The software that builds, serves and orchestrates AI models has become one of the most actively exploited categories in the CISA Known Exploited Vulnerabilities catalog, yet many teams still track it outside their normal vulnerability programme. This tracker lists significant CVEs in AI and machine learning frameworks, agent builders, AI gateways, inference servers, ML platforms and model-loading libraries, with the fixed version, exploitation status and the credentials typically exposed. Every entry is taken from the CVE record published through the CVE Program (CVEProject cvelistV5) and, where listed, the CISA KEV catalog. It is for vulnerability managers, platform and MLOps engineers and security architects who need to know which AI components to patch first. Last reviewed: November 2026 (CISA KEV catalog version 2026.11.06).
Key takeaways
- Agent builders lead the exploited list. Langflow alone has six entries in the CISA KEV catalog, most of them unauthenticated code execution through endpoints that run user-supplied Python.
- AI gateways hold the keys. Three LiteLLM CVEs are in KEV; a compromised gateway exposes every model provider API key and MCP server credential it brokers.
- Model loading is code execution. PyTorch torch.load with weights_only=True (CVE-2025-32434) and Keras safe_mode=True (CVE-2025-1550) were both bypassed: "safe" loading flags are not a substitute for trusted model sources.
- Developer tools are attack surface. MCP Inspector, mcp-remote and Ray's dashboard were exploitable from a browser or a malicious server, putting developer laptops and their cloud credentials in scope.
- KEV deadlines are short. Several AI entries were added with a three-day remediation due date for US federal agencies. Treat KEV-listed AI components as emergency patches regardless of sector.
Status key
- Exploited (KEV): listed in the CISA Known Exploited Vulnerabilities catalog, meaning CISA has reliable evidence of exploitation in the wild. The date shown is the date added.
- Published, fix available: CVE record published with a fixed version or revision; no KEV listing at the time of review.
- Disputed: the CVE record carries a dispute tag or a note that the vendor does not accept the report as a vulnerability.
- Vendor-side fix: a cloud service vulnerability fixed by the provider, with no customer patch.
Severity is the CNA's base score in the CVE record (CVSS v3.x or v4.0 as published; the two versions are not directly comparable). Products are listed alphabetically within each table; order is not a ranking.
Agent and workflow builders
| CVE | Product | Weakness (from the record) | Affected and fixed | Score | Status |
|---|---|---|---|---|---|
| CVE-2025-6514 | mcp-remote | OS command injection from a crafted authorization_endpoint URL when connecting to an untrusted MCP server | 0.0.5 to 0.1.15 | 9.6 (v3.1) | Published |
| CVE-2025-49596 | MCP Inspector | No authentication between Inspector client and proxy, allowing remote code execution | Below 0.14.1; fixed 0.14.1 | 9.4 (v4.0) | Published, fix available |
| CVE-2025-3248 | Langflow | Code injection in /api/v1/validate/code, remote and unauthenticated | Before 1.3.0 | 9.8 (v3.1) | Exploited (KEV 5 May 2025; known ransomware use) |
| CVE-2025-34291 | Langflow | Permissive CORS with credentials plus SameSite=None refresh cookie, chained to account takeover and code execution | Up to and including 1.6.9 | 9.4 (v4.0) | Exploited (KEV 21 May 2026) |
| CVE-2026-0770 | Langflow | exec_globals inclusion of functionality from an untrusted control sphere, unauthenticated code execution | 1.4.2 listed as affected (ZDI record) | 9.8 (v3.0) | Exploited (KEV 21 July 2026) |
| CVE-2026-9198 | Langflow (IBM Langflow OSS) | /api/v1/auto_login mints superuser tokens, chained with /api/v1/validate/code for code execution on default deployments | 1.0.0 through 1.10.0 | 9.8 (v3.1) | Exploited (KEV 4 August 2026) |
| CVE-2026-33017 | Langflow | Unauthenticated build of public flows via /api/v1/build_public_tmp/{flow_id}/flow, code injection | Before 1.9.0 | 9.3 (v4.0) | Exploited (KEV 25 March 2026) |
| CVE-2026-55255 | Langflow | IDOR in /api/v1/responses lets an authenticated user execute another user's flow | Before 1.9.1 | 8.4 (v3.1) | Exploited (KEV 7 July 2026) |
| CVE-2025-68664 | LangChain | Serialisation injection in dumps() and dumpd(): dictionaries with "lc" keys not escaped | Before 0.3.81 and, on 1.x, before 1.2.5 | 9.3 (v3.1) | Published, fix available |
| CVE-2025-68613 | n8n | Workflow expression evaluation lets authenticated users execute code | 0.211.0 to before 1.120.4; fixed 1.120.4, 1.121.1, 1.122.0 | 10.0 (v3.1) | Exploited (KEV 11 March 2026) |
| CVE-2024-6091 | AutoGPT | Shell command denylist bypass | 0.5.1 | 9.8 (v3.0) | Published |
The pattern is consistent: visual builders expose an endpoint that executes Python for validation or custom components, and default deployments ship with auto-login or weak authentication. See the Flowise and Langflow Security Guide, the n8n Security Guide and the MCP Security Guide.
