AI Threat AlertAPI
AI APIs are the boundary between the application and the model. Self-hosted inference servers (vLLM, Triton, Ollama, TGI) and third-party gateways (LiteLLM, OpenRouter) expose OpenAI-compatible endpoints, and the same web-app vulnerability classes appear here: missing or weak authentication on /v1/chat/completions, broken authorization between tenants, lack of rate limiting that lets an attacker drain quota or burn GPU time, and overly permissive CORS that leaks API keys from browser-side calls. The blast radius is unusual: a single auth-bypass on an inference endpoint exposes both data and compute, and in the case of paid hosted models, directly costs money. We have seen production CVEs across most popular self-hosted servers in the last 18 months. Defenses: require auth on every endpoint, per-tenant rate limits, separate key scopes for read vs admin, and pin server versions aggressively.
| Severity | CVE | Headline | Package | CVSS |
|---|---|---|---|---|
| CRITICAL | CVE-2026-37004 | LiteLLM: unauth SSTI in /prompts/test enables RCE | litellm | 9.8 |
| LOW | CVE-2026-81836 | Roo-Code: cleartext OAuth callback leaks auth tokens | 3.7 | |
| HIGH | CVE-2026-55641 | 9router: Host-header spoof bypasses auth, enables SSRF | 9router | 8.2 |
| HIGH | CVE-2026-55638 | 9router: /codex bypass exposes LLM proxy credentials | 9router | 8.6 |
| HIGH | CVE-2026-82288 | SD WebUI: cmd-flags endpoint leaks creds cleartext | 7.5 | |
| HIGH | CVE-2026-18891 | Langflow: broken auth allows unauthorized flow execution | langflow | 8.2 |
| HIGH | CVE-2026-82639 | NextChat: proxy URL check bypass leaks OpenAI key | 7.5 | |
| MEDIUM | CVE-2026-82640 | browser-use web-ui: stores LLM API keys in cleartext | 5.5 | |
| HIGH | CVE-2026-71415 | Kirby CMS: auth bypass enables chunk-upload DoS | getkirby/cms | - |
| HIGH | CVE-2026-83551 | SageMaker: HMAC leak allows forged pipeline code execution | sagemaker | 7.2 |
| MEDIUM | CVE-2026-78608 | Kibana: missing authz leaks APM server credentials | 6.5 | |
| MEDIUM | CVE-2026-84377 | LiteLLM: param injection leaks provider API keys | litellm | 6.5 |
| MEDIUM | CVE-2026-7680 | COCO Annotator: path traversal exposes host files | 4.3 | |
| MEDIUM | CVE-2026-85173 | n8n: IDOR exposes workflow data across projects | n8n | - |
| HIGH | CVE-2026-85178 | Helicone: IDOR leaks cross-tenant LLM provider keys | 7.7 | |
| HIGH | CVE-2026-85211 | Label Studio: org filter bypass leaks tenant storage | label-studio | 7.7 |
| MEDIUM | CVE-2026-72800 | SiYuan: broken authz leaks DB schema & block IDs | github.com/siyuan-note/siyuan/kernel | 5.8 |
| MEDIUM | CVE-2026-72805 | SiYuan: auth bypass exposes private notebook content | github.com/siyuan-note/siyuan/kernel | 5.8 |
| HIGH | CVE-2026-68586 | SiYuan: missing authz leaks forbidden doc content via backlink API | github.com/siyuan-note/siyuan/kernel | 8.6 |
| HIGH | CVE-2026-69086 | SiYuan: path traversal leaks attribute-view data | github.com/siyuan-note/siyuan/kernel | 7.7 |