AI Threat AlertAPI
AI APIs are the boundary between the application and the model. Self-hosted inference servers (vLLM, Triton, Ollama, TGI) and third-party gateways (LiteLLM, OpenRouter) expose OpenAI-compatible endpoints, and the same web-app vulnerability classes appear here: missing or weak authentication on /v1/chat/completions, broken authorization between tenants, lack of rate limiting that lets an attacker drain quota or burn GPU time, and overly permissive CORS that leaks API keys from browser-side calls. The blast radius is unusual: a single auth-bypass on an inference endpoint exposes both data and compute, and in the case of paid hosted models, directly costs money. We have seen production CVEs across most popular self-hosted servers in the last 18 months. Defenses: require auth on every endpoint, per-tenant rate limits, separate key scopes for read vs admin, and pin server versions aggressively.
| Severity | CVE | Headline | Package | CVSS |
|---|---|---|---|---|
| MEDIUM | GHSA-pqh8-p93p-2rx7 | Dynatrace MCP server: DQL injection bypasses read-tool caps | 4.3 | |
| HIGH | GHSA-p7w7-4929-vpj5 | Dynatrace MCP server: unauth HTTP data exfil via DQL | @dynatrace-oss/dynatrace-mcp-server | 7.5 |
| MEDIUM | GHSA-xrmj-5g4g-8987 | Dynatrace MCP: Jinja injection creates persistent exfil | 4.2 | |
| MEDIUM | CVE-2026-68585 | SiYuan: metadata leak bypasses publish-access checks | github.com/siyuan-note/siyuan/kernel | 5.8 |
| CRITICAL | CVE-2026-69084 | SiYuan: SQL injection in search endpoint exposes notebooks | github.com/siyuan-note/siyuan/kernel | 10.0 |
| CRITICAL | CVE-2026-69085 | SiYuan: SQL injection in searchDocs allows DB tampering | github.com/siyuan-note/siyuan/kernel | 10.0 |
| HIGH | CVE-2026-69249 | cryptography: exponential DoS in cert chain validation | cryptography | - |
| MEDIUM | CVE-2026-16056 | Contest Gallery WP: broken auth leaks OpenAI prompts | 4.3 | |
| MEDIUM | CVE-2026-67618 | marimo: PEP-723 config injection steals API keys | 6.5 | |
| HIGH | CVE-2026-70485 | Open WebUI: NAT64 IPv6 trick bypasses SSRF filter, leaks metadata | open-webui | 7.1 |
| MEDIUM | CVE-2026-70484 | open-webui: image-gen permission bypass in chat API | open-webui | 4.3 |
| LOW | CVE-2026-70483 | Open WebUI: broken authz cancels other users' chats | open-webui | 3.1 |
| HIGH | CVE-2026-70482 | Open WebUI: OAuth token exchange enables takeover | open-webui | 8.1 |
| MEDIUM | CVE-2026-70481 | Open WebUI: members can edit/delete others' channel messages | open-webui | 5.4 |
| MEDIUM | GHSA-8gj2-2cvc-6xx7 | Flowise: missing auth on TTS drains owner's API budget | flowise | - |
| HIGH | CVE-2026-70474 | Flowise: missing workspace auth in OAuth2 credential routes | flowise | - |
| HIGH | CVE-2026-70472 | Flowise: broken auth exposes cross-tenant OpenAI keys | flowise | - |
| UNKNOWN | CVE-2026-70471 | Flowise: broken authZ leaks workspace secrets via sandbox | flowise | - |
| MEDIUM | CVE-2026-54020 | Open WebUI: DNS-rebind SSRF bypasses URL check | open-webui | 6.3 |
| MEDIUM | CVE-2026-70590 | Ghost: staff API leaks other staff password hashes | ghost | 4.8 |