Security brief: a quiet weekend, and a catch-up on the agent-framework CVEs that went public on 7 and 8 October
No new in-the-wild agentic incident and no new CISA KEV entry for agentic software surfaced in the window. A sweep of the GitHub Advisory Database found a cluster of critical agent-framework flaws that reached the database on 7 and 8 October and have not been covered here: a Langflow MCP stdio command-injection family (CVSS 9.9), three PraisonAI critical or default-exposure flaws, a Flowise prompt-injection chain, and two role-boundary forgery bugs.
Covers Sat 17 Oct 12:00 to Sun 18 Oct 08:00 CEST, plus a sweep of the GitHub Advisory Database back to 1 Oct
Thin window: the previous brief ran on Saturday midday and the weekend produced no new disclosure I could verify, so this report goes deeper on late finds instead of padding. All items below are late finds: first published on GitHub between 22 June and 7 October, listed in the GitHub Advisory Database on 5 to 8 October, and not covered before. No daily signal was written: the only candidates (Anthropic's 8 October usage-policy update, Claude Code 2.1.299 to 2.1.302) were already covered or are minor, which is under the two-item bar. Source access was again limited: GitHub and anthropic.com were readable; news outlets, NVD, CISA, arXiv and dev.to were not. I could not check CISA KEV directly, so 'no new KEV entry' means none surfaced in search. Searches for unconfirmed claims (a Langflow in-the-wild exploitation report, a fuzzing study of 118 MCP servers) found only secondary blogs that I could not open, so I do not rely on them. Exposure figures and EPSS values are as shown on the advisory pages.
Act now
- Upgrade Langflow to 1.10.3 or later, and turn off auto-login Affected: langflow 1.1.2 to 1.10.2 (also langflow-base before 0.10.3 and lfx before 1.10.3). 1.9.0 added an allowlist but the execution path still used `bash -c`, so 1.9.0 to 1.10.2 remain bypassable. Set LANGFLOW_AUTO_LOGIN=false, keep the UI off untrusted networks, and review saved MCP server entries for commands outside node, python, npx, uvx and docker.
- Update PraisonAI and never expose AgentOS without a key praisonaiagents to 1.6.78 or later, praisonai (pip) to 4.6.78 or later, praisonai (npm) to 1.7.3 or later. If an AgentOS instance was started with the quickstart and bound beyond localhost, treat its system prompts as disclosed, check for unexpected invocations, and rotate any secret in the process environment.
- Update Cline to 3.0.30 or later and stop running `cline dashboard` on a workstation you browse from Affected: npm package `cline` before 3.0.30. Until updated, set ROOM_SECRET so the Hub dashboard does not accept unauthenticated local WebSocket sessions, and check the Cline settings file for MCP stdio entries you did not add.
In brief
- Langflow before 1.10.3 (CVE-2026-105697, CVSS 9.9): any user who can save an MCP server config gets a shell on the host. The earlier fix in 1.9.0 is not enough. With the default LANGFLOW_AUTO_LOGIN=true no account is needed.
- PraisonAI: a CodeAgent that runs LLM-written code with every environment secret (CVE-2026-61447, 10.0), an AICoder that writes files and runs commands from chat (CVE-2026-61445, 9.9), and an AgentOS that listens on 0.0.0.0 with no key (CVE-2026-61426, 8.6). The maintainer advisories date from 25 June; the database listing came on 8 October.
- Cline before 3.0.30 (CVE-2026-59723, 8.8): a web page the developer visits can write an MCP stdio entry through the local Hub dashboard, which auto-approves tools.
- Two bugs forge chat roles from untrusted text: Decepticon (CVE-2026-61732, 10.0) via ChatML special tokens in crawl output, and Banks (CVE-2026-107717, 6.5) via JSON lines rendered from templates.
- Flowise up to 3.1.2 (CVE-2026-73487, 9.3): prompt injection steers a CSV or Airtable agent past a 38-pattern regex blocklist to SSRF and data exfiltration. Fixed in 3.1.3.
