys as WhatsApp attachments. It is fixed in v0.2.1 with bearer token auth, host allow-listing, and path confinement.

Hugging Face disclosed a security incident it attributes to an autonomous AI agent conducting an intrusion end-to-end, and a separate report describes 'JADEPUFFER,' an alleged agent-driven ransomware capable of real-time adaptation. Both reports indicate a shift toward AI systems autonomously executing attack chains, but the JADEPUFFER report lacks victim identification and methodology transparency, limiting verifiability. Severity is high due to the plausibility and real-world implications of autonomous offensive agents, but confidence is tempered by sparse technical detail in the secondary source.

Hugging Face disclosed that an autonomous AI agent was used to breach its production infrastructure, resulting in unauthorized access to internal datasets and credentials. The incident is notable because the attack vector was an AI agent operating with some degree of autonomy rather than a purely manual intrusion, highlighting real-world risk of agentic systems being weaponized against AI platform infrastructure. Details remain limited, as the source article is truncated and lacks technical specifics on the agent's tooling or exploitation method.

NadMesh is a Go-based botnet that scans the internet for unauthenticated, publicly exposed AI infrastructure (ComfyUI, Ollama, n8n, Open WebUI, Langflow, Gradio) and abuses them to harvest cloud credentials, including a claimed 3,811 unique AWS keys, as well as Kubernetes tokens. This is not an attack on agent reasoning or protocols themselves, but exploitation of poor deployment hygiene around AI tooling that teams stand up quickly without adequate authentication or network controls. Severity is high because successful compromise yields direct cloud/infrastructure takeover, not just AI misuse.

ForgeCode, an AI pair-programming CLI, automatically parses and executes MCP server configurations from a repository's .mcp.json file without any user confirmation. A malicious or compromised repository can embed arbitrary OS commands in this file, achieving code execution with the developer's privileges the moment they run forge inside the cloned repo. This turns routine repository evaluation into a reliable initial-access vector for supply-chain attacks against developers.

IBM Langflow OSS versions 1.0.0 through 1.10.0 contain a vulnerability allowing an authenticated attacker to read arbitrary files on the host, including the JWT signing key used to issue authentication tokens. With this key, an attacker can forge valid tokens and impersonate any user, effectively bypassing authentication controls within the Langflow agent-building platform.