AI Threat AlertAPI
AI APIs are the boundary between the application and the model. Self-hosted inference servers (vLLM, Triton, Ollama, TGI) and third-party gateways (LiteLLM, OpenRouter) expose OpenAI-compatible endpoints, and the same web-app vulnerability classes appear here: missing or weak authentication on /v1/chat/completions, broken authorization between tenants, lack of rate limiting that lets an attacker drain quota or burn GPU time, and overly permissive CORS that leaks API keys from browser-side calls. The blast radius is unusual: a single auth-bypass on an inference endpoint exposes both data and compute, and in the case of paid hosted models, directly costs money. We have seen production CVEs across most popular self-hosted servers in the last 18 months. Defenses: require auth on every endpoint, per-tenant rate limits, separate key scopes for read vs admin, and pin server versions aggressively.
| Severity | CVE | Headline | Package | CVSS |
|---|---|---|---|---|
| HIGH | GHSA-g5ff-637f-6q2m | LiteLLM: file read via vertex_ai_credentials alias | litellm | 8.1 |
| MEDIUM | GHSA-hhww-mrg2-969h | LiteLLM: reflected XSS in SSO debug callback | litellm | 6.8 |
| CRITICAL | CVE-2026-48705 | MONAI: NaN/inf DICOM input causes DoS and corrupt inference | monai | 9.3 |
| MEDIUM | CVE-2026-60083 | SiYuan: MCP file tool leaks publish-share passwords | github.com/siyuan-note/siyuan/kernel | 4.9 |
| MEDIUM | GHSA-c8m5-c952-6cm4 | rustls: Debug on client session leaks TLS secrets | rustls | 4.0 |
| LOW | GHSA-h2v8-394m-p7vv | rustls: Brotli cert decoder allows 1 GiB alloc DoS | rustls | 3.7 |
| HIGH | CVE-2026-116690 | MLflow: path traversal exposes server files via prompts | mlflow | 7.5 |
| CRITICAL | CVE-2026-116692 | MLflow: scorer deserialization allows unauthenticated RCE | mlflow | 9.8 |
| HIGH | CVE-2026-116693 | dd-trace: ReDoS in query string obfuscation causes DoS | - | |
| MEDIUM | CVE-2026-111372 | WoowBot: missing authz lets subscribers drain AI API credits | wpbot | 4.3 |
| MEDIUM | CVE-2026-118667 | LangGraph SDK: path traversal in v3 stream helpers | langgraph | 4.3 |
| HIGH | CVE-2026-118668 | LangGraph API: Store namespace rewrite bypass in JS auth | langgraph | - |
| HIGH | CVE-2026-102590 | Langflow: SSRF allows authenticated info disclosure | langflow | 7.7 |
| MEDIUM | CVE-2026-104310 | Langflow: SSRF allows authenticated info disclosure | langflow | 4.3 |
| MEDIUM | CVE-2026-104314 | Langflow: flow share grant leaks owner's cleartext credentials | langflow | 6.5 |
| MEDIUM | CVE-2026-104315 | Langflow: SSRF allows authenticated internal network probing | langflow | 4.3 |
| MEDIUM | CVE-2026-110192 | Langflow: weak credential protection exposes secrets | langflow | 6.5 |
| HIGH | CVE-2026-110245 | Langflow: improper authentication exposes sensitive data | langflow | 7.5 |
| MEDIUM | CVE-2026-90991 | Langflow: unbounded resource allocation enables DoS | langflow | 6.5 |
| MEDIUM | CVE-2026-114406 | Red Hat CA store: weak eMudhra intermediates enable TLS MITM | rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9 | 6.8 |