AI Threat AlertAPI
AI APIs are the boundary between the application and the model. Self-hosted inference servers (vLLM, Triton, Ollama, TGI) and third-party gateways (LiteLLM, OpenRouter) expose OpenAI-compatible endpoints, and the same web-app vulnerability classes appear here: missing or weak authentication on /v1/chat/completions, broken authorization between tenants, lack of rate limiting that lets an attacker drain quota or burn GPU time, and overly permissive CORS that leaks API keys from browser-side calls. The blast radius is unusual: a single auth-bypass on an inference endpoint exposes both data and compute, and in the case of paid hosted models, directly costs money. We have seen production CVEs across most popular self-hosted servers in the last 18 months. Defenses: require auth on every endpoint, per-tenant rate limits, separate key scopes for read vs admin, and pin server versions aggressively.
| Severity | CVE | Headline | Package | CVSS |
|---|---|---|---|---|
| MEDIUM | CVE-2026-55430 | Coder: X-Forwarded-Host spoof leaks victim app data | github.com/coder/coder/v2 | 5.8 |
| HIGH | CVE-2026-55429 | Coder: cross-workspace agent hijack via app ID reuse | github.com/coder/coder/v2 | 8.7 |
| HIGH | CVE-2026-55076 | Coder: OIDC type-confusion enables account takeover | github.com/coder/coder/v2 | 7.4 |
| MEDIUM | CVE-2026-34225 | open-webui: blind SSRF via image-edit URL fetch | open-webui | 4.3 |
| HIGH | CVE-2026-48957 | Joomla: broken access control exposes com_privacy data | 8.8 | |
| HIGH | CVE-2026-53518 | better-auth: race condition mints duplicate OAuth tokens | 8.1 | |
| CRITICAL | CVE-2026-59706 | mem0: unauth config API leaks API keys + SSRF | 9.3 | |
| MEDIUM | CVE-2026-56778 | n8n: workflow:read scope triggers executions via API | n8n | 6.4 |
| MEDIUM | CVE-2026-59819 | LiteLLM: admin-scope local file read via OIDC ref | litellm | 4.9 |
| MEDIUM | CVE-2026-59820 | LiteLLM: Zip Slip in Skills upload allows file write | litellm | 6.5 |
| HIGH | CVE-2026-59821 | LiteLLM: code exec via unsandboxed Custom Guardrails | litellm | 7.2 |
| HIGH | CVE-2026-59822 | LiteLLM: MCP auth bypass via fabricated OAuth header | litellm | 8.2 |
| HIGH | CVE-2026-59806 | Gradio: SSRF via file_fetch() leaks cloud IAM creds | gradio | 7.4 |
| HIGH | CVE-2026-49471 | Serena: unauth dashboard API enables RCE via memory poisoning | serena-agent | 8.3 |
| HIGH | CVE-2026-59206 | n8n: prototype pollution lets guests hit admin APIs | n8n | 7.1 |
| MEDIUM | CVE-2026-59209 | n8n: editor-level access leaks credential headers | n8n | 6.5 |
| MEDIUM | CVE-2026-59227 | Open WebUI: image-edit API bypasses admin permission gate | open-webui | 4.3 |
| MEDIUM | CVE-2026-59217 | Open WebUI: read-only users can inject files into RAG KBs | open-webui | 4.3 |
| LOW | CVE-2026-59213 | Open WebUI: cache leak exposes cross-user model lists | open-webui | 3.5 |
| HIGH | CVE-2026-59219 | Open WebUI: revoked JWTs bypass WebSocket auth | open-webui | 7.1 |