Karl W. Stanton

Personal AI website. Security news for people building and defending AI systems.

This week

to

Bottom line

Unauthenticated network callers can run commands through Archon, and code through SGLang when its dumper port is set.

None of this week's new flaws is known to be exploited in the wild, but restrict Archon to trusted networks and turn off SGLang's dumper endpoint now.

Secure It

  • Unauthenticated callers can reach the Model Context Protocol (MCP) web endpoint of Flyto2 Core and pass a command to its shell tool.
  • Open WebUI has the most flaws, 19, and the worst, rated 8.6 out of 10, lets any website steal a signed-in user's session token.
  • Attackers called CyberXero used Claude Code to run a campaign that stole over 628,000 Ukrainian records.

Build It

  • The red-teaming tool garak adds a hit-at-k attack success rate metric to its evaluators.
  • The Cloud Security Alliance's open letter says adding MAESTRO would strengthen the artificial intelligence (AI) control roadmap Google DeepMind published in June.
  • Google Agent Development Kit for Python introduces finer control over tool execution, workflow approvals and deployment security.

Do this week

  • Restrict network access to Archon, which binds to all network addresses by default.
  • Disable the dumper endpoint in SGLang by leaving its dumper port unset.
  • Upgrade Flyto2 Core to 2.26.4 (one upgrade closes all 2).

Archive →

Build It

Defensive guidance, tools, and platform changes.

Defensive Research

Show 3 moreShow fewer

Guidance & Tooling

Show 6 moreShow fewer

Builder Radar

  • OpenAI Agents SDK v0.24.0

    OpenAI Agents SDK releases

    expose MCP annotations on converted tools

  • Google Agent Development Kit (ADK) for Python v2.12.0

    Google Agent Development Kit (ADK) for Python releases

    This release enhances execution performance in long sessions while introducing finer control over tool execution, workflow approvals, and deployment security.

  • Hello Python 3.15, goodbye 3.10, and now I can use 3.11

    Simon Willison

    Python 3.15 is here!

  • Open WebUI v0.12.0

    RELEASE Open WebUI releases

    🧾 Passwords kept out of the audit log. With request auditing on, every field whose name ends in "password" is now masked in both logged requests and logged responses, including admin settings such as YaCy, Jupyter and the LDAP Application DN Password, and passwords containing a…

Show 6 moreShow fewer

  • A new feature for my blog, built using my voice

    Simon Willison

    I shipped a new feature for my blog today: the Newsletters page, which offers an index of all of the newsletters I've sent out, both my free weekly Substack and my monthly sponsors-only updates.

  • Google Agent Development Kit (ADK) for Python v2.9.0

    Google Agent Development Kit (ADK) for Python releases

    This release focuses on agent resilience and ecosystem integration by introducing automatic model failover, native voice support via LiveKit, and compatibility with MCP SDK 2.x.

  • Google Agent Development Kit (ADK) for Python v2.11.0

    Google Agent Development Kit (ADK) for Python releases

    This release adds graceful cancellation and tool confirmation to workflows, a tool for consulting another model mid-task, and a built-in SQLite memory service.

  • Claude Haiku 5.5

    Simon Willison

    As previously promised, here's Anthropic's new fast, low cost model: Introducing Claude Haiku 5.5.

  • MLflow 3.17.0

    RELEASE MLflow releases

    [Model Registry / Tracking] Refuse to connect to client-named artifact hosts outside the default artifact root (GHSA-mr9f-g8qf-4w4j); [Gateway / Tracking] Reject conflicting protobuf field spellings in request bodies (GHSA-3g8m-hm3x-gh2r); [Model Registry / Tracking] Filter…

  • Langflow 1.12.5

    RELEASE Langflow releases

    fix(mcp): redact server credentials from management responses; fix(security): restrict built-in code execution to administrators; fix(security): confine stored chat attachments to authorized storage

Secure It

Critical and exploited vulnerabilities.

Active Threats

  • Mercury

    3 flaws in 30 days worst 10.0 critical

    Worst: From 3.0.0 until 3.2.4, a missing comma in BLOCKED_PATTERNS concatenates the /lab and /api/terminals regular-expression literals.

    Fixes named: 3.2.4, 3.2.6 and 3.2.11

    Show all 3

  • An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via…

    CRITICAL 10.0 CVE-2026-95182 no fix named yet NVD

  • Kobako

    CRITICAL 10.0 CVE-2026-55107 fixed in 0.9.1 NVD

    From version 0.1.0 to before version 0.9.1, a guest mruby script running inside the Kobako sandbox can execute arbitrary Ruby in the host process, fully escaping the sandbox.