AI gateways and inference servers
| CVE | Product | Weakness (from the record) | Affected and fixed | Score | Status |
|---|---|---|---|---|---|
| CVE-2026-42208 | LiteLLM | SQL injection: caller-supplied key mixed into the query text during proxy API key checks | 1.81.16 to before 1.83.7 | 9.3 (v4.0) | Exploited (KEV 8 May 2026) |
| CVE-2026-42271 | LiteLLM | Command injection through MCP server preview endpoints /mcp-rest/test/connection and /mcp-rest/test/tools/list | 1.74.2 to before 1.83.7 | 8.7 (v4.0) | Exploited (KEV 8 June 2026) |
| CVE-2026-59822 | LiteLLM | MCP Streamable HTTP endpoint: fabricated Authorization header triggers an OAuth2 passthrough fallback, unauthenticated access | Before 1.84.0 | 8.8 (v4.0) | Exploited (KEV 2 September 2026) |
| CVE-2024-50050 | Llama Stack (Meta) | pickle used for socket communication, potential remote code execution; changed to JSON | Before revision 7a8aa775 | Not scored by CNA | Published, fix available |
| CVE-2025-23319 | NVIDIA Triton Inference Server | Out-of-bounds write in the Python backend via a request; possible code execution | All versions prior to 25.07 | 8.1 (v3.1) | Published, fix available |
| CVE-2024-37032 | Ollama | Model blob digest format not validated, allowing path traversal (../) | Before 0.1.34 | Not scored by CNA | Published, fix available |
| CVE-2025-47277 | vLLM | Exposure through the PyNcclPipe KV cache transfer integration with the V0 engine only | 0.6.5 to 0.8.4; fixed 0.8.5 | 9.8 (v3.1) | Published, fix available |
The LiteLLM KEV entries are discussed in the LiteLLM Proxy Security Guide; inference server hardening is covered in the vLLM, Triton and NVIDIA NIM Inference Server Security Guide.
ML platforms and compute clusters
| CVE | Product | Weakness (from the record) | Affected and fixed | Score | Status |
|---|---|---|---|---|---|
| CVE-2024-27132 | MLflow | XSS from unsanitised template variables when running an untrusted recipe, leading to client-side code execution in Jupyter | Up to 2.9.2 | 7.5 (v3.1) | Published |
| CVE-2026-64849 | MLflow | Server-side request forgery through the unauthenticated webhook test endpoint POST /api/2.0/mlflow/webhooks/{id}/test | 3.3.0 to before 3.15.0 | 9.3 (v3.1) | Exploited (KEV 19 August 2026) |
| CVE-2023-48022 | Ray (Anyscale) | Code execution via the job submission API | Ray 2.6.3 and 2.8.0 named in the record | Not scored by CNA | Disputed (vendor says Ray is not intended for use outside a strictly controlled network) |
| CVE-2025-62593 | Ray | Insufficient guard against browser-based attacks; RCE against developers via Firefox and Safari | Before 2.52.0 | 9.4 (v4.0) | Exploited (KEV 17 August 2026) |
The disputed Ray CVE shows why dispute tags should not lower priority on their own: the ShadowRay 2024 campaign exploited CVE-2023-48022 on internet-exposed Ray clusters, and Oligo Security reported theft of OpenAI, Hugging Face, Stripe and Slack tokens, cloud access and database credentials. If the vendor's position is "do not expose this", the control is network isolation, and an exposed instance is a finding. See the Ray and AI Compute Cluster Security Guide and the MLflow and Kubeflow Security Guide.
