CRITICAL
GHSASUPPLY-CHAINLLM07:2025 System Prompt Leakage
LangBot: Authenticated RCE Via MCP Configuration
Authenticated users can run arbitrary commands through MCP config and fully compromise the LangBot host.
1 CRIT · 9 HIGH · 2 INFO · THREAT RED · 12 items · Generated in 230s
Authenticated users can run arbitrary commands through MCP config and fully compromise the LangBot host.
Unauthenticated attackers can force the server to fetch internal or cloud metadata URLs, exposing internal services and sensitive data.
Unauthenticated SSRF can reach cloud metadata or internal services even after the patch by abusing DNS rebinding.
Authenticated tenants can read or delete other tenants' workflow backups, exposing secrets and breaking tenant isolation.
Unauthenticated callers can trigger MCP tool actions using the operator's Meta token and access or modify Meta Ads data.
Unauthenticated requests can trigger shell command execution on the host process, leading to full server compromise.
An authenticated MCP client or injected agent can read local secrets like SSH keys and exfiltrate them as attachments.
It lets a malicious client or injected agent read local files the server can access, exposing secrets and other users' data.
This is a product and SecOps capability update, not a disclosed AI security flaw or exploit.
Shows AI agents can run intrusions end to end, raising attack speed and reducing defender visibility and warning signs.
A linked-page loophole let hostile content steer web fetching and potentially leak private chat data.
This is a trend piece about faster attacks and more automation, not a specific vulnerability or exploit.