Framework Vulnerabilities

IBM Langflow, an open-source framework used to build AI agent and LLM workflows, contains a path traversal flaw in versions 1.0.0 through 1.10.1. A remote, unauthenticated attacker can craft a URL request with '../' sequences to read arbitrary files on the host system, potentially exposing credentials, API keys, or configuration data used by connected agents and tools.

Updated Jul 31, 2026 · CVSS 7.5

IBM Langflow OSS versions 1.0.0 through 1.10.1 contain an improper access control flaw that lets authenticated users view and manipulate other users' agent flow build jobs and logs, and exposes some build endpoints without authentication at all. This is a genuine vulnerability with a moderate-high CVSS score (7.1), primarily impacting confidentiality and integrity of multi-tenant Langflow deployments rather than enabling remote code execution directly.

Updated Jul 30, 2026 · CVSS 7.1

Pydantic AI's protection against SSRF to cloud metadata endpoints can be bypassed when an application allows local/private URL downloads, because the IP blocklist fails to recognize IPv6-encoded forms (IPv4-mapped, 6to4, NAT64) of metadata service addresses. On dual-stack or NAT64-translated networks, this lets an attacker-controlled URL reach the cloud metadata service and potentially steal short-lived IAM credentials. This only affects apps that explicitly opt into 'force_download=allow-local' on URLs influenced by untrusted input; the issue has been patched in version 1.99.0.

Updated Jul 30, 2026 · CVSS 6.8

A REST endpoint in the n8n workflow automation platform is registered before authentication middleware is applied, letting any unauthenticated network caller cancel another user's active test webhook if they know the workflow ID. The impact is limited to disrupting in-progress test sessions; production webhooks and stored data are unaffected. This is a low-complexity availability/harassment issue rather than a data breach or compromise vector.

Updated Jul 23, 2026

n8n's JavaScript task runner shared a single module cache across all users' Code-node executions on the same instance, allowing one user to poison a cached module and affect other users' automations. This is a multi-tenant isolation failure rather than a sandbox escape or remote code execution, but it can compromise confidentiality, integrity, or availability of other tenants' workflow logic.

Updated Jul 23, 2026

n8n's HTML preview feature renders workflow output into an iframe without a sandbox attribute, allowing a sanitizer bypass to execute attacker-controlled script in the same origin as the editor. Since n8n orchestrates automated workflows and often integrates with AI agents and external data sources, this could let an attacker with low-privilege access (global:member) hijack an authenticated user's session to call privileged APIs. The vendor has released patched versions and interim mitigations via CSP hardening.

Updated Jul 22, 2026

n8n's Resource Locator UI passes a workflow-persisted URL field (cachedResultUrl) directly into window.open() without validating the URI scheme, allowing a malicious workflow to execute attacker-controlled JavaScript in a victim's browser when they interact with a crafted link. This is a stored XSS issue in the n8n web application rather than a direct compromise of an AI agent's reasoning, but since n8n is widely used to orchestrate AI/LLM agent workflows, exploitation could let an attacker pivot from the browser context into workflow credentials, connected integrations, or agent control surfaces. Official patches are available (1.123.64, 2.29.8, 2.30.1).

Updated Jul 22, 2026

n8n, a workflow automation platform commonly used to orchestrate AI agent and API integrations, incorrectly embedded the full PEM private key of a Google Service Account inside the 'kid' field of a JWT header instead of a key identifier. Because JWT headers are only Base64-encoded (not encrypted), any system that logged, proxied, or inspected these tokens could recover the private key and impersonate the service account against Google Cloud resources. This is a genuine credential-exposure vulnerability with a clear patch, not a novel agentic-AI attack technique, but it is highly relevant to agent pipelines that rely on n8n for tool/API orchestration.

Updated Jul 22, 2026

CISA added four actively exploited vulnerabilities to its KEV Catalog, one of which (CVE-2026-0770) affects Langflow, a framework used to build AI agent/LLM workflows, involving inclusion of functionality from an untrusted control sphere. The other three CVEs concern DD-WRT and WordPress and are unrelated to AI agent infrastructure. This is a legitimate, actively exploited vulnerability disclosure relevant to organizations running Langflow-based agent pipelines, warranting prompt patching per federal directive BOD 26-04.

Updated Jul 22, 2026

AgenticMail, a platform that gives AI agents real email addresses and phone numbers, contained a cluster of validation and security-control weaknesses across its API and core packages. These include SQL identifier injection risks, insufficient SMTP header/envelope sanitization enabling command injection, fail-open secret handling, and TLS verification defaulting incorrectly in some configurations. Combined, these flaws could let an attacker manipulate agent-controlled email infrastructure, access or corrupt storage metadata, inject SMTP commands, or intercept traffic via weakened TLS defaults.