Bottom line
Nothing new broke this weekend. What I found instead is a cluster of critical flaws in agent builders and coding agents that reached the GitHub Advisory Database on 7 and 8 October and were never covered here, mostly because the maintainers’ own advisories had been out for weeks or months before the database caught up. They share one idea: a setting that can start a process, or text that can become a role, is treated as data. Fixes exist for all of them.
Act now
- Langflow: go to 1.10.3, not 1.9.0, set
LANGFLOW_AUTO_LOGIN=false, and review saved MCP server entries. - PraisonAI: update all three packages and never bind AgentOS beyond localhost without an API key.
- Cline: update to 3.0.30 and set
ROOM_SECRETif you run the Hub dashboard.
Incidents
No new in-the-wild agentic incident surfaced in the window, and the campaigns in the 12 Oct brief have no public update I could verify.
Late finds
Each carries the tag Late find with its first publication date. I found them by sweeping the GitHub Advisory Database for mcp, agent, llm and prompt injection, newest first, then reading the primary advisory for each. The database lists reviewed advisories days to months after the maintainers publish them, so it is a good place to look for things the press has not picked up.
Langflow: saving an MCP server config runs the command on the host
What happened. Langflow carries two GitHub advisories for the same sink. GHSA-7w94-79vh-5mr2 (published 10 September, CVE-2026-105740 on the advisory page) covers Langflow 1.8.3 and says 1.9.0 fixes it. GHSA-w794-rj3p-xv45 (published 28 September, CVE-2026-105697, reviewed into the database on 7 October) covers langflow 1.1.2 up to but not including 1.10.3, with the same CVSS 3.1 vector and score of 9.9. The second one is the one that matters: it states that 1.9.0 added a command allowlist but left the execution path running bash -c, so configs embedded in flows or passed as tweaks could still run arbitrary commands until 1.10.3 removed the shell.
Mechanism. The entry point is the “Add MCP Server” settings page and the /api/v2/mcp/servers API (and, in older versions, the MCP Stdio component). A user supplies command, args and env for a stdio MCP server. Langflow launches that command on the host when it connects: when the server list is fetched, when tools load, or when a flow runs. It runs even if the UI reports that the server failed to start. The trust boundary crossed is between “a user of the application” and “the operating-system account that runs it”. The root cause is treating an MCP server definition as configuration when a stdio definition is, by design, a command line. Preconditions: with the default LANGFLOW_AUTO_LOGIN=true, GET /api/v1/auto_login hands out a token with no credentials, so an exposed default instance needs no account; otherwise any authenticated non-admin user qualifies. Blast radius is code execution as the Langflow process user, with access to everything in its environment: model API keys, database credentials, cloud metadata, and other users’ flows. The stored config re-executes for other users and admins who load the list, which gives persistence. The env field also allowed overriding PATH and LD_PRELOAD in the earlier release.
Why it matters. This is the same shape as the Claude Agent SDK resume flaw in the 17 Oct brief and the Cline item below: a field that looks like a setting is parsed as a command. In Langflow it also shows how a partial fix fails. A check at the API but not at the sink was bypassed by anything that reached the sink by another route (flows, tweaks). OWASP LLM06 (excessive agency) and the Agentic Top 10’s tool-misuse and supply-chain entries both apply; for ATLAS, this sits closest to execution through a compromised tool configuration.
Mitigation and detection. Upgrade langflow, langflow-base and lfx to the fixed versions. Set LANGFLOW_AUTO_LOGIN=false and keep the UI off untrusted networks. After 1.10.3 the advisory recommends LANGFLOW_MCP_SERVER_ALLOWED_PACKAGES (the allowlist otherwise permits any npx or uvx package), LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING=true and LANGFLOW_MCP_SERVER_DOCKER_HARDENING=true, and from 1.11.1 the custom-component restrictions. Detect by reviewing stored MCP server entries for commands outside node, python, npx, uvx and docker, and by alerting on child processes of the Langflow service that are shells or fetch-and-run pipelines. Other Langflow advisories in the same listing, which I read only by title: weak Fernet key from random.seed() (CVE-2026-9205, critical), X-Forwarded-For spoofing allowing a remote configuration write (CVE-2026-105741), cross-project file disclosure through MCP resource handlers (CVE-2026-105699), and prompt injection in Smart Transform leading to code execution (CVE-2026-7700).
