Agentic Supply Chain Vulnerabilities

This is an academic research paper (not an active exploit) that formalizes a threat model for multi-agent LLM delegation and empirically shows that popular agent frameworks (LangGraph, CrewAI, AutoGen) and the MCP authorization model lack proper confinement, allowing a prompt-injected agent or compromised sub-agent to exceed its delegated authority. The paper also proposes and validates an authorization broker as a mitigation. Severity is medium because it describes a systemic design gap rather than a live exploit, but the underlying issue (broad bearer credentials plus in-model authorization) is a real and widely applicable weakness.

Updated Sep 2, 2026

MCPHub, a hub for managing multiple MCP servers, fails to sanitize the manifest.json 'name' field when extracting uploaded MCPB (zip) files, allowing an attacker to use path traversal sequences to write files outside the intended extraction directory. The same unsanitized field is also used during cleanup, enabling arbitrary directory deletion. This lets a malicious MCP server package achieve file system compromise on the host running MCPHub, potentially leading to code execution or destructive data loss.

Updated Sep 1, 2026

A vulnerability in GitLab's AI Gateway allowed an authenticated user with access to the Duo Agent Platform to redirect model inference requests to an attacker-controlled endpoint by crafting model metadata. This could leak sensitive Google Vertex AI or AWS Bedrock cloud service credentials to the attacker's server. GitLab has already remediated the issue in patched versions.

Updated Aug 27, 2026 · CVSS 8.2

Researchers at Oasis Security found that a malicious webpage can reach an unauthenticated local Ollama instance running behind NVIDIA NemoClaw and use it to implant hidden instructions into the AI model itself. This effectively lets a remote attacker who only controls a webpage a victim visits achieve persistent, unauthenticated tampering with a locally hosted AI agent's behavior.

Updated Aug 26, 2026

The 'AI Agent by SiteGround' WordPress plugin fails to verify the upload_files capability on a media upload endpoint tied to its AI/Gutenberg block editor features, allowing low-privileged Contributor-level accounts to upload arbitrary images to the media library despite normally lacking that permission. This is a classic broken access control flaw in a plugin's admin-ajax/REST handler rather than an attack on the AI model or agent reasoning itself, and requires authenticated access at Contributor level or above.

Updated Aug 20, 2026 · CVSS 5.3

MLflow's model registry fails to properly validate ownership when creating a model version linked to a run_id or model_id, only checking path containment rather than authorization. This lets any authenticated user reference another user's artifact directory and read private files via the artifact-get API, bypassing READ permission checks.

Updated Aug 18, 2026 · CVSS 7.1

Trigger.dev, a platform for managing AI agent workflows, contains a path traversal vulnerability in its packet/object-store signing logic that lets an authenticated caller with any valid environment API key generate presigned URLs pointing into other tenants' storage. This allows reading or overwriting another tenant's task payloads, breaking tenant isolation. The vendor has fixed this in 4.5.0-rc.5.

Updated Aug 15, 2026 · CVSS 8.2

This is a defensive research paper (not an active exploit) describing RAG-IDS, a multi-agent intrusion detection framework that mitigates knowledge-base poisoning and prompt-injection attacks against RAG-based network flow classifiers. The paper reports strong empirical recovery of classification performance under simulated attacks, indicating a proactive defense contribution rather than a newly disclosed vulnerability or active threat. Severity is low because this describes mitigation research, not a real-world exploit or vulnerable deployed system.

Updated Aug 11, 2026

This is a research paper (not an active exploit) that benchmarks static analysis techniques against malicious 'Agent Skills' — installable instruction/script packages for LLM agents. The authors show static analysis catches data exfiltration and steganographic payloads well but completely misses host-destruction attacks using common shell commands and largely misses natural-language prompt injection, highlighting a real supply-chain detection gap for agent skill marketplaces.

Updated Aug 11, 2026

A vulnerability in Amazon Strands Agents Tools allows an authenticated user to manipulate the LLM into calling memory-management tools with a forged namespace parameter, letting them read, modify, or delete another tenant's stored memories. This is an insecure direct object reference (IDOR) bug affecting the mongodb_memory, elasticsearch_memory, and mem0_memory tool integrations before version 0.8.3. It poses a serious confidentiality and integrity risk in any multi-tenant deployment of these agent tools.

