Privilege Abuse

Trigger.dev's run replay API looks up task runs by a friendly ID without checking that the run belongs to the caller's environment/tenant, allowing any valid API key holder to replay another tenant's agent task run. This lets an attacker consume victim compute resources and repeat side effects of that run, and in combination with a separate object-store path-traversal bug, potentially inject attacker-controlled payload bytes into the victim's replayed task. The issue is fixed in 4.5.0-rc.4.

Updated Aug 15, 2026 · CVSS 4.2

Trigger.dev, a platform used to build and deploy AI agents and workflows, had a critical authorization flaw where the deployment lookup did not verify that a deployment belonged to the caller's own project. Any authenticated user with a valid API key for one project could reference another project's deployment ID and hijack it by linking an attacker-controlled background worker, altering its deployment state. This allows cross-tenant compromise of AI agent deployments, potentially letting an attacker inject their own worker code into a victim's production agent pipeline.

Updated Aug 14, 2026 · CVSS 9.9

Cursor IDE's AI coding agent, when running in Auto-Run Sandbox mode on macOS with Docker Desktop and Dev Containers CLI installed, could launch a privileged container and mount the host's virtiofs0 filesystem without any additional user confirmation. This effectively let the sandboxed agent break out of its intended isolation, gaining read/write access to the user's home directory and host command execution with the user's privileges. The issue is fixed in Cursor 3.0.0.

Updated Aug 12, 2026

A vulnerability in Cursor IDE for macOS (prior to 3.1.2) allows an AI coding agent operating in Auto-Run Sandbox mode to break out of its sandbox by replacing a virtual environment's Python executable with a malicious wrapper. Because Microsoft's Python extension invokes this executable outside the sandbox, the agent can execute arbitrary commands with the user's full privileges, undermining the entire purpose of the sandboxed auto-run feature. This is a genuine, well-documented sandbox escape with a clear fix in 3.1.2.

Updated Aug 12, 2026

ToolJet, a platform used to build internal tools and AI agents, fails to verify that the organizationId in the URL path matches the authenticated user's actual organization membership when calling its ToolJet Database API. Any authenticated user can manipulate the tj-workspace-id header and the target organizationId to read or modify database tables belonging to other tenants, including table schemas, rows, and data used by that tenant's workflows or agents. This is a broken object-level authorization (IDOR) vulnerability rather than a novel AI-specific attack, but it directly threatens the confidentiality and integrity of data feeding AI agents built on the platform.

Updated Aug 11, 2026 · CVSS 5.9

Flowise's OpenAI Assistants integration fails to verify workspace ownership when looking up credentials by UUID, letting any authenticated user access credentials, assistant metadata, and file/vector store data belonging to other workspaces. Attackers can also upload files into victim workspaces, enabling both data theft and data poisoning across tenant boundaries. This is a critical multi-tenant isolation failure in an agent orchestration platform.

Updated Aug 7, 2026 · CVSS 9.9

The AWS Labs DocumentDB MCP Server before version 1.0.12 fails to properly enforce read-only mode when processing certain aggregation pipeline stages, allowing an authenticated MCP client to perform unintended write operations on the connected database. This is a logic flaw in authorization enforcement rather than a novel AI-specific attack, but it is significant because agents and LLM-driven clients often rely on the read-only flag as a safety boundary to prevent destructive actions. Exploitation requires an already-authenticated client, limiting severity, but the impact on data integrity could be substantial in agentic workflows that assume read-only guarantees.

Updated Aug 6, 2026 · CVSS 5.5

Authenticated users of IBM Langflow OSS (versions 1.0.0 through 1.10.3) can abuse a built-in component to read arbitrary server environment variables, bypassing controls meant to disable custom components. This can expose secrets such as API keys, database credentials, or other sensitive configuration data stored in the environment.

Updated Aug 5, 2026 · CVSS 6.5

Flowise, an AI agent/workflow orchestration platform, has a PUT endpoint for updating workflow execution records that lacks the authorization middleware present on its sibling GET and DELETE endpoints. Any authenticated user with a valid API key, even one with minimal permissions, can modify the state and data of any execution belonging to their workspace, enabling manipulation of agent workflow results and metadata.

Updated Aug 5, 2026 · CVSS 7.5

Flowise's text-to-speech generation endpoint is whitelisted to bypass authentication and fails to verify whether the referenced chatflow is public, allowing anyone who knows or guesses a chatflow UUID to invoke that chatflow's stored OpenAI or ElevenLabs credential. This lets an unauthenticated attacker generate unlimited TTS audio at the chatflow owner's expense, resulting in financial abuse and indirect credential misuse. This is a genuine broken-access-control vulnerability in an AI agent orchestration platform, not a prompt injection or model-level attack.