Recommendation (opinion): act today if Langflow is reachable by anyone you do not fully trust. Patch to 1.10.3 (not 1.9.0), turn off auto-login, and treat any instance that was exposed with auto-login on as compromised until you have checked its MCP entries and process tree. A low-code agent builder holds the keys to every model and data source it connects; run it like a CI server, not like a dashboard.
Sources: GHSA-w794-rj3p-xv45 · GHSA-7w94-79vh-5mr2 · Langflow advisory list
PraisonAI: three defaults that hand the agent, its code runner and its secrets to the network
What happened. On 8 October the GitHub Advisory Database listed more than a dozen PraisonAI advisories that the maintainer had published on 25 June. Three matter most. CVE-2026-61447 (CVSS 10.0): praisonaiagents up to 1.6.77, fixed in 1.6.78, where CodeAgent writes LLM-generated Python to a temp file and runs it in a subprocess that inherits the full parent environment. CVE-2026-61445 (9.9): praisonai up to 4.6.77, fixed in 4.6.78, where the AICoder component gives the model write_to_file and execute_command with no path validation or command sanitization. CVE-2026-61426 (8.6): the npm praisonai package before 1.7.3, where AgentOS binds 0.0.0.0 with an empty API key and wildcard CORS, and the auth middleware is only registered when a key is set.
Mechanism. In CodeAgent, the sandbox field of CodeConfig defaults to True but is never read; the advisory calls it dead code, while a sibling execute_code tool runs with an empty environment. That is the classic gap between a safe option that exists and a safe option that is wired in. Prompt injection in any content the agent processes (input, tool results, ingested data) reaches code execution and every API key, database credential and cloud token in the process environment. In AICoder, the injected instruction can write to /etc/cron.d/ or run a fetch-and-pipe command; the advisory notes the Docker image runs as root. In AgentOS, an unauthenticated GET /api/agents returns agent names, roles and system prompts, and POST /api/chat invokes the agent for any caller, so the exposure is data disclosure plus model-cost abuse plus whatever tools the agent holds. The advisory links this to an earlier similar issue (CVE-2026-44338) and calls this one worse because of the 0.0.0.0 default. Other PraisonAI entries in the same batch, by title only: an unauthenticated MCP HTTP-stream transport by default (CVE-2026-61427), a localhost-only auth bypass through a spoofed Host header (CVE-2026-61435), a shell allowlist bypass through find -exec (CVE-2026-61434), two prompt-injection defence bypasses (CVE-2026-61439, CVE-2026-60086) and an unauthenticated Jobs API with webhook SSRF (CVE-2026-60091). Blast radius for a default install is the whole host and its credentials. OWASP LLM01, LLM05 and LLM06 apply; so does the Agentic Top 10 entry on unexpected code execution.
Why it matters. Two points. First, the lag: the maintainer published on 25 June and the database on 8 October, so anyone relying on database-fed scanners had a three-month blind spot. Second, defaults: three separate components fail open. Compare the exposed-by-default pattern in the 12 Oct brief census and the LMCache example deployment in the 17 Oct brief.
Mitigation and detection. Upgrade to praisonaiagents 1.6.78, praisonai (pip) 4.6.78 and praisonai (npm) 1.7.3, or later. Never run the quickstart server on a routable interface; set an API key, restrict CORS, and bind to loopback. Run code agents in a container without the host environment and with no outbound network, and give them a scrubbed environment instead of os.environ.copy(). Detect unauthenticated hits to /api/agents and /api/chat, writes under /etc/cron.d/, and agent processes spawning curl or sh.
Recommendation (opinion): act this week. Inventory where PraisonAI is installed (pip and npm), patch, and rotate keys on any host that ran CodeAgent or AICoder against untrusted content. If you cannot patch, remove the code-running components.