Updated Aug 7, 2026 · CVSS 8.1

This is an academic measurement study analyzing how MCP server registry descriptions change over time, not an active exploit or vulnerability disclosure. The paper argues that ranking servers by past drift for re-auditing is an ineffective way to keep security audits current, since most description changes come from new server arrivals rather than previously observed servers. The practical takeaway is a scanner-hygiene recommendation (hash-based revalidation plus periodic full sweeps), not a runtime trust or security flaw in MCP itself.

Updated Aug 6, 2026

IBM Langflow's implementation of the MCP resources/read request fails to sanitize file paths, allowing an attacker to use URL-encoded path traversal sequences to read arbitrary files on the server. This exposes sensitive data including other users' uploaded documents, the JWT signing secret, the SQLite database, and environment variables, which could enable full account takeover or further compromise.

Updated Aug 5, 2026 · CVSS 6.5

Flowise's text-to-speech generation endpoint is whitelisted to bypass authentication and fails to verify whether the referenced chatflow is public, allowing anyone who knows or guesses a chatflow UUID to invoke that chatflow's stored OpenAI or ElevenLabs credential. This lets an unauthenticated attacker generate unlimited TTS audio at the chatflow owner's expense, resulting in financial abuse and indirect credential misuse. This is a genuine broken-access-control vulnerability in an AI agent orchestration platform, not a prompt injection or model-level attack.

Updated Aug 5, 2026

Flowise's OAuth2 credential refresh endpoint is exempt from authentication, allowing anyone who knows or guesses a credential ID to force the server to refresh and return a live OAuth access token for that connected third-party account. This lets attackers hijack victims' Google, Microsoft, GitHub, or other integrated service access without any login, and can also be abused to exhaust refresh token quotas as a denial-of-service.

Updated Aug 5, 2026

Flowise's OAuth2 credential endpoints (authorize, callback, refresh) look up credentials by ID alone without checking workspace ownership, and two of these endpoints are fully unauthenticated. This lets any authenticated user access other workspaces' OAuth2 client metadata, and lets any unauthenticated attacker forge callbacks to inject tokens into or refresh tokens for arbitrary credentials. Since these credentials are used by Flowise's AI agents to authenticate to third-party tools and APIs, the flaw effectively lets attackers hijack the external identities and permissions of agents belonging to other tenants.

Updated Aug 4, 2026

This is an academic measurement study of the official MCP registry, not an active exploit or vulnerability disclosure. The researchers show that periodic, drift-ranked re-auditing of server descriptions poorly covers actual description changes over time, and recommend content-hash-based revalidation instead. No attack technique, malicious payload, or exploited weakness is described.

Updated Aug 4, 2026

Ouroboros, a local-first runtime for AI coding agents, blindly trusts a .env file found in the current working directory to configure execution-critical CLI backend paths. A malicious repository can set a variable like OUROBOROS_CLI_PATH to point at an attacker-controlled script, which then executes automatically when the victim runs basic Ouroboros commands. This is a classic untrusted-repository-triggers-code-execution supply chain flaw, fixed in version 0.39.0.

Updated Aug 4, 2026

IBM Langflow OSS fails to enforce per-user isolation of Chroma vector store collections, allowing any authenticated attacker to guess or reuse another user's persist_directory and collection_name to read their private documents. The same flaw lets an attacker write poisoned documents into the victim's namespace, corrupting the data that victim's RAG workflows retrieve on. This is a straightforward multi-tenancy authorization failure rather than a novel agentic exploit, but it directly compromises confidentiality and integrity of agent memory.

Updated Jul 31, 2026 · CVSS 8.1

IBM Langflow, an open-source framework used to build AI agent/LLM workflows, contains two broken access control flaws in its file handling API. One endpoint allows completely unauthenticated retrieval of image files tied to any flow, while another allows authenticated users to access other users' files via an IDOR, breaking tenant isolation in multi-user deployments. This can expose sensitive data stored within private agent flows.

Updated Jul 31, 2026 · CVSS 6.5

Pydantic AI's UI adapters (e.g., the Vercel AI adapter) accept client-submitted message history containing 'UploadedFile' references, such as S3/GCS URIs or provider file IDs, without validating that the requesting client should have access to them. Because the server resolves these references using its own privileged credentials (IAM role, service account, or API key), an attacker who can guess or obtain a valid file identifier can trick the server into reading files it should not have access to on the attacker's behalf, including data belonging to other tenants. This is a classic confused-deputy vulnerability affecting a widely used Python agent framework, fixed in versions 1.106.0 and 2.0.0b6.

Updated Jul 30, 2026 · CVSS 6.8