AI Threat AlertAPI
AI APIs are the boundary between the application and the model. Self-hosted inference servers (vLLM, Triton, Ollama, TGI) and third-party gateways (LiteLLM, OpenRouter) expose OpenAI-compatible endpoints, and the same web-app vulnerability classes appear here: missing or weak authentication on /v1/chat/completions, broken authorization between tenants, lack of rate limiting that lets an attacker drain quota or burn GPU time, and overly permissive CORS that leaks API keys from browser-side calls. The blast radius is unusual: a single auth-bypass on an inference endpoint exposes both data and compute, and in the case of paid hosted models, directly costs money. We have seen production CVEs across most popular self-hosted servers in the last 18 months. Defenses: require auth on every endpoint, per-tenant rate limits, separate key scopes for read vs admin, and pin server versions aggressively.
| Severity | CVE | Headline | Package | CVSS |
|---|---|---|---|---|
| MEDIUM | CVE-2026-79723 | Langflow: SSRF via unvalidated API endpoints leaks data | langflow | 5.0 |
| HIGH | CVE-2026-81268 | Langflow: stale API keys survive user deactivation | langflow | 8.1 |
| HIGH | CVE-2026-71416 | Headroom: CSWSH bypass allows unauthenticated LLM abuse | headroom-ai | 8.8 |
| HIGH | CVE-2026-59148 | Mockoon: unauth admin API leaks secrets, hijacks mocks | @mockoon/cli | 8.8 |
| MEDIUM | CVE-2026-87918 | WPBot: unauthenticated AJAX abuse drains AI API budget | WPBot | 5.3 |
| MEDIUM | CVE-2026-90555 | vLLM: FLAC header spoofing crashes transcription API | vllm | 6.5 |
| HIGH | CVE-2026-90535 | Flowise: IDOR in abort API enables agent DoS | flowise | 7.5 |
| MEDIUM | CVE-2026-90580 | Flowise: SSRF via Host/X-Forwarded-Proto in Evaluations | flowise | 6.3 |
| CRITICAL | CVE-2026-57127 | PraisonAI: auth middleware fails open, exposes agents | praisonai | 9.8 |
| CRITICAL | CVE-2026-57131 | PraisonAI: no-auth API exposes agent execution | praisonai | 9.8 |
| HIGH | CVE-2026-57132 | PraisonAI: auth bypass on agent invoke endpoint | praisonai | 8.2 |
| HIGH | CVE-2026-50270 | dd-trace-java: baggage header parsing causes DoS | 7.5 | |
| MEDIUM | CVE-2026-12765 | Langflow: unauthenticated SSRF enables internal network probing | langflow | 6.5 |
| MEDIUM | CVE-2026-12766 | Langflow: SSRF allows internal network probing | langflow | 5.4 |
| MEDIUM | CVE-2026-12767 | Langflow: unauthenticated SSRF enables internal probing | langflow | 6.5 |
| MEDIUM | CVE-2026-73497 | MCP Atlassian: DNS rebinding SSRF reaches cloud metadata | mcp-atlassian | 6.5 |
| MEDIUM | CVE-2026-90878 | vLLM: chat_template abuse causes resource exhaustion | vllm | 4.3 |
| CRITICAL | CVE-2026-57140 | PraisonAI: unauthenticated AgentOS API exposes agents | praisonai | 9.4 |
| CRITICAL | CVE-2026-57147 | PraisonAI: hardcoded JWT secret allows auth bypass | praisonai | 9.8 |
| CRITICAL | CVE-2026-57148 | PraisonAI: hardcoded JWT secret enables auth bypass | praisonai | 9.8 |