Sources: GHSA-2xv2-w8cq-5gxw · GHSA-9mp3-24cc-77mg · GHSA-6wjp-v33h-5cvq · Database search: llm
Cline Hub: a web page you visit can add an MCP server to your coding agent
What happened. GitHub’s advisory GHSA-3cj3-hqcr-g934 (published 23 June, reviewed into the database 24 September) describes cross-origin WebSocket hijacking in the Cline Hub dashboard. npm package cline before 3.0.30 is affected. The advisory’s text cites a 9.6 score while the listed vector gives 8.8; I use the listed value.
Mechanism. cline dashboard accepts WebSocket connections on /browser without checking the Origin header. When ROOM_SECRET is unset, which is the default for local 127.0.0.1 binds, the authorization check passes every request. Browsers do not apply the same-origin policy to WebSocket handshakes, so any page the developer opens can connect to the local port. Dashboard sessions default to auto-approving all tools, so the attacker can write an MCP server entry, including a stdio command, into the Cline settings file, which runs when Cline activates it. Preconditions: the dashboard is running and the victim visits one attacker-controlled page. No credentials are needed. The attacker can also read sessions, workspace and provider configuration, and steer agent sessions. This is the same class as earlier localhost-service flaws in coding-agent tooling: a service that trusts “it is on my machine” while the browser is a bridge from the open web.
Mitigation and detection. Update to 3.0.30. Set ROOM_SECRET. Do not leave the dashboard running while browsing untrusted sites. Check the Cline settings file for stdio MCP entries you did not add.
Recommendation (opinion): act this week for anyone using the Hub. Treat any local agent control port as an internet-facing service: require a secret and validate
Origin.
Sources: GHSA-3cj3-hqcr-g934
Two ways untrusted text becomes a trusted chat role
What happened. Decepticon (CVE-2026-61732, CVSS 10.0, all versions up to 1.1.16, fixed in 1.1.17) places web crawl output into LLM messages without neutralizing ChatML special-token literals such as <|im_start|>. Banks (CVE-2026-107717, CVSS 6.5, up to 2.4.5, fixed in 2.5.0) renders a template, parses each output line as a JSON ChatMessage, and accepts any role string, so user text that renders as a JSON object with a system role comes back as a system message.
Mechanism. Both break the boundary between data and instructions at the serialization layer, where the model never sees a “this is untrusted” flag. In Decepticon, text planted on a target page appears to the model as a new operator turn, which the advisory says bypasses the agent’s guardrails and can end in arbitrary command execution in its Kali sandbox. The advisory confirms it against self-hosted OpenAI-compatible servers that parse special-token literals into real role tokens (vLLM, SGLang, TGI) and says hosted vendors (OpenAI, Anthropic, DashScope) were not exploitable at the time because they strip the literals server-side; it notes that is vendor behaviour, not a guarantee. Banks needs an application that passes untrusted input through chat_messages() to a provider; impact depends on the application. Blast radius for Decepticon is command execution on an offensive-security agent that is, by design, pointed at hostile content.
Why it matters. Anyone who self-hosts an open-weight model behind an OpenAI-compatible endpoint inherits a risk that hosted APIs mask. If you moved from a hosted model to self-hosted to cut cost or keep data in-house, your prompt-assembly code is now the only defence against role forgery.
Mitigation and detection. Escape or strip special-token literals and role-like JSON in every untrusted input before it reaches a prompt, at the point you build messages. Test your own stack: render a fixture page containing your model’s role tokens and confirm the server returns them as text. Upgrade the two packages.
Recommendation (opinion): add a role-forgery test to your agent red-team suite this month; it is cheap, and it fails silently in production.
Sources: GHSA-g5f9-3xfg-p9mf · GHSA-hmq2-7hp6-7crh
Flowise: a 38-pattern regex is not a sandbox
What happened. Endor Labs’ Peyton Kennedy reported that Flowise and flowise-components up to 3.1.2 let prompt injection push the CSV Agent and Airtable Agent nodes into generating Python that passes a regex blocklist (validatePythonCodeForDataFrame(), 38 patterns). Fixed in 3.1.3. The advisory gives CVSS 3.1 9.3 and CVSS 4.0 9.0 on differing vectors; the prediction endpoint requires no authentication by default.
