// stack
AI / LLM tooling
Security incidents affecting lLM gateways, agent builders and ML platforms. Newest first.
- incidents
- 13
- live
- 3
- patched
- 12
## 13 AI / LLM tooling incidents in the last year
through Oct 22, 2026- criticallivepatchedsince Oct 21, 2026
LiteLLM 1.107.0 PyPI/Docker supply-chain compromise
› LiteLLM (PyPI + official Docker/GHCR images)
On Oct 21 2026 attackers compromised LiteLLM’s release pipeline and published malicious litellm==1.107.0 to PyPI (live ~2 hours) plus compromised Docker Hub/GHCR tags (v1.107.0, latest, main-latest, main-stable). The wheels install cook.pth / cook.py / sitecustomize.py that steal cloud, developer and AI-tool credentials at every Python startup and open a remote-code loader. Second LiteLLM compromise of 2026.
MAL-2026-2144 - criticallivepatchedsince Oct 19, 2026
OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)
› OpenCode AI coding agent (Anomaly) on Windows and WSL
A command-injection flaw in the OpenCode AI coding agent let a malicious or later-hijacked remote MCP server run PowerShell commands on a developer's Windows or WSL machine when they started the MCP OAuth sign-in. The server-supplied authorization endpoint was passed unescaped to an old version of the open package. Anomaly fixed it in 1.18.33 on Sep 28 without a CVE or advisory, so scanners won't flag 1.0.137 through 1.18.32. macOS and Linux are not affected. Pillar Security found it and rates it 9.8; no in-the-wild exploitation reported.
- highlivepartial fixsince Oct 17, 2026
OpenCode Console breach exposes users' saved OpenAI / Anthropic / Google API keys
› OpenCode Console (hosted service by Anomaly)
On the night of Oct 16 2026 an intruder reached a legacy OpenCode Console system that was being decommissioned and may have exposed third-party AI provider keys saved in Console workspaces. OpenCode says 1.4% of Console users (those with external providers linked) were affected and tied it to a large-scale distillation attack. Users reported unauthorized charges up to ~$1,700 and some Google Cloud project suspensions. Anthropic and Google revoked/blocked exposed keys; OpenAI refunded drawn credits. The OpenCode app itself (local keys) was not affected.
show 10 older incidents10 older incidents
September 2026 1
highBerriAI LiteLLM: BerriAI LiteLLM Improper Authentication Vulnerabilitypatched
› BerriAI LiteLLM patched
BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token. Added to CISA KEV on 2026-09-02.
open incident →CVE-2026-59822
August 2026 3
highMLflow MLflow: MLflow Server-Side Request Forgery Vulnerabilitypatched
› MLflow MLflow patched
MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body. Added to CISA KEV on 2026-08-19.
open incident →CVE-2026-64849highRay-Project Ray: Ray-Project Ray Code Injection Vulnerabilitypatched
› Ray-Project Ray patched
Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari. Added to CISA KEV on 2026-08-17.
open incident →CVE-2025-62593highIBM Langflow: IBM Langflow Code Injection Vulnerabilitypatched
› IBM Langflow patched
Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments. Added to CISA KEV on 2026-08-04.
open incident →CVE-2026-9198
July 2026 2
highLangflow Langflow: Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerabilitypatched
› Langflow Langflow patched
Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations. Added to CISA KEV on 2026-07-21.
open incident →CVE-2026-0770highLangflow Langflow: Langflow Authorization Bypass Through User-Controlled Key Vulnerabilitypatched
› Langflow Langflow patched
Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. Added to CISA KEV on 2026-07-07.
open incident →CVE-2026-55255
June 2026 1
highBerriAI LiteLLM: BerriAI LiteLLM Command Injection Vulnerabilitypatched
› BerriAI LiteLLM patched
BerriAI LiteLLM contains a command injection vulnerability that could allow any authenticated user, including holders of low-privilege internal-user keys, to run arbitrary commands on the host. CISA added CVE-2026-42271, CVE-2026-48710 to the Known Exploited Vulnerabilities catalog on 2026-06-08 based on evidence of active exploitation.
open incident →CVE-2026-42271 · CVE-2026-48710
May 2026 2
highLangflow Langflow: Langflow Origin Validation Error Vulnerabilitypatched
› Langflow Langflow patched
Langflow contains an origin validation error vulnerability in which an overly permissive CORS configuration combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. This could allow the attacker to execute arbitrary code and achieve full system compromise via obtained tokens that permit access to authenticated endpoints. Added to CISA KEV on 2026-05-21.
open incident →CVE-2025-34291highBerriAI LiteLLM: BerriAI LiteLLM SQL Injection Vulnerabilitypatched
› BerriAI LiteLLM patched
BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from the proxy's database and potentially modify it, leading to unauthorized access to the proxy and the credentials it manages. Added to CISA KEV on 2026-05-08.
open incident →CVE-2026-42208
March 2026 1
highLangflow Langflow: Langflow Code Injection Vulnerabilitypatched
› Langflow Langflow patched
Langflow contains a code injection vulnerability that could allow building public flows without requiring authentication. Added to CISA KEV on 2026-03-25.
open incident →CVE-2026-33017
