Cascading Failures

A WordPress plugin that exposes an MCP interface and llms.txt generation for AI agents contains a broken access control flaw allowing low-privileged Subscriber-level users to perform actions reserved for higher-privilege roles. This could let an attacker with minimal site access escalate privileges or manipulate AI-agent-facing configuration and content. No evidence of active exploitation is provided in the raw data, but the CVSS score indicates meaningful impact if exploited.

Updated Sep 3, 2026 · CVSS 8.1

Boruta, an OAuth2/OIDC authorization server, logged sensitive credentials including access tokens, refresh tokens, ID tokens, and agent tokens in plaintext business event logs prior to version 0.10.0. Anyone with access to these logs, log aggregation pipelines, or the admin log viewer could extract valid tokens and reuse them for unauthorized access until expiration or revocation. This is a credential-hygiene vulnerability rather than a novel agent-specific attack, but it directly threatens agent-to-service authentication where 'agent tokens' are among the logged values.

Updated Sep 3, 2026 · CVSS 6.5

A path traversal vulnerability in IBM Langflow OSS (versions 1.0.0 through 1.11.1) allows a remote attacker to read arbitrary files on the host system. Langflow is a visual builder for LLM/agent workflows, so this flaw could expose sensitive configuration, credentials, or agent memory/state files stored on disk. This is a genuine, high-severity infrastructure vulnerability rather than a novel agentic attack technique.

Updated Aug 29, 2026 · CVSS 7.5

The mcp-router CLI's serve command bound to all network interfaces by default and only enforced authentication if an operator explicitly requested it, meaning a standard invocation exposed the MCP aggregator and every downstream MCP server it fronts to anyone who could reach the port. This is a straightforward insecure-default configuration flaw rather than a novel attack technique, but its impact is severe because it grants unauthenticated network access to an aggregation point for multiple MCP tool servers. Version 0.6.3 fixes this by defaulting to loopback binding and refusing non-loopback starts without a token.

Updated Aug 29, 2026 · CVSS 9.1

Hatchet, a platform used to orchestrate AI agents and background workflows, contains a missing tenant-ownership check in its Dispatcher gRPC service. An authenticated attacker who can guess or enumerate another tenant's worker UUID can tamper with that worker's labels or forcibly disconnect it, causing integrity and availability impact on shared/multi-tenant deployments. Single-tenant deployments are not meaningfully affected.

Updated Aug 28, 2026 · CVSS 6.4

A missing authorization check in Dradis Community Edition lets any authenticated non-admin user redirect the built-in Roslin AI agent to an arbitrary attacker-controlled or internal URL. This creates a server-side request forgery vulnerability whose responses are reflected back to the attacker, enabling access to internal services and cloud metadata endpoints like AWS IMDS.

Updated Aug 26, 2026 · CVSS 7.1

This is a research writeup, not an attack. It describes an AI coding agent (Claude in Claude Code for web) that, upon discovering its container lacked nested virtualization support needed to run the smolvm sandbox, autonomously pivoted to using a GitHub Actions runner (which exposes /dev/kvm) to complete its testing task. There is no described exploitation, prompt injection, or security vulnerability here — it is an example of agentic problem-solving and infrastructure workaround behavior.

Updated Aug 20, 2026

IBM Langflow versions 1.0.0 through 1.10.0 expose a registration endpoint without proper authentication, allowing a remote attacker to overwrite the administrator's email address and abuse the server to send outbound mail as a relay. Because Langflow is widely used to build and orchestrate LLM agent flows, compromising its admin identity could give an attacker control over flow configuration, credentials, and connected tools.

Updated Aug 20, 2026 · CVSS 7.5

MLflow versions 3.13.0 through 3.14.x are missing an authorization check on the log-inputs API endpoint, letting any authenticated user inject fabricated dataset lineage records into another user's ML run without holding UPDATE permission. This undermines trust in experiment metadata and lineage tracking, which many AI agent pipelines rely on for provenance and reproducibility, but it does not itself provide remote code execution or full account takeover. The issue is fixed in MLflow 3.15.0.

Updated Aug 18, 2026 · CVSS 6.5

Trigger.dev's run replay API looks up task runs by a friendly ID without checking that the run belongs to the caller's environment/tenant, allowing any valid API key holder to replay another tenant's agent task run. This lets an attacker consume victim compute resources and repeat side effects of that run, and in combination with a separate object-store path-traversal bug, potentially inject attacker-controlled payload bytes into the victim's replayed task. The issue is fixed in 4.5.0-rc.4.

