AI Security News: October 27, 2026

1. Critical Unauthenticated RCE in OpenHands Software Agent SDK Sandboxes

OpenHands. CVE-2026-112346 (CVSS 3.1 9.8, Critical; CVSS 4.0 9.3) affects the OpenHands Software Agent SDK before 1.52.0. The DockerWorkspace and Apptainer workspace launchers bound the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_keys list, which turned off authentication by default. Anyone who could reach the published container port could send unauthenticated HTTP and WebSocket requests to run shell commands as root in the sandbox, read the mounted workspace, and pull plaintext secrets from the secrets store. Version 1.52.0 fixes it. Source

2. Google Patches File Exfiltration in MCP Toolbox and Bucket Squatting in Cloud Run MCP

Google Cloud. CVE-2026-93328 (CVSS 4.0 9.3, Critical) is a path traversal and missing authorization flaw in the cloud-storage source of MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0. With crafted tool-invocation parameters, an unauthenticated remote attacker could copy host files to external Cloud Storage buckets and overwrite arbitrary local files. Separately, CVE-2026-85297 (CVSS 4.0 7.7, High) is a bucket-squatting issue in Cloud Run MCP before 1.11.0 that could let an attacker intercept proprietary source code, execute arbitrary code and exfiltrate data. Users should upgrade to Cloud Run MCP 1.11.0. Source Source

3. vLLM 0.32.0 Fixes a Pickle RCE and Seven Other Flaws

vLLM. A new batch of eight vLLM CVEs, all fixed in 0.32.0, is separate from the set published the day before. The most serious is CVE-2026-115912 (CVSS 7.5): in scale-out deployments with shared-memory multimodal caching, an authenticated caller can forge shared-memory addresses in features.kwargs_data so that workers pass attacker-chosen bytes to pickle.loads(), giving arbitrary Python execution even when insecure serialization is disabled. CVE-2026-115915 (CVSS 8.1) lets image requests route EPS payloads to Ghostscript through Pillow’s unrestricted decoder selection. The others cover unbounded Jinja chat-template rendering and a trust-policy bypass on /v1/responses (CVE-2026-115911, CVE-2026-115918), engine crashes from Phi-4 audio, DeepSeek-OCR images and an off-by-one token ID (CVE-2026-115913, -115914, -115916), and a wildcard CORS default that lets a malicious web page drive a localhost vLLM server (CVE-2026-115917). Source Source

4. Six llama.cpp CVEs Cover Malicious GGUF Files and Out-of-Range Token IDs

llama.cpp. Six llama.cpp advisories were published on October 27, several of them for bugs fixed long ago. CVE-2026-116816 (CVSS 3.1 7.8, High) is a heap out-of-bounds write in the PLaMo-2 tokenizer: a crafted GGUF with BYTE tokens like <0x-1> writes before the buffer at model load (fixed in b10261). CVE-2026-116829 (6.6) and CVE-2026-116840 (6.1) are integer overflows in gguf_init_from_reader that bypass tensor size checks, including the earlier CVE-2025-53630 fix (fixed in b11301 and b11275). CVE-2024-58400 (8.2) lets unauthenticated clients read embedding memory out of bounds by sending integer-array prompts with token IDs outside the vocabulary to llama-server’s /completion endpoint. Anyone loading untrusted GGUF models should run a current build. Source Source

5. Mem0 Session Scope Collision Leaked Conversation History Across Tenants

Mem0. CVE-2026-116575 (CVSS 6.3) affects the Mem0 agent memory SDKs before Python 2.0.18 and TypeScript 3.1.6. The session-scope key joined caller-controlled user_id, agent_id and run_id with unescaped & and = delimiters, so a crafted identifier could make two different tenants map to the same key. Because Memory.add() and the REST POST /memories flow read and save recent raw messages under that key, one tenant could see another’s conversation, or evict and interleave it. Source

6. Flaws in Agentic Apps: a Call-Center Agent Key, astron-agent and Mattermost Agents

Agent applications. CVE-2026-110474 (CVSS 4.0 8.7, High), reported through CERT-In, is a static API key hardcoded in the client-side JavaScript of the CreditNirvana Agentic AI Call Centre application. Any unauthenticated user can extract it and call the API to pull call transcripts and recordings. CVE-2026-116339 (CVSS 3.1 7.3) is an incomplete blacklist in the DDL whitelist handler of iFlytek astron-agent up to 1.1.2. A public proof of concept smuggles statements past the check with comments, and the vendor did not respond to disclosure. CVE-2026-116516 (6.5) lets an authenticated user crash the Mattermost Agents plugin by asking it to summarize a crafted Zoom chat transcript (MMSA-2026-00723). Source Source Source

7. ONNX 1.22.0 Fixes Four Shape-Inference Crashes Triggered by Untrusted Models

ONNX. CVE-2026-115919 through CVE-2026-115922 (CVSS 6.2 each) are memory-safety bugs in ONNX shape inference and tensor unpacking before 1.22.0. They affect RNN, LSTM and GRU nodes in old opsets, ConvTranspose weights with fewer than three dimensions, Scan inference, and the 2-bit and 4-bit unpack helpers, which resize arrays from attacker-controlled dims. A malicious model can read out of bounds or crash the application. For the RNN bug, that includes a model which still passes onnx.checker.check_model() before infer_shapes() processes it. Pipelines that inspect third-party models should upgrade to 1.22.0. Source