Model loading and serialisation libraries
| CVE | Product | Weakness (from the record) | Affected and fixed | Score | Status |
|---|---|---|---|---|---|
| CVE-2024-3568 | Hugging Face transformers | Deserialisation of untrusted data in load_repo_checkpoint() of TFPreTrainedModel | Versions before 4.38 | 3.4 (v3.0) | Published, fix available |
| CVE-2025-1550 | Keras | Model.load_model allows code execution even with safe_mode=True via a crafted .keras archive config.json | 3.0.0 to before 3.8.0 | 7.3 (v4.0) | Published, fix available |
| CVE-2025-32434 | PyTorch | Remote command execution when loading a model with torch.load and weights_only=True | 2.5.1 and prior; fixed 2.6.0 | 9.3 (v4.0) | Published, fix available |
OWASP's Top 10 for LLM Applications 2025 lists outdated or deprecated components and vulnerable pre-trained models under LLM03:2025 Supply Chain, and MITRE ATLAS records the model route as AML.T0010.003 (AI Supply Chain Compromise: Model). Prefer weight-only formats such as safetensors, load models only from an approved registry, and scan model files before they reach production. See the Model Supply Chain Guide.
AI assistants and cloud AI services
| CVE | Product | Weakness (from the record) | Affected and fixed | Score | Status |
|---|---|---|---|---|---|
| CVE-2025-32711 | Microsoft 365 Copilot | AI command injection allowing an unauthorised attacker to disclose information over a network | Service | 9.3 (v3.1) | Vendor-side fix |
Service-side AI CVEs need no patch but still need a response: review what data the assistant could reach and whether logs show the pattern. For agent and MCP incidents beyond CVEs, use the AI Agent Security Incidents Tracker.
Where identity and NHI exposure fits
Almost every exploited entry above ends in credential theft, because AI components are credential concentrators.
| Component type | Credentials typically within reach after compromise | Containment control |
|---|---|---|
| Agent builder (Langflow, n8n) | Model provider API keys stored in flows, database connection strings, SaaS OAuth tokens used by tools | Store secrets in a vault reference, not in flows; separate service identity per workflow; rotate on any KEV listing |
| AI gateway (LiteLLM) | Gateway master key, virtual keys, upstream provider keys, MCP server credentials | Never run with the default master key; short-lived upstream credentials; network-restrict admin routes |
| Compute cluster (Ray) | Cloud instance role credentials, object storage keys, tokens in job environment variables | Private network only, workload identity with least privilege, no long-lived keys in job environments |
| ML platform (MLflow) | Artifact store credentials, cloud metadata reachable through SSRF | Block instance metadata from the server, IMDSv2 or equivalent, egress allow-list |
| Developer tools (MCP Inspector, mcp-remote, Ray dashboard) | Developer's cloud CLI sessions, Git tokens, local .env files | Bind to localhost with authentication, keep tools updated, short-lived developer credentials |
After patching a KEV-listed AI component, assume the credentials it held were exposed: rotate them and review their use. MITRE ATT&CK records the entry technique as T1190 Exploit Public-Facing Application and the follow-on as T1552.001 Credentials In Files.