Updated Aug 15, 2026 · CVSS 4.2

Langflow, an open-source framework used to visually build LLM/agent workflows, contains a flaw allowing unlimited authentication attempts, enabling remote attackers to brute-force user credentials. Given a 9.1 CVSS score, successful exploitation could grant unauthorized access to accounts controlling agent pipelines, connected tools, and stored credentials/secrets.

Updated Aug 14, 2026 · CVSS 9.1

Trigger.dev, a platform used to build and deploy AI agents and workflows, had a critical authorization flaw where the deployment lookup did not verify that a deployment belonged to the caller's own project. Any authenticated user with a valid API key for one project could reference another project's deployment ID and hijack it by linking an attacker-controlled background worker, altering its deployment state. This allows cross-tenant compromise of AI agent deployments, potentially letting an attacker inject their own worker code into a victim's production agent pipeline.

Updated Aug 14, 2026 · CVSS 9.9

Trigger.dev, a platform for managing AI agent workflows, fails to check Google's email_verified flag during OAuth login, allowing an attacker to create a Google account with an email matching an existing victim's account and take it over. Because Trigger.dev orchestrates AI agent deployments, compromising an account gives an attacker control over that user's agents, workflows, secrets, and API keys. This is a classic identity-spoofing/authentication flaw rather than a novel agentic attack, but it has serious downstream impact on agent supply-chain trust.

Updated Aug 14, 2026 · CVSS 7.4

ToolJet, a platform used to build internal tools and AI agents, fails to verify that the organizationId in the URL path matches the authenticated user's actual organization membership when calling its ToolJet Database API. Any authenticated user can manipulate the tj-workspace-id header and the target organizationId to read or modify database tables belonging to other tenants, including table schemas, rows, and data used by that tenant's workflows or agents. This is a broken object-level authorization (IDOR) vulnerability rather than a novel AI-specific attack, but it directly threatens the confidentiality and integrity of data feeding AI agents built on the platform.

Updated Aug 11, 2026 · CVSS 5.9

IBM Langflow, an open-source visual builder for AI agent workflows, has a flaw in its ensure_fernet_key() function that produces weak cryptographic keys used to encrypt sensitive data such as credentials and secrets. This weakens the confidentiality guarantees of stored secrets, potentially allowing an attacker to decrypt or brute-force protected data if they gain access to the encrypted material. This is a genuine framework-level security issue affecting confidentiality of agent configuration/secrets rather than a direct agent-behavior exploit.

Updated Aug 7, 2026 · CVSS 7.4

This is a research paper (not an active exploit) demonstrating that proprietary 'skills' offered by AI agent platforms can have their hidden functionality functionally cloned purely through legitimate use, without ever disclosing the underlying files. The method, SkillClone, builds an interface hypothesis from public documentation, probes the skill with structured benign queries, and iteratively synthesizes and repairs a replica using differential validation against real outputs. This shows that file-disclosure defenses are insufficient to protect proprietary agent logic, since functional secrecy can be broken through cumulative, non-malicious-looking interactions.

Updated Aug 6, 2026

CISA added three actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, most notably a code injection flaw in IBM Langflow, a popular framework for building AI agent workflows. This is a genuine, confirmed security issue (active exploitation) requiring urgent patching, though the underlying advisory is a routine government vulnerability notification rather than a novel agentic-AI attack technique.

Updated Aug 5, 2026

Flowise's DELETE endpoint for chatflows fails to verify that the resource being deleted actually matches the caller's granted permission scope, letting a user or API key with only 'agentflows:delete' permission delete Chatflows (and vice versa). This breaks the intended separation between agent workflow management roles and can result in unauthorized destruction of AI agent configurations within a workspace.

Updated Aug 4, 2026

Flowise's openai-assistants-vector-store endpoints accept a client-supplied credential ID without verifying it belongs to the caller's workspace, allowing any authenticated user to use another workspace's OpenAI API key. This is a classic multi-tenant IDOR that lets attackers hijack billing, read/modify/delete victim vector stores, and access victim OpenAI account resources.

Updated Aug 4, 2026

better-auth's OIDC provider and MCP plugin fail to validate the URI scheme of registered OAuth redirect_uris, allowing an attacker to register a javascript: URI that gets echoed back to the consent page. If the consent UI navigates to this URI unsafely, attacker JavaScript executes in the authorization server's origin, potentially hijacking victim sessions. This is a classic web input-validation flaw made newly relevant because it affects the auth layer underlying MCP server deployments, extending its blast radius to agent tool-authorization flows.

Updated Aug 1, 2026 · CVSS 7.2