Privilege Abuse

A WordPress plugin that exposes an MCP interface and llms.txt generation for AI agents contains a broken access control flaw allowing low-privileged Subscriber-level users to perform actions reserved for higher-privilege roles. This could let an attacker with minimal site access escalate privileges or manipulate AI-agent-facing configuration and content. No evidence of active exploitation is provided in the raw data, but the CVSS score indicates meaningful impact if exploited.

Updated Sep 3, 2026 · CVSS 8.1

This is an academic research paper (not an active exploit) that formalizes a threat model for multi-agent LLM delegation and empirically shows that popular agent frameworks (LangGraph, CrewAI, AutoGen) and the MCP authorization model lack proper confinement, allowing a prompt-injected agent or compromised sub-agent to exceed its delegated authority. The paper also proposes and validates an authorization broker as a mitigation. Severity is medium because it describes a systemic design gap rather than a live exploit, but the underlying issue (broad bearer credentials plus in-model authorization) is a real and widely applicable weakness.

Updated Sep 2, 2026

MCPHub, a multi-tenant hub for orchestrating MCP servers, failed to enforce ownership checks on its tool-execution API even though it correctly scoped list and config views. Any authenticated non-admin user could invoke tools on MCP servers owned by other tenants, leading to cross-tenant compromise including arbitrary host file reads and SSRF using another user's connected credentials. The issue is fixed in version 1.0.30.

Updated Sep 1, 2026 · CVSS 7.7

MCPHub, a management hub for MCP servers, fails to restrict server configuration endpoints to admin users and does not sanitize the command/args used to spawn MCP server processes. Any authenticated non-admin user can register a malicious MCP server configuration that MCPHub immediately executes, resulting in full remote code execution as the host's OS user, often root. This is a critical, easily exploitable authorization flaw with a severe real-world impact.

Updated Sep 1, 2026 · CVSS 9.9

MCPHub, a management hub for multiple MCP servers, contains a flawed authorization check that lets a bearer key scoped to one specific MCP server gain access to every other server in the same group. Any credential holder with narrow, single-server authorization can silently pivot to unauthorized MCP servers, effectively breaking the tool/server isolation model the hub is meant to enforce. This was fixed in version 1.0.31.

Updated Sep 1, 2026 · CVSS 8.1

MCPHub, a centralized hub for orchestrating multiple MCP servers, contained a broken access control flaw where any authenticated user could modify system-wide configuration via the PUT /api/system-config endpoint, since the handler never checked admin privileges. This allows a low-privileged user to reconfigure routing to MCP servers, potentially redirecting agent traffic, disabling security controls, or hijacking tool orchestration across the hub. The issue is fixed in version 1.0.29.

Updated Sep 1, 2026 · CVSS 8.8

MCPHub prior to version 1.0.32 fails to enforce admin-only access on prompt and resource management endpoints, allowing any authenticated non-admin user to create, overwrite, or shadow globally-served prompt templates and resources. Because these tampered records are consulted before any connected MCP server for every session, the flaw enables stored prompt injection into other users' LLM sessions. The issue is patched in 1.0.32.

Updated Sep 1, 2026 · CVSS 7.1

IBM Langflow OSS versions 1.0.0 through 1.11.1 contain an improper authorization flaw that lets any authenticated user execute or read another user's private flows. This is a classic access-control bug in an agent-orchestration framework rather than a novel agentic attack technique, but it can expose proprietary prompts, credentials embedded in flows, and business logic, or allow unauthorized execution of another tenant's automation.

Updated Aug 29, 2026 · CVSS 6.4

Hatchet, a platform used to orchestrate AI agents and background workflows, contains a missing tenant-ownership check in its Dispatcher gRPC service. An authenticated attacker who can guess or enumerate another tenant's worker UUID can tamper with that worker's labels or forcibly disconnect it, causing integrity and availability impact on shared/multi-tenant deployments. Single-tenant deployments are not meaningfully affected.

Updated Aug 28, 2026 · CVSS 6.4

A flaw in the Omnigent AI agent framework allows a user with only edit access to their own session to tamper with a shared or template agent that isn't properly bound to that session, injecting a malicious stdio MCP server configuration. When other sessions later reuse the poisoned shared agent, attacker-controlled commands execute with the full permissions of the Omnigent runner process, exposing files, credentials, and internal services. This is a critical broken-authorization vulnerability with a CVSS score of 9.0, fixed in version 0.3.0.