Updated Jul 21, 2026 · CVSS 8.2

nono, a sandboxing framework for running AI agents with reduced privileges, failed to block access to local Unix domain sockets prior to version 0.55.0. This allowed a sandboxed AI agent to reach the per-user systemd D-Bus socket and escape the intended isolation boundary, potentially gaining broader system access than intended. Users should upgrade to 0.55.0 immediately.

Updated Jul 21, 2026 · CVSS 6.1

Langflow's APIRequest component, when its 'Save to File' feature is enabled, trusts filenames supplied by an external HTTP server's Content-Disposition header without sanitizing them. A malicious or compromised remote endpoint can inject path traversal sequences to write arbitrary files outside the intended temporary directory, potentially leading to full remote code execution on the host running the agent flow.

Updated Jul 20, 2026 · CVSS 9.9

IBM Langflow versions 1.0.0 through 1.10.0 contain a vulnerability allowing remote code execution due to incomplete validation of MCP server configuration files. An attacker who can supply or modify an MCP server config could execute arbitrary code on the Langflow host, fully compromising the agent runtime and any connected tools or data.

Updated Jul 18, 2026 · CVSS 8.8

Langflow, an open-source framework used to build AI agent workflows, contains a server-side request forgery vulnerability caused by weak default configuration and incomplete SSRF protections. An attacker could exploit this to make the Langflow server issue unauthorized requests to internal or cloud-metadata endpoints, potentially exposing sensitive infrastructure or credentials. This is a genuine, credibly documented vulnerability (CVSS 7.7) rather than a speculative or low-quality report.

Updated Jul 18, 2026 · CVSS 7.7

IBM Langflow, an open-source visual builder for AI agent workflows, contains a path traversal flaw where a malicious flow can fetch attacker-controlled content and write it to arbitrary paths on the server via a crafted Content-Disposition header. An authenticated attacker can abuse this to overwrite configuration, code, or scheduled/startup files, likely leading to full compromise of the Langflow instance. This is a serious framework-level vulnerability requiring only low-privilege authenticated access.

Updated Jul 18, 2026 · CVSS 8.8

Langflow, a widely used low-code framework for building AI agent workflows, ships with an AUTO_LOGIN feature enabled by default that issues long-lived superuser bearer tokens to any unauthenticated network requester hitting a specific login endpoint. Combined with permissive CORS settings, this allows a remote attacker with no credentials to obtain full administrative control over the Langflow instance, including any agents, flows, and connected tools/credentials it manages. This is a critical, actively exploitable misconfiguration in a default deployment rather than a subtle logic flaw.

Updated Jul 18, 2026 · CVSS 9.8

A concurrency flaw in IBM Cognos Analytics' Agentic AI assistant causes incorrect report summaries or processing failures when multiple authenticated users submit report tasks at the same time. This is a reliability/integrity bug rather than an exploitable attacker-controlled takeover primitive, though it could be leveraged to degrade service or corrupt report outputs relied on for decision-making.

Updated Jul 18, 2026 · CVSS 5.4

LangChain4j's MariaDB and pgvector embedding store integrations build SQL queries by unsafely concatenating metadata filter keys (and MariaDB string values) into query strings, allowing an attacker who controls filter input to inject SQL. This can lead to blind data exfiltration, denial of service, and mass deletion of vector store data via crafted EmbeddingSearchRequest filters.

Updated Jul 11, 2026 · CVSS 7.6

This is an academic survey (SoK) that reviews and categorizes 39 existing papers on execution-layer security for AI coding agents, rather than describing a novel exploit or active campaign. It highlights systemic weaknesses across the field—such as high denylist bypass rates, unaddressed TOCTOU races, and fragmented treatment of MCP threats—and references four previously disclosed, already-patched CVEs. Severity is low-to-medium as a direct threat signal since no new vulnerability or attack technique is disclosed; its value is as a roadmap of known/likely weak points defenders should prioritize.

Updated Jul 8, 2026

CISA added three actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, including CVE-2026-55255, an authorization bypass in Langflow, a popular framework for building AI/LLM agent workflows. This is relevant to AI agent security because Langflow is used to construct agentic pipelines, and an authorization bypass could let attackers manipulate or hijack agent flows, credentials, or connected tools. The other two CVEs (JoomShaper and Joomlack) are unrelated CMS plugin vulnerabilities with no agentic relevance.

Updated Jul 8, 2026