🚨 17 CVEs across 12 AI agent frameworks — one disclosure wave, same three design failures.
6× CVSS 9.8 unauthenticated RCE:
- Piflow: POST /chat → exec_shell, no auth
- Langchain-Chatchat: /tools/call invokes shell tool, no auth
- DB-GPT: mock auth grants everyone admin
- Letta: compose.yaml omits LETTA_SERVER_SECURE, all routes open
- Cognition: no auth on REST/SSE API (fixed: 0.13.0)
5× 8.8: approval gates return True, unsandboxed python3, async sub-agents skip interrupt_on.
2× 8.3 IDOR: IBM Langflow OSS (fixed: 1.12.5), Coze Studio (fixed: 0.5.2).
7 products have no published fix. Put an auth proxy in front, bind DB ports to localhost, and rotate every secret in the execution environment.
https://threataft.com/articles/ai-agent-framework-rce-mega-cluster-17-cves
ThreatAftAI Agent RCE Cluster: 17 CVEs, Auth Defaults Off | ThreatAft17 AI agent framework CVEs in one disclosure wave: auth defaults off, sandboxing absent, approval gates bypassable. Full CVE list and fixes.