AI Security News: October 28, 2026

1. NVIDIA Patches a CVSS 10.0 Missing-Authentication Flaw in NeMo Agent Toolkit

NVIDIA. NVIDIA published a security bulletin on October 27 for its NeMo Agent Toolkit. CVE-2026-65145 (CVSS 3.1 10.0, Critical) is a missing authentication issue (CWE-306) that is network-reachable with no privileges or user interaction and can lead to code execution, privilege escalation, data tampering, denial of service and information disclosure. It affects versions 1.0 through 1.8.0 and is fixed in 1.9.0. A second bug, CVE-2026-65151 (8.4, High), is a SQL injection in versions 1.4 to 1.6, fixed in 1.7.0. A separate TensorRT-LLM bulletin covers CVE-2026-65119 (8.4, High), an untrusted-code inclusion flaw in KvCacheAwareRouter tokenizer loading, and two SSRF bugs, CVE-2026-65120 and CVE-2026-24269 (7.1 each). Source Source

2. MLflow 3.17.0 Fixes Critical Scorer RCE, File Read and CrewAI API Key Leak

MLflow. Three new MLflow advisories, all fixed in 3.17.0, landed on October 27. CVE-2026-116692 (CVSS 9.8, Critical) affects 3.12.0rc0 onward: third-party scorer deserialization accepted any submodule of an allowed package, so a caller could upload a Python module through artifact endpoints and have /ajax-api/3.0/mlflow/scorer/invoke import it. Servers with authentication disabled allow this without credentials. CVE-2026-116690 (7.5, High) lets a remote caller register a prompt model version with a schemeless server-local path and read files through the get-artifact endpoint. CVE-2026-116691 (6.5) is a credential leak: mlflow.crewai.autolog() wrote CrewAI agents’ LLM provider API keys into trace spans, which could reach the MLflow backend or an OTLP destination. This follows an earlier scorer-endpoint SSRF fixed in the same release. Source Source Source

3. Official MCP Python and TypeScript SDKs Get Four Advisories

Model Context Protocol. The MCP Python SDK fixed three issues in 1.30.0 and 2.2.0. CVE-2026-116684 (CVSS 6.8) is a resource-confusion flaw: server-side bearer authentication accepted tokens issued for a different service when the TokenVerifier did not check the aud claim. CVE-2026-116685 (5.9) covers client transports that followed cross-origin redirects while forwarding custom credential headers and, on 307/308, the request body. CVE-2026-116686 (6.5) lets a malicious server make clients fetch HTTP, HTTPS or file:// URLs through unresolved $ref values in a declared outputSchema, and stall the event loop while it does so. Separately, GHSA-f897-62hf-6gxq (CVSS 7.5, High) reports that the TypeScript SDK’s Streamable HTTP transports set no limit on POST body size or JSON-RPC batch length, so unauthenticated clients could exhaust memory. It is fixed in @modelcontextprotocol/sdk 1.30.1 and the 2.x server packages 2.1.0 (hono 2.0.1). Source Source Source Source

4. AWS API MCP Server Accepted OAuth Tokens Issued to Other Applications

AWS. CVE-2026-115413 (CVSS 4.0 7.3, CVSS 3.1 7.8, High) affects the OAuth authentication mode of the AWS API MCP Server (awslabs.aws-api-mcp-server) before 1.6.0. The server did not validate token audience, so a local user holding an access token issued to a different application by the same identity provider could run AWS operations with the server’s configured AWS credentials. AWS advises upgrading to 1.6.0 and configuring the expected token audience or client ID (security bulletin 2026-152-AWS). Source

