Daily News · 4 min read

AI Security News: October 25, 2026

security ai-security cve a2a mcp fastmcp vllm mlflow model-serving ssrf ai-agents defensive-tooling

1. Strands Agents SDK A2A Server Leaked Conversation History Across Callers

Strands Agents. CVE-2026-115419 (CVSS 8.1, High) affects the open-source Strands Agents SDK, which AWS maintains for Python (strands-agents) and TypeScript (@strands-agents/sdk). Under some conditions the Agent2Agent (A2A) server shared conversation history between callers with different context_id values. In multi-tenant deployments, that let an authenticated remote user read another caller’s session or influence the model’s behavior for them (CWE-488). Fixes ship in strands-agents 1.43.0 and @strands-agents/sdk 1.5.0, where the A2A server now uses an agent factory to isolate state per context_id. Source

2. Two FastMCP Flaws: Authorization Bypass on Transformed Components and Redirectable OAuth Client Secrets

FastMCP. GHSA-7xgj-8392-5q4r (CVSS 6.8, Medium) covers FastMCP 3.0.0 to 3.4.9 and 4.0.0 to 4.1.1. Direct lookups checked the authorization policy of the original component but returned the transformed one without checking again, so a client that knew a component’s identifier could call a tool or read a resource or prompt the policy should deny. GHSA-vqqp-x5qm-5qp4 (CVSS 5.9, Medium) affects 4.0.0 to 4.1.1: the client-credentials and private-key JWT OAuth providers were not bound to an issuer, so a malicious MCP server could advertise its own authorization server and receive the client secret or a signed assertion. Both are fixed in 4.1.2 (and the first in 3.4.10), and the OAuth fix only protects users who set the new issuer option. Source Source

3. vLLM Fixes Unauthenticated Engine Crash and Memory Exhaustion in Multimodal Inputs

vLLM. CVE-2026-114050 (CVSS 6.5, Medium) lets one unauthenticated client crash the whole vLLM engine under default flags. vLLM uses the client-supplied uuid on a multimodal item as its cache identity, and the API-process and engine-process caches evict independently, so a seed, drift and kill sequence of requests makes the engine reuse mismatched tensor data. A second advisory, CVE-2026-114055 (CVSS 7.5, High), shows per-request mm_processor_kwargs reaching image and video processor constructors unchecked, letting a single request force an out-of-memory crash. Both affect versions before 0.31.0 (the second since 0.7.3) and are fixed in 0.31.0. Source Source

4. MLflow GenAI Scorer Endpoint Allowed Unauthenticated SSRF

MLflow. CVE-2026-115886 (CVSS 6.5, Medium) affects MLflow 3.12.0rc0 up to, but not including, 3.17.0. The tracking server exposes POST /ajax-api/3.0/mlflow/scorer/invoke without authentication, and the handler builds an attacker-named class from attacker-supplied JSON with unrestricted constructor arguments. If the optional trulens and trulens-providers-litellm packages are installed, an attacker can make the server send HTTP requests with attacker-chosen headers to any host. The scorer register and GenAI evaluate endpoints are affected too, and the fix is in 3.17.0. Source

5. Critical Path Traversal in End-of-Life AWS Multi Model Server Has No Patch

AWS. CVE-2026-115812 (CVSS 9.8, Critical) is a relative path traversal during model archive extraction in Multi Model Server 1.1.11 and earlier. A remote actor could use a crafted model archive to execute arbitrary code. Multi Model Server is end of life and no fixed version will ship, so AWS advises users to stop using it and move to a supported model serving solution. Source

6. PrivateGPT URI Loader SSRF Has a Public Exploit and No Vendor Response

Zylon PrivateGPT. CVE-2026-116000 (CVSS 7.3) is a server-side request forgery in load_file_from_uri in private_gpt/server/ingest/uri_loader.py, the URI Artifact Loader component of PrivateGPT 1.0.0 and 1.0.1. It can be triggered remotely, and an exploit has been made public. The advisory says the vendor was contacted early in the disclosure process but never responded, and no fixed version is listed. Source

7. Argus Releases an Open-Source Security Operations Platform Built Around Read-Only AI Investigators

Argus. Argus, posted to Show HN on October 24, is a self-hosted, multi-tenant security operations platform covering cloud, identity, code, endpoints, network and Kubernetes. Seven specialist agents triage, investigate and hunt with read-only tools and may propose fixes but not run them. Response playbooks draw on 27 typed, reversible actions that start in shadow mode, and the project also includes an AI gateway with model allowlists and DLP, canaries aimed at rogue agents (hidden prompt injections, a fake MCP server, fake LLM API keys), and a simulator that replays 8 AI-driven attack scenarios. Licensed MIT. Source