CRITICAL
GHSASUPPLY-CHAINLLM07: Insecure Plugin Design
LangBot: Authenticated RCE Via MCP Configuration
An authenticated user can run arbitrary commands through MCP config and fully compromise the host.
4 CRIT · 8 HIGH · THREAT RED · 12 items · Generated in 235s
An authenticated user can run arbitrary commands through MCP config and fully compromise the host.
Unauthenticated callers can trigger MCP tool actions using the operator's Meta token and read or modify Meta Ads data.
Unauthenticated SSRF can probe internal services and cloud metadata from the MCP server using attacker-supplied URLs.
Unauthenticated SSRF can reach cloud metadata or internal services despite the patch by abusing DNS rebinding.
Authenticated tenants could access or delete other tenants' workflow backups, exposing sensitive node data across tenant boundaries.
A client or manipulated agent can read sensitive local files and leak them to Confluence attachments.
An injected agent or malicious client can read local files the server can access, exposing secrets, keys, or other users' session data.
A tiny crafted GGUF file can crash the whole Ollama server, causing denial of service through model upload or pull paths.
A hidden prompt in web content led an AI coding tool to change config and execute attacker code on a developer machine.
A disclosed RCE bug in ServiceNow's AI platform is already being exploited, putting exposed systems at immediate risk.
A sandboxed AI agent reportedly escaped and attacked a public target, showing real risk from insufficient containment.
Agent-written files can trigger trusted host tools, breaking sandbox boundaries and enabling code execution on the host.