Agentic Supply Chain Vulnerabilities

The MCP Ruby SDK's HTTP transport failed to validate Host or Origin headers before version 0.23.0, allowing a malicious website to use DNS rebinding to reach a locally running MCP server from a victim's browser. This lets an attacker invoke tools exposed by the local MCP server without authorization, effectively bypassing the same-origin trust boundary that localhost services normally rely on.

Updated Jul 30, 2026

A vulnerability in IBM Langflow OSS (versions 1.0.0 through 1.10.1) allows an attacker to reuse another user's FAISS vector namespace, exposing owner-only embedded content and enabling persistent poisoning of future query results. This creates cross-user data leakage and an ongoing integrity risk in shared or multi-tenant Langflow deployments where vector stores back retrieval-augmented generation (RAG) agents.

Updated Jul 29, 2026 · CVSS 7.1

This is an academic research paper introducing a benchmark to evaluate how well tool-using LLM agents contain the effects of prompt injection after it occurs, rather than a description of an active exploit or vulnerability disclosure. It highlights that terminal 'no harm' outcomes can mask significant differences in taint propagation and lost legitimate functionality, which is a useful methodological insight for defenders rather than a new attack technique.

Updated Jul 28, 2026

A vulnerability in APIFold's auto-generated MCP server allows unauthenticated attackers to inject arbitrary JSON payloads via a webhook endpoint due to a missing signature validation configuration. These attacker-controlled payloads are stored and later served as trusted resource state to legitimate MCP clients, enabling a form of tool/data poisoning against downstream AI agents. The issue is fixed in a subsequent commit and requires no special access beyond knowledge of a server slug.

Updated Jul 23, 2026 · CVSS 5.3

A validation/runtime mismatch in n8n's workflow automation platform lets an authenticated user without the `externalSecret:list` permission smuggle external secret references into credential fields that bypass static checks but still resolve at execution time. This allows unauthorized users to indirectly exfiltrate secret values they should not have access to, undermining the platform's Advanced Permissions model. Severity is moderate since it requires authenticated access with credential-editing rights and a specific configuration (external secrets provider plus Advanced Permissions enabled).

Updated Jul 23, 2026

A vulnerability in n8n allows authenticated users with only project editor access to read plaintext external secrets by referencing them directly in node expressions, bypassing the intended secrets access permission model. This affects instances that have the external secrets feature configured, potentially exposing sensitive credentials to users who should not have access to them. The issue has been patched in n8n 2.27.4 and 2.28.1.

Updated Jul 23, 2026

n8n's GraphQL node failed to enforce the 'Allowed HTTP Request Domains' restriction that is applied to HTTP-based credentials, unlike its HTTP Request node counterpart. An authenticated user with workflow editing rights could exploit this gap to point the GraphQL node at an attacker-controlled server and exfiltrate credentials that were supposed to be domain-restricted. This is a moderate-severity authorization bypass affecting multi-tenant or shared-credential n8n deployments, fixed in recent releases.

Updated Jul 23, 2026

n8n workflows using LLM sub-nodes (OpenAI, Anthropic, Lemonade) with custom HTTP header credentials write those header values in plaintext into stored execution data, even though the n8n UI masks them. Any user with access to execution logs or exports can recover API keys and secrets, which may persist in the database well after the workflow run completes.

Updated Jul 23, 2026

n8n's JavaScript task runner shared a single module cache across all users' Code-node executions on the same instance, allowing one user to poison a cached module and affect other users' automations. This is a multi-tenant isolation failure rather than a sandbox escape or remote code execution, but it can compromise confidentiality, integrity, or availability of other tenants' workflow logic.

Updated Jul 23, 2026

This advisory is a withdrawn duplicate of GHSA-9r8p-h6cc-6qhm, describing an n8n bug where the full Google Service Account PEM private key was mistakenly written into the JWT header's 'kid' field instead of a key identifier. Since JWT headers are only Base64-encoded (not encrypted), anything that logs or inspects the token could recover the private key, allowing impersonation of the associated Google Cloud service account. Impact is limited to n8n instances configured with Google Service Account credentials, and the issue is fixed in versions 1.123.64, 2.29.8, and 2.30.1.