Mapping to frameworks
| Framework | Reference | Relevance to this tracker |
|---|---|---|
| NIST SP 800-53 Rev. 5 | RA-5 Vulnerability Monitoring and Scanning; SI-2 Flaw Remediation; SR-3 Supply Chain Controls and Processes | Scan and patch AI components like any other software; treat model and package sources as supply chain |
| NIST CSF 2.0 | ID.RA-01, ID.RA-08, PR.PS-02 | Identify AI component vulnerabilities, receive disclosures, maintain or remove software by risk |
| OWASP Top 10 for LLM Applications 2025 | LLM03:2025 Supply Chain | Outdated components and vulnerable pre-trained models |
| MITRE ATLAS | AML.T0049 Exploit Public-Facing Application; AML.T0010 AI Supply Chain Compromise; AML.T0055 Unsecured Credentials | Adversary behaviours behind the entries |
| CISA KEV | Catalog listing and due date | Primary prioritisation signal; see the CISA KEV Catalogue Guide |
Common pitfalls
- AI components missing from the asset inventory: notebooks, Ray clusters and agent builders are often deployed by data teams outside the CMDB, so scanners never see them. Use an AI-BOM: see the AI Supply Chain and AI-BOM Guide.
- Python packages pinned in images, not tracked: container images bake in old versions of LangChain, transformers or LiteLLM that software composition analysis on the source repository does not report.
- Trusting "safe" loading flags: weights_only and safe_mode were both bypassed. Provenance of the model file matters more than the flag.
- Ignoring disputed or unscored records: CVE-2023-48022 is disputed and unscored in its record, and was exploited at scale.
- Patching without rotating: upgrading Langflow or LiteLLM after exposure leaves stolen keys valid.
- Developer tooling out of scope: MCP Inspector and mcp-remote run on laptops, where endpoint patching rarely covers npm or pip tools.
What to watch next
- More gateway and MCP CVEs: the 2026 LiteLLM entries all touch MCP integration paths, a newer and less tested code area in gateways.
- Repeat Langflow listings: six KEV entries in about 15 months suggest continued attacker interest; check Langflow advisories with every release.
- Short KEV due dates: CVE-2026-9198, CVE-2026-0770 and CVE-2026-55255 were given three-day due dates, and CVE-2025-62593 also three days. Expect similar urgency for future AI entries.
- Model format research: further bypasses of model-loading safeguards are likely as researchers focus on serialisation formats.
How to use this tracker
- Inventory: list every instance of the products above, including containers, notebooks, developer laptops and managed services, with exposed network interfaces.
- Prioritise: KEV entries first, then internet-exposed instances of any entry, then internal instances. Use the Risk-Based Vulnerability Management Guide for scoring.
- Patch to the fixed version: use the version in the CVE record or the vendor advisory, and rebuild images rather than patching running containers.
- Rotate and hunt: for any exposed KEV-listed instance, rotate the credentials it held and review logs for the endpoints named in the record.
- Isolate what cannot be patched: place Ray dashboards, inference admin routes and builder UIs behind authentication and private networking.
- Subscribe: watch the CISA KEV feed and the GitHub security advisories for each project you run, and recheck this page monthly.
Practitioner checklist
- AI frameworks, gateways, inference servers and builders are in the asset inventory and scanned, including container images.
- CISA KEV is checked at least daily for AI product entries, with an emergency patch path.
- No Langflow, n8n, LiteLLM, MLflow or Ray instance is reachable from the internet without authentication.
- Default credentials and master keys are removed before deployment.
- Models load only from an approved registry, in weight-only formats where possible, with model file scanning.
- Credentials held by AI components are vault-referenced, least privilege and rotated after any exposure.
- Developer AI tools (MCP clients, inspectors) are inventoried and kept current.
- Exploitation indicators for the listed endpoints are in detection content.
Standards and references
- CISA: Known Exploited Vulnerabilities Catalog
- CVE Program: CVE records (cve.org)
- CVE Program: cvelistV5 official CVE record repository
- OWASP: Top 10 for LLM Applications 2025
- MITRE ATLAS: AI Supply Chain Compromise (AML.T0010)
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls
- NIST: Cybersecurity Framework 2.0
- MITRE ATT&CK: Exploit Public-Facing Application (T1190)
Related NHI Mgmt Group resources: AI Agent Security Incidents Tracker · Model Supply Chain Guide · CISA KEV Catalogue Guide · Vulnerability Management Guide