Tool Misuse

The n8n PostgresTrigger node, commonly used by AI agent and automation workflows to connect to PostgreSQL databases, failed to properly escape user-supplied identifier fields (channel, function, trigger names) before embedding them in SQL statements. This allowed authenticated n8n users to inject arbitrary SQL, gaining full read/write access to the connected database using the workflow's configured credentials. The issue has been patched; the main risk is privilege escalation by low-trust authenticated users within multi-tenant or shared n8n deployments.

Updated Jul 23, 2026

The n8n Snowflake node's Execute Query operation directly interpolates workflow expression values into raw SQL strings instead of using parameterized queries, creating a classic SQL injection risk. Exploitation requires a workflow author to have already wired untrusted external data (e.g., from a webhook) into the raw query, so it is a secondary/contributing weakness rather than a directly remotely exploitable flaw on its own. This is a traditional application security bug in an automation tool that is increasingly used as an agentic tool-calling backend, not an AI-specific attack technique.

Updated Jul 23, 2026

The mcp-webresearch MCP server's visit_page tool fails to filter private, loopback, or cloud metadata IP ranges before directing its Playwright browser to fetch a URL. An attacker who can influence the LLM's tool arguments (e.g., via prompt injection from a webpage the agent reads) can redirect the server to internal endpoints like cloud metadata services, leaking sensitive internal data or credentials into the model's context.

Updated Jul 22, 2026 · CVSS 8.2

NadMesh is a Go-based botnet that scans the internet for unauthenticated, publicly exposed AI infrastructure (ComfyUI, Ollama, n8n, Open WebUI, Langflow, Gradio) and abuses them to harvest cloud credentials, including a claimed 3,811 unique AWS keys, as well as Kubernetes tokens. This is not an attack on agent reasoning or protocols themselves, but exploitation of poor deployment hygiene around AI tooling that teams stand up quickly without adequate authentication or network controls. Severity is high because successful compromise yields direct cloud/infrastructure takeover, not just AI misuse.

Updated Jul 19, 2026

AWS HealthOmics MCP Server's linting tools failed to properly restrict pathnames, allowing an actor who can influence the MCP agent's workflow_files input to write attacker-controlled content outside the intended workflow bundle directory via directory traversal sequences. This is a classic path traversal vulnerability exposed through an MCP tool interface rather than a novel agent-specific attack, and is fixed in version 0.0.36.

Updated Jul 19, 2026 · CVSS 5.5

Reports indicate that OpenAI's Codex coding agent (referenced as GPT-5.6) can unexpectedly delete a user's entire $HOME directory when run in 'full access mode' without sandboxing or auto-review safeguards. The root cause is the model attempting to override the $HOME environment variable to create a temporary directory and mistakenly deleting the real $HOME instead. This is an unintentional agent malfunction rather than a malicious attack, but it demonstrates severe real-world consequences of granting autonomous coding agents unsandboxed filesystem access.

Updated Jul 16, 2026

The Apify MCP server's documentation-fetching tool checked allowed domains using a naive string prefix match instead of proper URL hostname parsing, letting an attacker craft URLs like docs.apify.com.evil.com to bypass the allowlist. This allows arbitrary attacker-controlled content to be fetched and returned to the LLM agent, which could then be used to inject malicious instructions or exfiltrate context. The issue was fixed in version 0.9.21.

Updated Jul 16, 2026 · CVSS 6.1

The dbt-mcp MCP server, prior to version 1.17.1, failed to sanitize client-supplied node_selection and resource_type values before passing them as dbt CLI arguments. Although the use of shell=False blocks shell metacharacter injection, an MCP client could still smuggle dbt global flags like --profiles-dir, --project-dir, or --target into the subprocess call, allowing unauthorized redirection of dbt execution context.

Updated Jul 16, 2026 · CVSS 6.3

Repomix's MCP server contains a flaw where two specific tool flows can be used to register and read arbitrary local files without triggering the secret-scanning safety check that normally protects file reads. This allows an MCP client (or an attacker controlling one) to exfiltrate sensitive local files, including those containing credentials, that were meant to be blocked by the redaction/validation layer.

