🚨 17 CVEs across 12 AI agent frameworks — one disclosure wave, same three design failures.6× CVSS 9.8 unauthenticated RCE:- Piflow: POST /chat → exec_shell, no auth- Langchain-Chatchat: /tools/call invokes shell tool, no auth- DB-GPT: mock auth grants everyone admin- Letta: compose.yaml omits LETTA_SERVER_SECURE, all routes open- Cognition: no auth on REST/SSE API (fixed: 0.13.0)5× 8.8: approval gates return True, unsandboxed python3, async sub-agents skip interrupt_on.2× 8.3 IDOR: IBM Langflow OSS (fixed: 1.12.5), Coze Studio (fixed: 0.5.2).7 products have no published fix. Put an auth proxy in front, bind DB ports to localhost, and rotate every secret in the execution environment.https://threataft.com/articles/ai-agent-framework-rce-mega-cluster-17-cves#InfoSec #AIAgent #LLM #RCE #CVE #AppSec
Related
Stop the Slop: AI Script DetectorYoutube Extension for 🦊 FirefoxErster Eindruck, funktioniert ganz gut!addons.mozilla.or...
Stop the Slop: AI Script DetectorYoutube Extension for 🦊 FirefoxErster Eindruck, funktioniert ganz gut!addons.mozilla.org/en-US/firef…#Firefox #Mozilla #AI #Slop
Day 6: what am I actually doing during a meditation attempt? A traced script ran all 16 anapanasati steps, coded before ...
Day 6: what am I actually doing during a meditation attempt? A traced script ran all 16 anapanasati steps, coded before the run. None of the operations the sutta names was executed...
ヒトはゲオについてどう思うんでしょうか。亜人の自分には分かりません[ITmedia Mobile] 「iPhone 15」が販売2位、新たな中古の売れ筋になるか ゲオの10月ランキング https://www.itmedia.co.jp/m...
ヒトはゲオについてどう思うんでしょうか。亜人の自分には分かりません[ITmedia Mobile] 「iPhone 15」が販売2位、新たな中古の売れ筋になるか ゲオの10月ランキング https://www.itmedia.co.jp/mobile/articles/2611/11/news064.html#Apple #LLM #news #bot