Updated Aug 5, 2026

Flowise's organization billing endpoints trust a client-supplied Stripe subscriptionId without verifying it belongs to the authenticated user's organization. This lets any authenticated user modify another tenant's Stripe subscription, changing plans or seat counts, causing financial loss or service disruption. This is a classic IDOR/broken object-level authorization flaw in the multi-tenant SaaS layer of an AI agent-building platform, not an attack on model behavior or agent reasoning itself.

Updated Aug 5, 2026

Flowise's OAuth2 credential refresh endpoint is exempt from authentication, allowing anyone who knows or guesses a credential ID to force the server to refresh and return a live OAuth access token for that connected third-party account. This lets attackers hijack victims' Google, Microsoft, GitHub, or other integrated service access without any login, and can also be abused to exhaust refresh token quotas as a denial-of-service.

Updated Aug 5, 2026

Flowise's DELETE endpoint for chatflows fails to verify that the resource being deleted actually matches the caller's granted permission scope, letting a user or API key with only 'agentflows:delete' permission delete Chatflows (and vice versa). This breaks the intended separation between agent workflow management roles and can result in unauthorized destruction of AI agent configurations within a workspace.

Updated Aug 4, 2026

Flowise, a low-code AI agent/workflow builder, fails to enforce its 'variables:view' permission when populating the $vars object inside the custom JavaScript function execution sandbox. A user or API key that is explicitly denied access to workspace variables can still call the node-custom-function endpoint and read all workspace variables, including runtime secrets pulled from server environment variables, effectively bypassing the platform's RBAC controls.

Updated Aug 4, 2026

Flowise's openai-assistants-vector-store endpoints accept a client-supplied credential ID without verifying it belongs to the caller's workspace, allowing any authenticated user to use another workspace's OpenAI API key. This is a classic multi-tenant IDOR that lets attackers hijack billing, read/modify/delete victim vector stores, and access victim OpenAI account resources.

Updated Aug 4, 2026

Flowise's OAuth2 credential endpoints (authorize, callback, refresh) look up credentials by ID alone without checking workspace ownership, and two of these endpoints are fully unauthenticated. This lets any authenticated user access other workspaces' OAuth2 client metadata, and lets any unauthenticated attacker forge callbacks to inject tokens into or refresh tokens for arbitrary credentials. Since these credentials are used by Flowise's AI agents to authenticate to third-party tools and APIs, the flaw effectively lets attackers hijack the external identities and permissions of agents belonging to other tenants.

Updated Aug 4, 2026

ArcadeDB's MCP server exposes a get_server_settings tool that leaks the cluster authentication token in cleartext. Any client with MCP access can use this token to forge headers and impersonate the root user, gaining full control of the database server.

Updated Aug 2, 2026 · CVSS 7.5

IBM Langflow OSS fails to enforce per-user isolation of Chroma vector store collections, allowing any authenticated attacker to guess or reuse another user's persist_directory and collection_name to read their private documents. The same flaw lets an attacker write poisoned documents into the victim's namespace, corrupting the data that victim's RAG workflows retrieve on. This is a straightforward multi-tenancy authorization failure rather than a novel agentic exploit, but it directly compromises confidentiality and integrity of agent memory.

Updated Jul 31, 2026 · CVSS 8.1

IBM Langflow, an open-source framework used to build AI agent/LLM workflows, contains two broken access control flaws in its file handling API. One endpoint allows completely unauthenticated retrieval of image files tied to any flow, while another allows authenticated users to access other users' files via an IDOR, breaking tenant isolation in multi-user deployments. This can expose sensitive data stored within private agent flows.

Updated Jul 31, 2026 · CVSS 6.5

Pydantic AI's UI adapters (e.g., the Vercel AI adapter) accept client-submitted message history containing 'UploadedFile' references, such as S3/GCS URIs or provider file IDs, without validating that the requesting client should have access to them. Because the server resolves these references using its own privileged credentials (IAM role, service account, or API key), an attacker who can guess or obtain a valid file identifier can trick the server into reading files it should not have access to on the attacker's behalf, including data belonging to other tenants. This is a classic confused-deputy vulnerability affecting a widely used Python agent framework, fixed in versions 1.106.0 and 2.0.0b6.

Updated Jul 30, 2026 · CVSS 6.8