Updated Aug 22, 2026 · CVSS 9

LangBot, an LLM-based IM bot platform, allows any authenticated user to configure a STDIO MCP server, which the backend uses to launch an arbitrary subprocess with server-level privileges. This means a low-privileged account holder can achieve full remote code execution on the LangBot host, leading to data disclosure, tampering, and service disruption. No fix is currently available, making this a high-priority, actively exploitable weakness.

Updated Aug 20, 2026 · CVSS 8.8

This is a defensive research paper, not an active threat, describing a post-training method to reduce 'excess-authority' errors where tool-using LLM agents perform actions beyond what a task requires. The work proposes an auditing and reward framework to teach models task-conditioned least privilege in terminal and MCP environments, reporting significant reduction in excess-authority events. There is no vulnerability disclosure, exploit, or attack technique here; severity is low as it documents mitigation research rather than a genuine threat.

Updated Aug 20, 2026

The 'AI Agent by SiteGround' WordPress plugin fails to verify the upload_files capability on a media upload endpoint tied to its AI/Gutenberg block editor features, allowing low-privileged Contributor-level accounts to upload arbitrary images to the media library despite normally lacking that permission. This is a classic broken access control flaw in a plugin's admin-ajax/REST handler rather than an attack on the AI model or agent reasoning itself, and requires authenticated access at Contributor level or above.

Updated Aug 20, 2026 · CVSS 5.3

The Splunk AI Toolkit's Agent Run History feature improperly swaps a user's session token for a system-level authentication token when executing searches, letting low-privileged users run searches and access data as if they were admins. This also lets unprivileged users read or delete other users' search jobs. It is a classic broken access control flaw in an AI agent management feature rather than a novel agentic-AI attack technique.

Updated Aug 20, 2026 · CVSS 8.3

ArcadeDB's MCP server tool set_server_setting only checks a global allowAdmin flag rather than the calling user's actual role, allowing any authenticated read-only user to modify server-wide configuration when allowAdmin is enabled. This lets a low-privileged user tamper with GlobalConfiguration or trigger denial of service. The fix in 26.8.1 adds proper per-caller role enforcement.

Updated Aug 18, 2026 · CVSS 6.3

This is an academic research paper describing a defensive authorization architecture (Agentic Principal Chain) for multi-agent LLM systems, not an active exploit or newly disclosed vulnerability. It identifies a real architectural weakness class in agent systems—static, per-request permission checks that ignore session history—and proposes and validates a mitigation. No new attack technique, tool, or malicious campaign is disclosed here.

Updated Aug 18, 2026

MLflow's model registry fails to properly validate ownership when creating a model version linked to a run_id or model_id, only checking path containment rather than authorization. This lets any authenticated user reference another user's artifact directory and read private files via the artifact-get API, bypassing READ permission checks.

Updated Aug 18, 2026 · CVSS 7.1

MLflow versions 3.13.0 through 3.14.x are missing an authorization check on the log-inputs API endpoint, letting any authenticated user inject fabricated dataset lineage records into another user's ML run without holding UPDATE permission. This undermines trust in experiment metadata and lineage tracking, which many AI agent pipelines rely on for provenance and reproducibility, but it does not itself provide remote code execution or full account takeover. The issue is fixed in MLflow 3.15.0.

Updated Aug 18, 2026 · CVSS 6.5

MemOS, a memory operating system for LLM agents, contains a critical authentication bypass where an unset internal-service secret causes the system to treat any unauthenticated request as a trusted internal caller with full privileges. This allows remote attackers to mint admin API keys, generate master keys, and access all data and memory endpoints without credentials. The flaw is trivially exploitable and results in complete compromise of the memory layer underlying dependent AI agents.

Updated Aug 18, 2026 · CVSS 9.8

Trigger.dev, a platform for managing AI agent workflows, contains a path traversal vulnerability in its packet/object-store signing logic that lets an authenticated caller with any valid environment API key generate presigned URLs pointing into other tenants' storage. This allows reading or overwriting another tenant's task payloads, breaking tenant isolation. The vendor has fixed this in 4.5.0-rc.5.

Updated Aug 15, 2026 · CVSS 8.2