AI Security News: October 29, 2026

1. Critical Flaw in Red Hat’s AI Gateway Let Tenants Spend Each Other’s LLM API Keys

Red Hat. CVE-2026-117574 (CVSS 3.1 9.1, Critical) affects ai-gateway-payload-processing. An authenticated user could name another tenant’s model identifier in the request body or a header, and because the service did not check authorization before pulling credentials from its shared store, it injected that tenant’s API keys into the outgoing request. The attacker could then make requests and consume the other tenant’s LLM resources and quotas. Red Hat tracks the issue in its CVE database and Bugzilla. Source

2. Prompt Could Switch Off Secret Masking in Strands Agents’ Environment Tool

AWS. CVE-2026-115415 (CVSS 3.1 6.5, CVSS 4.0 5.9) is an improper input neutralization flaw in the environment tool of Strands Agents Tools before 0.8.6. A crafted prompt could disable the tool’s secret masking, so a remote actor able to influence the agent’s input could obtain the host’s environment variables in cleartext, including cloud credentials and API keys. AWS (security bulletin 2026-154-AWS) advises upgrading to 0.8.6 and rotating any credentials present in the environment of agents that loaded the tool. This follows the Strands session storage advisories disclosed the day before. Source

3. n8n Fixes More Than a Dozen Flaws, Including Chat Hub Users Running Agents and Code

n8n. VulnCheck published a large batch of n8n CVEs on October 28, fixed across 1.123.85, 2.41.x, 2.43.5 and 2.44.1. CVE-2026-118640 (CVSS 3.1 5.4) lets users with the chat-only global:chatUser role register restricted tool types in Chat Hub and use them to run sandboxed code, access permitted files, and invoke instance workflows, Data Tables and agents. CVE-2026-118649 (8.3) lets a member who can run workflows pass a crafted workflow ID such as __proto__ to read, modify and delete Data Table rows in every project. CVE-2026-118643 (8.2) leaves credential secrets for the Git, MongoDB Atlas Vector Store and Google Cloud Storage nodes in execution error data visible to users who cannot read the credential. Other entries cover a Quick Base filter injection (CVE-2026-118645, 8.7), error-workflow identity inheritance (CVE-2026-118644), SSRF, prototype pollution, stored XSS and several authorization bypasses. Source Source Source

4. Four MCP Server Flaws: Package-Alias RCE, DNS Rebinding and Unauthenticated Listeners

MCP servers. CVE-2026-59176 (CVSS 3.1 7.8) affects functype-mcp-server before 1.4.4: its set_functype_version tool interpolated an unvalidated version string into pnpm add functype@<version>, so file:, npm: or URL aliases could install an arbitrary package that the server then imported, and the advisory notes an assistant hit by indirect prompt injection could be induced to call it. AnkiMCP before 0.21.0 (CVE-2026-61546, CVSS 4.0 8.8) globally disabled FastMCP’s DNS-rebinding protection on its default loopback listener with no token or Origin check, letting a malicious web page read and edit a victim’s Anki collection. CVE-2026-61542 (8.6) covers the drhelius emulators’ optional --mcp-http mode, which bound to all interfaces with no authentication despite localhost-only documentation; it is patched in Gearboy 3.8.7. Google also fixed CVE-2026-106484 (4.4, Medium), insufficient policy enforcement in chrome-devtools-mcp on Linux before 1.5.0 that allowed arbitrary read and write via a malicious file. Source Source Source Source

5. mcp-sanitizer, a Guard for MCP Tool Inputs, Let SSRF and Home-Directory Paths Through

mcp-sanitizer. Two advisories for the mcp-sanitizer npm package, which is meant to vet MCP tool parameters such as web_fetch URLs and file paths, are fixed in 1.4.0. GHSA-4mfg-r38w-w8fg (CVSS 8.2, High) shows its localhost check only fired when no port was given, so http://localhost:8080/ passed, and that bracketed IPv6 hostnames such as [::1] and [fe80::1] slipped past string comparisons. GHSA-7w82-6f9j-v9jp (7.5, High) shows the path validator hard-coded /home/ and /Users/ as safe prefixes, so paths like ~/.ssh/id_rsa and ~/.aws/credentials were returned unblocked; the reporter confirmed exfiltrating simulated keys with a single HTTP POST to a consuming app. Source Source

6. Telerik Document Processing’s AI Agent Tools Allowed Path Traversal

Progress Telerik. Progress fixed two issues in Telerik Document Processing Libraries 2026.3.1027. CVE-2026-118038 (CVSS 3.1 7.1, High) is a path traversal in the library’s Convert and Merge AI agent tools: a low-privileged user who can supply tool arguments could read files outside the configured output directory, and overwrite writable ones, because relative paths resolved against the process working directory. CVE-2026-118036 (7.5, High) lets an unauthenticated attacker hang or crash the host through a crafted PDF or text submitted to RadPdfProcessing or the AI summarization and question-answering features. Source Source

7. MONAI Silently Skipped Integrity Checks on Model Downloads Without a Hash

MONAI. CVE-2026-118684 (CVSS 4.0 8.2, CVSS 3.1 5.9) affects the MONAI medical imaging AI framework before 1.6.1. Its check_hash() function returned success whenever no expected hash was supplied, and defaulted to MD5 otherwise, so bundles, datasets and model archives downloaded without a hash were never verified. An attacker with a man-in-the-middle position or control of a registry could substitute malicious files, potentially leading to code execution. Source