AI Security News: October 30, 2026

1. IBM Discloses 33 Langflow CVEs, Including Critical Unauthenticated RCE and an Agentic Assistant Bypass

IBM Langflow. IBM’s PSIRT published 33 CVEs for Langflow OSS 1.0.0 through 1.12.8 on October 29, with the fix in Langflow 1.13.0. The most severe are CVE-2026-93680 (CVSS 3.1 9.8), an improper authentication flaw that lets a remote attacker bypass security restrictions; CVE-2026-110186 (9.8), unauthenticated code execution through improper control of code generation; CVE-2026-104339 (9.8), OS command injection; and three 9.9 issues (CVE-2026-107327, CVE-2026-107328, CVE-2026-107329) that let authenticated users run code through missing authorization and eval/exec handling. CVE-2026-110193 (8.8) shows a low-privileged user can make Langflow’s Agentic Assistant generate or submit component code using unblocked patterns, leading to OS command execution on the server. Others cover deserialization RCE, SSRF, path traversal, and cleartext exposure of a flow owner’s stored third-party credentials to users with only a read or share grant (CVE-2026-104314). IBM lists no workarounds and recommends upgrading to 1.13.0. Source Source Source

2. Wiz Documents Seven Fingerprints of Agent-Driven Intrusions

Wiz. Wiz researcher Avigayil Mechtinger published an analysis of intrusions where AI agents do most of the hands-on work under human-set objectives. Wiz describes three cases it observed: an exposed Flowise instance where an agent produced about 99 scripts in 24 hours and used the host to mass-exploit other Flowise servers; 602 steps across 12 technique families against a Java operations gateway in about 4.5 hours; and an attack on an AI-agent GraphQL backend that targeted roughly 25 organizations, including crypto exchanges, and stole cloud and Kubernetes credentials. The post lists seven signals of agentic activity, including machine-paced iteration, natural-language reasoning embedded in scripts, self-correcting versioned scripts, and breadth-first coverage. Wiz notes that such attacks are currently noisy, which favors behavioral detection, while shared agent tooling makes attribution through code similarity less reliable. Source

3. Prompt Injection Could Make Agno’s PandasTools Call read_pickle for Code Execution

Agno. CVE-2026-119050 (CVSS 4.0 9.2, CVSS 3.1 8.1), disclosed by VulnCheck, affects Agno through 3.1.11. The PandasTools toolkit passed model-controlled function names to getattr() on the pandas module, so an attacker who can influence the agent through prompt injection could have it call pandas.read_pickle on an attacker-controlled path for code execution, or use other pandas readers to read local files. The issue is tracked in Agno issue 8699. This is a separate flaw from the FunctionCall eval() issue disclosed earlier in the week. Source

4. ServiceNow Fixes a Critical Sandbox Escape in Its AI Platform

ServiceNow. CVE-2026-103093 (CVSS 4.0 9.4, Critical) lets an authenticated user with the admin role bypass Rhino sandbox restrictions in the ServiceNow AI Platform and run arbitrary code on the underlying host operating system. A second issue, CVE-2026-103094 (7.1, High), could cause a user’s plaintext password to be stored in a system table where users without entitlement could view it. ServiceNow says hosted instances have been updated, patches went to partners and self-hosted customers (KB3228994), and it is not aware of exploitation. Source Source

5. A PDF Reader MCP Server Ignored Its Own API Key, and a Chatbot Proxy Forwarded Admin Credentials

MCP and chatbot middleware. CVE-2026-62264 (GHSA-q344-5v34-gm84, CVSS 3.1 7.5, High) affects @sylphx/pdf-reader-mcp 2.2.0 up to 3.0.1: in HTTP transport mode the server read MCP_API_KEY and logged that API key authentication was enabled, but never checked the X-API-Key header. Combined with a default bind of 0.0.0.0, anyone who could reach the port could invoke every PDF tool and read any PDF the process could open. Version 3.0.1 enforces the key and defaults to loopback. Separately, GHSA-w9x9-j56r-h98r (8.2, High) shows @eeacms/volto-chatbot through 2.0.3 exposed an unauthenticated /_v1_da/ route that proxied any method and path to the upstream Danswer API while attaching the server’s service credentials, letting attackers call privileged admin endpoints. It is fixed in 2.0.4. Source Source

6. PraisonAI’s Inline Python Sandbox Allowed import os

PraisonAI. CVE-2026-61438 (GHSA-26mh-57q7-jfvr, CVSS 3.1 7.3, High) affects the PraisonAI multi-agent framework before 4.6.78. JobWorkflowExecutor._exec_inline_python() validated YAML workflow script: steps against an AST allowlist, but the module allowlist included os and the AST rules permitted imports, calls and attribute access, so import os; os.system(...) passed validation. Any user or CI pipeline running an untrusted workflow with PRAISONAI_ALLOW_JOB_WORKFLOWS=true would execute arbitrary commands. The advisory flags downloaded templates and AI-generated workflows as likely vectors. Source

7. Crawl4AI Let Clients Pick Which Hugging Face Model the Server Loads, and llama.cpp’s RPC Server Could Be Crashed

Crawl4AI and llama.cpp. CVE-2026-119120 (CVSS 4.0 7.7, CVSS 3.1 7.5) affects Crawl4AI 0.9.0 before 0.9.5: the Docker API did not filter the CosineStrategy model_name field, so authenticated clients could point the server at a malicious Hugging Face repository with a pickle weight file and run Python code under PyTorch versions below 2.6, or exhaust disk and memory. VulnCheck also disclosed CVE-2026-119052 (CVSS 4.0 8.7), an uncaught exception in llama.cpp’s ggml-rpc server from b2877 before b11935: after the HELLO handshake, an unauthenticated attacker can send a command such as SET_TENSOR with an oversized length, aborting the process and denying service to all clients. Source Source

8. Cross-Tenant Leaks in SuperAGI and Path Traversal in agent-zero

Agent platforms. Three CVEs for SuperAGI up to v0.0.14 (CVE-2026-51902, CVE-2026-51903, CVE-2026-51905) describe agent controller endpoints that accept a project_id or agent_id without checking organization ownership, letting an authenticated user from one organization list another organization’s agents, read their latest execution metadata, and read their agent execution configurations. CVE-2026-51851 covers agent-zero 1.7 through 1.10, where FileBrowser.save_text_file accepted user-controlled paths without normalization, allowing directory traversal writes. No CVSS scores had been assigned at publication. Source Source

9. Drupal’s AI Module Gets Eight Security Advisories

Drupal. Drupal published eight CVEs for its AI (Artificial Intelligence) contributed module on October 30, affecting versions through 1.4.11 and 1.5.0 through 1.5.2 (SA-CONTRIB-2026-266 through 273). They include five cross-site scripting issues, an incorrect authorization flaw allowing resource injection (CVE-2026-118548), insecure storage of sensitive information (CVE-2026-118551), and sensitive data exposure through the browser cache (CVE-2026-118550). Related Drupal modules SmartLinker AI (CVE-2026-107307) and AI File to Text (CVE-2026-114554) received incorrect authorization advisories in the same batch. Source