2 CRIT · 8 HIGH · 2 MED · THREAT RED · 12 items · Generated in 229s
Unauthenticated attackers could invoke MCP tools and reach connected services by bypassing LiteLLM auth.
A shared chat payload can use a victim admin session to create a server-side function and achieve remote code execution.
Members can run another user's MCP workflow with the owner's credentials and access its outputs, breaking tenant isolation.
Authenticated attackers can write files outside the skills directory and may gain code execution on vulnerable deployments.
Bypass lets terminal proxy requests reach unintended paths using configured credentials and user headers.
If startup policy data fails to load, restricted AWS operations can run unchecked for the life of the MCP server process.
An ungated write tool can create persistent tenant-visible content without consent and may trigger DQL when others open it.
Privileged users could make LiteLLM read local files through test_connection, exposing sensitive data if admin access is misused.
Unauthenticated RCE can let attackers run commands and poison agent memory, leading to full system compromise.
Overprivileged AI agents can turn routine mistakes into real security incidents and widen blast radius.
Unauthenticated takeover with persistent post-patch compromise can let attackers control AI agents and keep malicious behavior alive.
Hidden instructions can spread across Copilot-edited documents and silently manipulate future AI-assisted workflows.