  • Decepticon

    CRITICAL 10.0 CVE-2026-61732 fixed in 1.1.17 NVD

    Versions prior to 1.1.17 wrap web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals.

Show 36 more productsShow fewer

  • MCP Atlassian

    29 flaws in 30 days worst 10.0 critical

    Worst: Prior to 0.22.0, the HTTP transport accepts requests without a verified user identity and downstream fetcher construction falls back to the operator's globally configured Jira or Confluence credentials.

    Fixed in 0.22.0

    Show the 5 most severe

  • MaxKB

    13 flaws in 30 days worst 10.0 critical

    Worst: Prior to version 2.10.5-lts, assistants with a tool, MCP tool, skill, or sub-application use SandboxShellBackend, which exposes an execute shell tool without excluding it and omits execute from interrupt_on, so human…

    Fixes named: 2.10.5-lts and 2.10.6-lts 9 with no fix named yet

    Show the 5 most severe

  • IBM Langflow OSS

    31 flaws in 30 days worst 9.9 critical

    Worst: Prior to 1.9.0, any authenticated Langflow user can achieve Remote Code Execution (RCE) on the server by adding an MCP server with the "Stdio" transport.

    Fixes named: 1.9.0, 1.9.1, 1.10.1, 1.10.3 and 1.12.0 25 with no fix named yet

    Show the 5 most severe

  • obsidian-tc

    5 flaws in 30 days worst 9.9 critical

    Worst: Prior to 1.3.1, tool dispatch does not compare the caller-controlled input.vault value with the vault bound to the caller, the JSON Web Token (JWT) has no vault claim, and the folder access-control list is shared…

    Fixed in 1.3.1

    Show all 5

  • GitLab

    3 flaws in 30 days worst 9.9 critical

    Worst: GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions…

    Fixes named: 19.2.4, 19.2.7, 19.2.8, 19.3.2, 19.3.3, 19.3.5, 19.4.1 and 19.4.2

    Show all 3

  • Astron Agent

    CRITICAL 9.9 CVE-2026-108263 fixed in 1.1.2 NVD

    Prior to 1.1.2, the default workflow code-node path through /console-api/workflow/code/run and /workflow/v1/run selects LocalExecutor in core/workflow/engine/nodes/code/code_node.py when CODE_EXEC_TYPE is not…

  • Langchain-Chatchat

    CRITICAL 9.8 CVE-2026-75128 no fix named yet (affected through 0.3.1.3) NVD

    Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any registered tool by name without authentication, leaving the always-registered shell tool callable.

  • piflow

    CRITICAL 9.8 CVE-2026-109442 no fix named yet (affected through 2.0.1) NVD

    piflow 2.0.0 through 2.0.1 contains a remote code execution vulnerability in its DeepAgents chat agent, whose POST /chat and POST /chat/stream endpoints lack authentication.

  • SGLang

    20 flaws in 30 days worst 9.8 critical

    Worst: SGLang contains an arbitrary code execution vulnerability caused by the ZMQ message decoder unconditionally deserializing PickleWrapper payloads via pickle.loads() in _maybe_unwrap_pickle without type allowlisting or…

    No fix named yet

    Show the 5 most severe

  • LangChat

    CRITICAL 9.8 CVE-2026-111704 no fix named yet NVD

    LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered.

  • The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions…

    CRITICAL 9.8 CVE-2026-105038 no fix named yet NVD

  • EXL3

    CRITICAL 9.8 CVE-2026-84286 no fix named yet NVD

    ExLlamaV3’s EXL3 loader uses an untrusted, model-supplied index to select a CUDA kernel without first verifying that the index is within bounds.

  • TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller. In affected…

    CRITICAL 9.8 CVE-2026-51915 no fix named yet NVD

  • SuperAGI

    2 flaws in 30 days worst 9.8 critical

    Worst: SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller.

    No fix named yet

    Show all 2

  • RAGFlow

    6 flaws in 30 days worst 9.8 critical

    Worst: RAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/evaluation_app). Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution

    No fix named yet

    Show the 5 most severe

  • langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code (remote). The…

    CRITICAL 9.8 CVE-2026-51886 no fix named yet (affected through 1.9.3) NVD

  • The /knowledge_base/upload_temp_docs temporary document upload endpoint in Langchain Chatchat 0.3.1 is vulnerable to…

    CRITICAL 9.8 CVE-2026-51884 no fix named yet NVD

  • Devika v1.0 is vulnerable to Code Injection in the Runner.execute function in src/agents/runner/runner.py which allows…

    CRITICAL 9.8 CVE-2026-51871 no fix named yet NVD

  • metatool-ai MetaMCP

    2 flaws in 30 days worst 9.8 critical

    Worst: metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution in the internal MCP inspector proxy endpoint GET /mcp-proxy/server/stdio (createTransport, STDIO branch, routers/mcp-proxy/server.ts).