5. VulnCheck Discloses Ten Injection Flaws in MCP Servers Reachable by Prompt-Injected Agents

MCP servers. VulnCheck published a batch of CVEs for community MCP servers, each describing how an agent steered by untrusted content could trigger the bug. Most are OS command injection rated CVSS 3.1 7.8 (4.0 8.5, High): the ai-sdlc plugin MCP server through 0.31.2 (CVE-2026-117558, via gh commands in execSync), DroidMind through 0.4.0 (CVE-2026-117559, allowlist bypass with $(...) on Android devices), the ATXP Gemini CLI extension through 1.0.0 (CVE-2026-117560, where instructions planted in email or SMS content reach shell parameters), Codefriar sf-mcp through 1.3.2 (CVE-2026-117561), esp-mcp (CVE-2026-117567), Kali-GPT (CVE-2026-117569) and hagent (CVE-2026-117573). mcp-ffmpeg through 1.0.5 (CVE-2026-117568, 7.0) is injectable through crafted file names, and Vorota-ai nmap-mcp (CVE-2026-117570, 5.2) lets callers run blocked exploit and DoS NSE scripts. On October 28, Tabularis before 0.28.0 (CVE-2026-118378, 7.8) followed with a SQL injection in its describe_table MCP tool that bypasses read-only mode and write approval. Source Source Source

6. Agno Agent Framework Passed a FunctionCall Field to eval()

Agno. CVE-2026-35002 (GitHub rates it CVSS 9.8, Critical) affects Agno before 2.3.24. The field_type parameter on a FunctionCall input field went straight to Python’s eval(), so anyone able to influence that value, including through an API, web UI or untrusted tool or model output, could run arbitrary Python in the Agno process (CWE-95). Version 2.3.24 replaces the eval() call with a fixed type-mapping lookup and validates the field. Source

7. vLLM Requests Could Swap the Processor Code Revision Under trust-remote-code

vLLM. CVE-2026-114053 (CVSS 8.1, High) lets an untrusted multimodal request set mm_processor_kwargs.code_revision. When the served model’s Hugging Face processor uses dynamic auto_map code and the operator has enabled --trust-remote-code, that value reaches AutoProcessor.from_pretrained and selects which revision of the processor module Transformers imports. A client can thereby execute code from a different revision of the same model repository than the one the operator reviewed, while the model weights revision stays pinned. The fix is in vLLM 0.31.0. Source

8. Critical Stack Overflow in llama.cpp RPC Server’s RDMA Transport

llama.cpp. CVE-2026-118375 (CVSS 4.0 9.2, Critical; CVSS 3.1 8.1) is an out-of-bounds write in the ggml-rpc RDMA transport’s rdma_recv() affecting builds b8841 through b11864. An unauthenticated peer that advertises RDMA capability in the HELLO message can send up to 256 KiB into a 1-byte stack variable in rpc_serve_client(), crashing rpc-server or potentially executing code. Build b11865 fixes it. It is separate from the six GGUF and tokenizer CVEs published the day before. Source

9. LiteLLM Viewer Role Could Read Proxy Files and Escalate to Admin

LiteLLM. GHSA-g5ff-637f-6q2m (CVSS 8.1, High) lets an authenticated LiteLLM proxy user with only the internal_user_viewer role, which many deployments grant through SSO login, read any file the proxy process can access. The request-body blocklist on /utils/transform_request rejected vertex_credentials but not its alias vertex_ai_credentials, which reached the Vertex AI credential loader and sent the file contents to an attacker-controlled URL. Reading /proc/self/environ can expose LITELLM_MASTER_KEY and provider API keys. The fix is in 1.95.0. A reflected XSS in /sso/debug/callback (GHSA-hhww-mrg2-969h) was published the same day. Source

10. Strands Agents and Google ADK Fix Session and Artifact Storage Isolation

Agent frameworks. GHSA-3w55-933p-8pv5 (CVSS 7.1, High) reports that the Strands Agents FileSessionManager stored sessions by default in the world-writable /tmp/strands/sessions/ with predictable paths and a symlink-following write pattern. A local attacker could overwrite arbitrary files or inject session data for persistent prompt injection. A companion advisory (GHSA-763v-5pjm-fx36, Medium) notes the default storage was world-readable, and both are fixed in strands-agents 1.48.0. Google’s CVE-2026-115522 (CVSS 4.0 5.3) affects the Agent Development Kit for Python 1.19.0 before 1.39.1 and 2.0.0a1 before 2.7.0: FileArtifactService left app_name out of on-disk paths, so one application could list, read, overwrite or delete another’s artifacts when both shared a root directory and user_id. Source Source