Daily News · 5 min read

AI Security News: October 26, 2026

security ai-security cve vllm model-serving mcp coding-agents robotics llama-cpp agent-skills prompt-injection research

1. vLLM Discloses Ten More CVEs, Including SSRF That Leaks KV-Cache Tensors

vLLM. A batch of ten CVEs (CVE-2026-116172 to CVE-2026-116181) published on October 25 covers many vLLM releases. The most serious, CVE-2026-116176 (CVSS 8.2, High), affects 0.9.2 up to 0.24.0: an API caller can put a decode address in the X-Request-Id header and make a P2pNcclConnector prefill worker ZMQ-connect to an attacker host, which leaks the NCCL unique_id and KV-cache tensors. CVE-2026-116180 (CVSS 7.7) lets a tenant crash EngineCore and drop every co-tenant request by asking for prompt_logprobs against a connector-cached prefix (fixed in 0.31.0). The rest are mostly denial of service: frame-cap bypass through media_io_kwargs (CVE-2026-116179, 7.5), a Nemotron-VL processor that disables Pillow’s decompression-bomb guard globally (CVE-2026-116177, 7.5), audio decompression bombs, and unchecked token IDs in the Rust gRPC frontend. Operators running anything older than 0.31.0 should upgrade. Source Source Source

2. Critical Command Injection in Unitree Go2 Robot’s GPT Chat Component

Unitree Robotics. CVE-2026-115995 (CVSS 3.1 9.6, Critical; CVSS 4.0 9.4) is an OS command injection in the set_volume function of gpt_thread.py, part of the chat_go voice and LLM chat component on the Unitree Go2 quadruped robot, up to firmware 1.1.11.4. The attack can be launched remotely. Unitree confirmed the report (internal ticket #474), and firmware 1.1.11.5 fixes it. Source

3. Command Injection Flaws in Continue and Z.ai Zcode Coding Agents

Continue / Z.ai. CVE-2026-116109 (CVSS 6.3) is an OS command injection in MCPManagerSingleton.setConnections in core/config/ConfigHandler.ts, the MCP Server Transport component of the Continue 2.0.0 coding assistant. A public exploit exists, and the advisory says the vendor never responded to the disclosure. Separately, CVE-2026-116118 (CVSS 6.3) reports that the sed command filter in Z.ai Zcode up to 3.14.3 and 3.15.1 can be bypassed for OS command injection, with an exploit also public. In both cases a shell-command allowlist or MCP configuration path ends up letting attacker-influenced input reach the host shell. Source Source

4. Three MCP Server Bugs: docker-mcp, SiYuan and designer-mcp

MCP servers. CVE-2026-116102 (CVSS 6.3) is an OS command injection through the project_name argument to _build_windows_command in docker_executor.py in QuantGeekDev’s docker-mcp 0.1.0 and 0.2.0. CVE-2026-116168 (CVSS 6.2) affects the MCP asset tool in the SiYuan note-taking app before 3.8.7: its sensitive-path blocklist leaves out .env and other secret files, so an authenticated client using the MCP upload action can copy them into the workspace and read them over /assets/. CVE-2026-116045 (CVSS 4.3) is a path traversal in the get_reference tool of designer-mcp up to 2.1.0, patched in commit c8c2951. Source Source Source

5. Memory-Safety and Code-Injection Bugs in llama.cpp, SMG and Sony NNabla

Inference and ML libraries. CVE-2026-116096 (CVSS 5.3, local) is a heap out-of-bounds write in llama.cpp’s Pocket-TTS state handling, triggered by a malicious mmproj file. It is fixed in b11796, and maintainers say current releases now abort on the condition instead of writing out of bounds. CVE-2026-116095 (CVSS 5.3) is uncontrolled memory allocation in the JPEG decoder of the llm-multimodal crate in the smg model gateway 1.7.0 to 1.10.1, fixed in 1.11.0. CVE-2026-116103 and CVE-2026-116104 (CVSS 6.3 each) are eval()-based code injection bugs in Sony Neural Network Libraries (nnabla) up to 1.39.0, in the param encoder and the NNP converter. Both have public exploits, and the project is no longer maintained. Source Source Source

6. KnotScryer Finds 612 Insecure Chains Among 13,598 Benign Agent Skills

Research. A new paper argues that agent skills that are each clean on their own can still combine into exploitable chains, because the agent passes one skill’s output into the next skill’s input at runtime. Single-skill malware scanners miss this. The authors’ tool, KnotScryer, models each skill as a typed capability flow, builds a Skill Capability-Flow Graph, searches for paths that carry untrusted or protected data to sensitive operations, and confirms candidates by replaying them and running an LLM audit. Run on 13,598 clean skills from ClawHub, it found 612 insecure compositions that worked across three agent frameworks and three LLMs. Source

7. NTBench Shows Prompt Injection Defenses Miss “Near-Target” Attacks

Research. NTBench measures near-target prompt injection, where the injected instruction keeps most of a legitimate answer or tool call but makes it subtly wrong or harmful, instead of hijacking the task outright. Across seven LLMs, ten language-task datasets and two agent benchmarks, near-target attacks beat the usual fixed-target baseline for every model in every setting, given the same budget of three attempts per sample. On language tasks the gains were 9.3 to 35.8 percentage points for incorrect targets and 1.7 to 17.3 points for harmful ones. The authors conclude that injection benchmarks which only test obvious task abandonment overstate how robust models are. Source