    No fix named yet

    Show all 2
    • CVE-2026-79538 9.8 critical no fix named yet (affected through 2.4.22)
    • CVE-2026-79537 9.1 critical no fix named yet (affected through 2.4.22)

  • Open GenAI Stack

    CRITICAL 9.8 CVE-2026-77177 no fix named yet NVD

    Open GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Meta AI backend for WhatsApp and other products, allows code execution because prompt injection (with Jinja2 template syntax) can be used to achieve server-side…

  • NetLicensing MCP Server

    CRITICAL 9.6 CVE-2026-57496 fixed in 0.1.8 NVD

    Prior to 0.1.8, netlicensing_get_product passes the caller-controlled product_number to src/netlicensing_mcp/tools/products.py, which interpolates it into a REST path consumed by nl_get() in…

  • An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software…

    CRITICAL 9.6 CVE-2026-91140 no fix named yet NVD

  • Ollama is vulnerable to path traversal in the `/api/pull` endpoint due to insufficient validation of layer digests by…

    CRITICAL 9.4 CVE-2026-103663 fixed in 0.35.0 NVD

  • Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MCP proxy…

    CRITICAL 9.3 CVE-2026-103091 fixed in 0.1.0-alpha.9 NVD

  • Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress…

    CRITICAL 9.3 CVE-2026-102503 fixed in 0.1.0-alpha.3 NVD

  • Archon

    CRITICAL 9.3 CVE-2026-111322 no fix named yet (affected through 0.11.1) NVD

    Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API, which binds to 0.0.0.0 by default.

  • x64dbg-MCP Server

    2 flaws in 30 days worst 9.3 critical

    Worst: Prior to 1.1, x64dbg-MCP Server exposes all MCP debugger tools over HTTP and SSE without authentication while listening on 0.0.0.0 by default.

    Fixes named: 1.1 and 1.2

    Show all 2

  • OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution 2.x before 2.14.12…

    CRITICAL 9.3 CVE-2026-104019 fixed in 2.14.12, 3.9.12, 4.0.11, 4.1.11, 4.2.8, 4.3.5 and 4.4.3 NVD

  • Obot

    6 flaws in 30 days worst 9.3 critical

    Worst: obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to restricted MCP servers if they possess the server ID.

    Fixes named: v0.21.1 and v0.23.0 2 with no fix named yet

    Show the 5 most severe

  • LightLLM

    3 flaws in 30 days worst 9.3 critical

    Worst: LightLLM through 1.2.0 contains a remote code execution vulnerability in the KV-transfer worker when started with --pd_trans_mode nccl, which exposes an unauthenticated RPyC control channel that deserializes…

    No fix named yet

    Show all 3

  • DBHub

    2 flaws in 30 days worst 9.3 critical

    Worst: Versions prior to 0.22.5 expose an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport mode, for example `--transport http --port 8080`.

    Fixes named: 0.22.5 and 0.22.6

    Show all 2

  • Claude Agent SDK

    CRITICAL 9.2 CVE-2026-96620 fixed in 0.2.121 NVD

    Prior to 0.2.121, the resume option is passed to the Claude CLI as a separate token without validation, so a dash-leading value is parsed as an independent CLI flag.

  • NullHub

    CRITICAL 9.2 CVE-2026-110616 no fix named yet (affected through 2026.5.29) NVD

    NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API because the auth_token field defaults to null and is never assigned.

  • common_chat_peg_mapper

    CRITICAL 9.2 CVE-2026-107183 no fix named yet NVD

    llama.cpp before b11393 contains a use-after-free and double free vulnerability in common_chat_peg_mapper::map that allows unauthenticated remote attackers to corrupt heap memory via a dangling current_tool pointer.

  • Flowise

    6 flaws in 30 days worst 9.2 critical

    Worst: Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifier bindings, allowing attackers to authenticate as any existing user by claiming their email at…

    No fix named yet

    Show the 5 most severe

  • DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input.

    CRITICAL 9.1 CVE-2026-52394 no fix named yet NVD

Attack Research

Show 9 moreShow fewer

Incidents & Advisories

Show 16 moreShow fewer