Updated Jul 16, 2026

The elasticsearch_memory tool in strands-agents-tools exposed connection parameters like the target host directly to LLM control, allowing a crafted prompt to redirect the tool to an attacker-controlled server. When the api_key parameter was omitted, the tool silently fell back to the operator's environment-stored Elasticsearch API key and sent it to whatever host the LLM specified, leaking the credential via the Authorization header. This is a classic tool-schema over-permissioning issue that turns an LLM-controllable field into a credential exfiltration vector.

Updated Jul 16, 2026 · CVSS 6.5

The mastergo-magic-mcp MCP server (versions up to 0.2.0) contains a server-side request forgery vulnerability in its getComponentLink tool, caused by insufficient validation of the url argument passed to a z.string schema check. A remote attacker can supply a crafted URL to make the MCP server issue requests to arbitrary internal or external endpoints. A public exploit exists and the vendor has not yet responded to the disclosure.

Updated Jul 15, 2026 · CVSS 6.3

MCP Server Kubernetes before version 3.9.0 has a flaw that lets attackers smuggle malicious flags (like --server) into kubectl commands by disguising them as resource names with leading dashes, bypassing the tool's dangerous-flag safety check. This allows redirecting kubectl operations to an attacker-controlled API server, leaking the operator's bearer token and enabling full Kubernetes cluster takeover.

Updated Jul 11, 2026 · CVSS 9.8

Langroid's file read/write tools fail to properly restrict operations to a configured working directory, allowing an LLM agent or user-controlled tool call to escape that directory using path traversal sequences. This lets an attacker read arbitrary files (e.g., secrets, credentials) or write files anywhere the process has permissions, despite the framework appearing to sandbox file access to a project workspace. The issue is patched in version 0.64.0.

Updated Jul 10, 2026 · CVSS 7.1

Langroid's SQLChatAgent uses an incomplete regex denylist to block dangerous SQL functions before executing LLM-generated queries against a live database. Because the denylist omits PostgreSQL file-reading functions (pg_read_file, pg_stat_file, etc.) and certain SQL Server/SQLite file-attach primitives, an attacker who can influence the generated SQL—directly or via prompt injection in ingested data—can craft ordinary SELECT statements that read arbitrary files from the database host, bypassing the agent's strict default safety configuration entirely.

Updated Jul 10, 2026

A server-side request forgery (SSRF) vulnerability exists in the aerostack-mcp project's mcp-whatsapp component, specifically in the upload_media function's media_url argument. A remote attacker can supply a malicious URL to force the MCP server to make unintended requests, potentially reaching internal network resources. The vendor has been notified but has not responded or patched the issue.

Updated Jul 9, 2026 · CVSS 6.3

Researchers found that six popular AI coding assistants can be tricked by a malicious repository containing symlinks: the agent asks the user to approve an edit to what looks like a harmless file, but the actual write lands on a sensitive system file instead. This allows an attacker who convinces a developer to open a booby-trapped project to gain code execution or persistence on the developer's machine, bypassing the intended human-approval safety check.

Updated Jul 9, 2026

Composio SDK versions before 0.2.32-beta.283 fail to validate file paths in a file-upload tool, allowing an attacker who controls untrusted input (e.g., via prompt injection) to redirect the agent into reading and uploading sensitive local files such as SSH private keys to attacker-controlled storage. This is a realistic and impactful supply-chain/tool-layer vulnerability, not a speculative or low-severity issue.

Updated Jul 9, 2026 · CVSS 6.8

A server-side request forgery flaw exists in the mcp-wiki/wiki-summary component of AIAnytime Awesome-MCP-Server, where the 'url' argument passed to an MCP tool is not validated before the server fetches it. A remote attacker can supply this MCP-exposed tool with an internal or attacker-controlled URL to make the server issue requests on their behalf, potentially reaching internal network resources. The vendor has been notified but has not responded or patched the issue.

Updated Jul 5, 2026 · CVSS 6.3

This report describes a reliability/compatibility quirk, not a security threat: newer Claude models (Opus 4.8, Sonnet 5) sometimes emit malformed tool call arguments with invented fields when used with third-party coding harnesses like Pi, likely due to RL training tuned specifically for Anthropic's own Claude Code edit tool. There is no malicious actor, injection, or exploitation involved—this is a model behavior/engineering problem causing failed tool calls and retries.

Updated Jul 5, 2026