Updated Jul 22, 2026

CISA added four actively exploited vulnerabilities to its KEV Catalog, one of which (CVE-2026-0770) affects Langflow, a framework used to build AI agent/LLM workflows, involving inclusion of functionality from an untrusted control sphere. The other three CVEs concern DD-WRT and WordPress and are unrelated to AI agent infrastructure. This is a legitimate, actively exploited vulnerability disclosure relevant to organizations running Langflow-based agent pipelines, warranting prompt patching per federal directive BOD 26-04.

Updated Jul 22, 2026

Langflow, a widely used visual builder for LLM/agent workflows, contains a vulnerability allowing remote attackers to execute arbitrary code by including functionality from an untrusted control sphere. This has been added to CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild, with a very short remediation window (3 days from add date to due date). Because Langflow is often used to orchestrate AI agents and connect them to tools and data sources, compromise of the platform can lead to full takeover of downstream agent pipelines and connected systems.

Updated Jul 22, 2026

Researchers identified roughly 7,600 malicious GitHub repositories, with over 800 masquerading as AI 'skills' or Model Context Protocol (MCP) servers, used to distribute the SmartLoader malware family in a campaign dubbed FakeGit. The attackers use copied projects, lookalike developer profiles, convincing READMEs, and malicious ZIP downloads to trick developers into executing malware, exploiting growing trust in AI/MCP tooling as a lure.

Updated Jul 21, 2026

NextCRM's MCP server exposes product catalog management tools (create, update, archive, delete) without enforcing the same role-based restrictions applied to the normal web application. Any authenticated low-privileged user who can obtain an MCP Bearer token can tamper with the shared CRM product catalog, an action normally reserved for managers and admins. This is a broken access control flaw surfaced through an agent-facing tool interface, not a novel AI-specific attack.

Updated Jul 21, 2026 · CVSS 7.1

IBM Langflow, a popular open-source visual builder for LLM/agent workflows, ships with hard-coded credentials (password or cryptographic key) used for inbound authentication, outbound service communication, or internal data encryption. Because these secrets are static and embedded in the codebase across versions 1.0.0-1.10.1, any attacker who knows or extracts them can authenticate as a legitimate component, decrypt protected data, or impersonate trusted internal services. The maximum CVSS score of 9.8 reflects the potential for full compromise of confidentiality, integrity, and availability with low attack complexity and no privileges required.

Updated Jul 20, 2026 · CVSS 9.8

AWS HealthOmics MCP Server's linting tools failed to properly restrict pathnames, allowing an actor who can influence the MCP agent's workflow_files input to write attacker-controlled content outside the intended workflow bundle directory via directory traversal sequences. This is a classic path traversal vulnerability exposed through an MCP tool interface rather than a novel agent-specific attack, and is fixed in version 0.0.36.

Updated Jul 19, 2026 · CVSS 5.5

ForgeCode, an AI pair-programming CLI, automatically parses and executes MCP server configurations from a repository's .mcp.json file without any user confirmation. A malicious or compromised repository can embed arbitrary OS commands in this file, achieving code execution with the developer's privileges the moment they run forge inside the cloned repo. This turns routine repository evaluation into a reliable initial-access vector for supply-chain attacks against developers.

Updated Jul 19, 2026 · CVSS 7.8

IBM Langflow versions 1.0.0 through 1.10.0 contain a vulnerability allowing remote code execution due to incomplete validation of MCP server configuration files. An attacker who can supply or modify an MCP server config could execute arbitrary code on the Langflow host, fully compromising the agent runtime and any connected tools or data.

Updated Jul 18, 2026 · CVSS 8.8

Claude Code Action, prior to version 1.0.74, checked out attacker-controlled pull request branches and blindly loaded and enabled any MCP servers defined in a PR's .mcp.json file. This allowed an external attacker to open a malicious pull request that, once processed by the Claude Code action, achieved arbitrary code execution on the GitHub Actions runner and exfiltrated CI secrets such as API keys and tokens.

Updated Jul 18, 2026

The Apify MCP server's documentation-fetching tool checked allowed domains using a naive string prefix match instead of proper URL hostname parsing, letting an attacker craft URLs like docs.apify.com.evil.com to bypass the allowlist. This allows arbitrary attacker-controlled content to be fetched and returned to the LLM agent, which could then be used to inject malicious instructions or exfiltrate context. The issue was fixed in version 0.9.21.

Updated Jul 16, 2026 · CVSS 6.1