Mechanism. The generated code runs in Pyodide. The bypasses use things the blocklist did not name: pandas readers that accept URLs (read_json, read_html, read_csv), importlib (the pattern matches import but not importlib), building blocked names at runtime with chr(), and np.ctypeslib. The confirmed impact is exfiltration of everything loaded into the DataFrame and SSRF to internal services including cloud metadata endpoints; the advisory says native-library loading is limited in Pyodide/Wasm. It is a follow-on to an earlier import-aliasing bypass (ZDI-CAN-29411) fixed by blocking all imports in 3.1.0, which shows that blocklists get patched pattern by pattern.
Mitigation and detection. Upgrade to 3.1.3. Run the Pyodide runtime with no outbound network, put the prediction endpoint behind authentication, and prefer an AST-level allowlist of DataFrame operations over text patterns, as the advisory suggests. Detect outbound requests from the Flowise host to metadata addresses and unexpected hosts.
Recommendation (opinion): patch within a week, and move off public unauthenticated prediction endpoints. If your agent builder generates code from model output, the sandbox has to be a process and network boundary, not a filter.
Sources: GHSA-w7x8-q2gp-5cgg
Vulnerabilities table
| CVE | Product | Issue | CVSS | Fixed | Exploited |
|---|---|---|---|---|---|
| CVE-2026-105697 | Langflow | OS command injection through MCP stdio server config | 9.9 | 1.10.3 (1.9.0 incomplete) | No evidence |
| CVE-2026-105740 | Langflow 1.8.3 | Authenticated RCE through MCP Stdio transport | 9.9 | 1.9.0 | No evidence |
| CVE-2026-61447 | praisonaiagents | CodeAgent runs LLM code unsandboxed with all env secrets | 10.0 | 1.6.78 | No evidence |
| CVE-2026-61445 | praisonai (pip) | AICoder file write and command execution through tool calls | 9.9 | 4.6.78 | No evidence |
| CVE-2026-61426 | praisonai (npm) | AgentOS on 0.0.0.0 with no key and wildcard CORS | 8.6 | 1.7.3 | No evidence |
| CVE-2026-73487 | Flowise | Prompt injection to SSRF and exfiltration via validator bypass | 9.3 | 3.1.3 | No evidence |
| CVE-2026-61732 | Decepticon | ChatML special-token role forgery from crawl output | 10.0 | 1.1.17 | No evidence |
| CVE-2026-59723 | Cline Hub | Cross-origin WebSocket hijack writes MCP entries | 8.8 | 3.0.30 | No evidence |
| CVE-2026-107717 | Banks | Role injection through templated chat messages | 6.5 | 2.5.0 | No evidence |
| CVE-2026-105806 | Payload MCP plugin | MCP API keys managed outside the caller’s account | 8.6 (v4) | 3.88.0 | No evidence |
“No evidence” means none appears in the advisories I read or in search results I could open. CISA KEV was not directly readable this run.
MCP and protocol security
No new specification release: the latest is 2026-07-28, and the official TypeScript SDK’s 5 October releases (2.3.1, server-legacy 2.3.1) only add the opt-in expectedResource audience check already covered in the 17 Oct brief. The Payload @payloadcms/plugin-mcp advisory (CVE-2026-105806, 3.61.0 up to but not including 3.88.0) says an authenticated user could manage MCP API keys outside their account under unspecified conditions; the advisory page gives no more detail, so I list it in the table only. Workaround: disable the plugin or limit key management to trusted users.
Policy
Anthropic’s usage-policy update, announced on 8 October, takes effect on 12 November. For operators of agents the useful parts are the restated human-in-the-loop duty for high-risk uses (health, legal rights, finances, livelihood, essential services), a new requirement that equipment taking autonomous physical actions can be observed and stopped, and that it can hold a safe state if Claude is disconnected. The post does not add new cyber or computer-use rules. If you build on Claude for high-risk decisions, check your review step against the new text before that date. Opinion: a useful prompt to write down who can stop an agent, how, and what it does if the connection drops.
Sources: 2026 Usage Policy update