A house newsletter · daily · researched and written by the Kurzia AI
Tuesday 3 November 2026 · Issue 3 · 4 min read
Langflow unauthenticated RCE — patch to 1.13.0; npm MCP package steals cloud credentials; 1,000+ GitLab servers still unpatched
Act on this first
Langflow — Two critical bugs in Langflow, the open-source framework for building agents and workflows, let someone with no account get past the login check or run their own code on the server. IBM, which now handles Langflow's vulnerability reports, disclosed them. All releases 1.0.0 through 1.12.8 are affected, and 1.13.0 is the only fixed version. No attacks have been reported and neither flaw is in CISA's exploited-vulnerabilities catalogue, so there is a patching window.
If you self-host Langflow anywhere reachable — internal networks included, since no login is needed — this is full server takeover, and Langflow installations typically hold API keys for models and data sources. Patch before scanners find it. No vendor advisory page is linked yet; the affected versions and the fix come from IBM's disclosure as reported. Check your deployment's version first, then upgrade to 1.13.0. The Hacker News
Affected: 1.0.0 through 1.12.8 · Fixed in: 1.13.0 · We had it 2 Nov, 23:06 UTC
Under attack
Ivanti Connect Secure — ICS 25.1.1.2 and prior, 22.8R2.5 and prior: chained zero-days CVE-2026-111357 and CVE-2026-118527 give attackers root; upgrade to 25.1.1.3 or 22.8R2.6 — earlier fixes miss these two.
Affected: 25.1.1.2 and prior; 22.8R2.5 and prior · Fixed in: 25.1.1.3 and 22.8R2.6 · We had it 3 Nov, 03:31 UTC
GitLab CE/EE — Below 19.4.2, 19.3.5 or 19.2.8: CVE-2026-97229 gives unauthenticated attackers code execution via crafted CI/CD regexes; over 1,000 exposed instances remain unpatched after the fix shipped.
Fixed in: 19.4.2, 19.3.5, 19.2.8 · We had it 3 Nov, 03:31 UTC
Node-RED — Instances without adminAuth: CVE-2026-58115 lets anyone deploy a flow that executes shell commands; VulnCheck canaries caught attempts dropping a bot and webshells — check external reachability.
Synology NAS — Devices on outdated DSM: C3RB3R ransomware encrypts data through flaws Synology patched long ago; update DSM and block internet access to the admin interface.
Holes in AI tools
@ifasn/mmdd-doc-mcp — A package posing as a Markdown table-of-contents MCP server is actually malware: at startup it performs a handshake with the Alibaba Cloud metadata endpoint (100.100.100.200), pulls the host instance's temporary RAM credentials into a local dump file, and ships scripts that enumerate /etc/shadow, /root/.ssh/id_rsa and the Kubernetes service-account token. There is no clean version — every published release is malicious.
This is the shape of supply-chain attacks aimed at AI developers: install one helper package on a cloud VM or cluster node and the machine's instance role is the prize. If it appears in a lockfile, treat that instance's cloud credentials as stolen and rotate them. OpenSSF published the finding as MAL-2026-18489; the advisory notes a code comment claiming "no network reporting" is a cover story. GitHub Advisory Database
Affected: every published version (see advisory for the list) · Fixed in: None · Disclosed 2 Nov · We had it 2 Nov, 23:04 UTC
“the operation is unauthorized reading of installer-side cloud instance-role credentials by a package whose declared purpose does not require any host metadata access”
DBHub (@bytebase/dbhub) — DBHub, an MCP server that gives AI assistants SQL access, checks queries for read-only mode with its own parser but then sends the original string to MySQL and MariaDB. The parser treats "--" as a comment start while those databases need a space after the dashes, so a payload like SELECT 1--1;DROP TABLE victim passes the read-only check and drops the table. PostgreSQL is unaffected; version 0.22.6 fixes it.
Anyone who can influence the text your assistant reads — prompt injection, in content the assistant processes — can run writes and destructive DDL against a database you deliberately exposed as read-only. If DBHub fronts MySQL or MariaDB for you, upgrade and re-verify the read-only guarantee actually holds. Reported by canolgun; rated Moderate, CVSS 6.1, no CVE assigned. GitHub Advisory Database
Affected: < 0.22.6 · Fixed in: 0.22.6 · Disclosed 2 Nov · We had it 2 Nov, 23:05 UTC
MCP quickstart configs — A GitHub issue on the MCP spec repository points out that the project's own beginner docs start every local server with `npx -y` and no version, contradicting the Local Server Security guide, which says to install a specific version. In a sample of 2,999 public repositories shipping agent skills or MCP configs, 46% of those configuring a local server start at least one unpinned, and 18% ask for `latest` outright.
An unpinned launch fetches whatever was published to npm most recently, which is exactly how a malicious package like the one above lands in your stack. Pin the version in every server entry you copy out of the docs. GitHub (modelcontextprotocol)
Agentic Backdoors via Pretraining Poisoning — Researchers pretrained Qwen3 models from scratch at 0.6B, 1.7B and 4B and showed that poisoning just 0.1% of the pretraining corpus plants a backdoor: the resulting CLI agent executes attacker-chosen shell commands when a trigger appears, while behaving normally otherwise. The effect strengthens with model scale and stays measurable at poisoning rates down to 0.0005%.
If you build agents on base models whose pretraining data you don't control, this is a reason to treat 'behaves normally in testing' as weak evidence — the trigger may simply not have fired yet. The poisoned base models were post-trained into agents through a clean pipeline, so the backdoor survives standard post-training. arXiv
Found or caused by AI
ARTEX / Vapor Panda — CrowdStrike reports Chinese-linked actors it tracks as Vapor Panda used ARTEX, an AI penetration-testing framework, against more than 200 organisations across 14 countries, with the agents doing reconnaissance, exploitation, web-shell deployment and credential work while a human operator stepped in at decision points. Separately, DIVD says the ARTEX agent that breached its own network chained two zero-days and reached root privileges in 12 minutes, issuing more than 450,000 requests on the way. This is automated intrusion at scale with evidence behind it — the agents skipped endpoint-protected hosts and pursued alternative attack paths, which changes how fast your unpatched software becomes someone's foothold. It is the argument for shrinking the backport backlog below. In one intrusion the agents consumed over 1.4 billion input tokens; DIVD also counted 2,500 scripts tied to the attack on its network.
Trail of Bits backport project — Trail of Bits is using Codex with GPT-5.6 to find security fixes that exist upstream but were never copied back to supported stable branches, with human engineers reviewing and submitting every patch. The effort has delivered fixes for 149 distinct CVEs into stable Linux kernel releases, plus fixes to Fedora and Ubuntu packages. The post also sizes the problem the agents are chewing through: the 5.10.y kernel branch alone counts 2,006 CVEs fixed in newer branches but missing there, and Debian 13 counts 4,562 unique unfixed CVEs across 1,128 source packages. That backlog is what AI-assisted attackers get to pick from — the same gap leaving Ubuntu servers on an unpatched TCP flaw.
Ubuntu's CVE-2026-98432 gap — Ubuntu lists every supported release, LTS included, as vulnerable to CVE-2026-98432 while Debian, Arch and Alpine shipped fixes; verify your fleet's exposure yourself. The kernel TCP flaw is remotely exploitable and Anthropic reportedly built a working exploit that gets root; the author writes that he took his Ubuntu servers offline while migrating.
VOLTA-AUTODOXER — A new Windows infostealer harvests passwords and cookies from Chromium browsers plus Outlook and Slack data, then hands the loot to LLMs — Claude, Gemini and Kimi are named — to rank each victim's data by monetization value. Cheap LLM triage turns indiscriminate credential dumps into targeted follow-up against the highest-value victims, so expect stolen-data buyers to get better at picking targets. Browser password stores, Outlook profiles and Slack workspaces are the exposure surface to watch here.
Patches worth knowing
AWS Serverless MCP Server — awslabs.aws-serverless-mcp-server below v0.2.1: traversal in the project-name input reads, and where enabled writes, JSON outside the status directory; fixed in v0.2.1 (CVE-2026-116635, rated Important).
Affected: < v0.2.1 · Fixed in: v0.2.1 · Disclosed 2 Nov · We had it 2 Nov, 23:05 UTC
QnABot on AWS — 7.0.0–7.4.5 with the optional Q Business hook deployed: authenticated users can read any S3 object; fixed in 7.4.6 plus hook redeployment (CVE-2026-105811).
Affected: 7.0.0 through 7.4.5 · Fixed in: 7.4.6 · Disclosed 2 Nov · We had it 2 Nov, 23:05 UTC
vLLM — vllm below 0.33.0: speculators_config in a served config.json redirects model and tokenizer to any named path; fixed in 0.33.0 (Moderate, CVSS 5.4).
Affected: < 0.33.0 · Fixed in: 0.33.0 · Disclosed 2 Nov · We had it 2 Nov, 23:05 UTC
One thing to do
Pin the versions in your MCP configs. Grep your agent and MCP configuration files for `npx -y` launches with no `@version`, and pin each one — for example `@modelcontextprotocol/[email protected]` — so an install can never pull whatever npm published last. Do it while the malicious-package story above is fresh; unpinned launches are exactly how that kind of package lands in your stack. GitHub (modelcontextprotocol)