Six AI software flaws on the CISA Known Exploited Vulnerabilities list

Six of the 727 advisories published on this site cover flaws that attackers have used in real attacks, according to the CISA Known Exploited Vulnerabilities catalog. All six are in self-hosted AI tools: LiteLLM, Langflow and MLflow. If your organization runs any of these tools, check the installed version this week.

What the KEV list is and how we use it

The CISA Known Exploited Vulnerabilities (KEV) catalog lists vulnerabilities that CISA has evidence attackers have exploited. When an advisory’s CVE appears in the catalog, we mark that advisory “known exploited.”

The counts in this post come from the Securaity database as read on 2026-10-27. The source records for these 6 advisories were first published between 2026-05-08 and 2026-08-17. Our data does not include the date CISA added each one to the catalog, so this post does not say when that happened.

The six advisories

Advisory	Product	CVE	Severity	CVSS	First published	Fixed version
SA-26-026	LiteLLM	CVE-2026-42208	Critical	9.8	2026-05-08	1.83.7
SA-26-027	LiteLLM	CVE-2026-42271	High	8.8	2026-05-08	1.83.7
SA-26-225	Langflow	CVE-2026-55255	High	8.4	2026-06-23	1.9.1
SA-26-305	LiteLLM	CVE-2026-59822	High	8.2	2026-07-08	1.84.0
SA-26-338	Langflow	CVE-2026-9198	Critical	9.8	2026-07-17	None named; check the vendor advisory
SA-26-523	MLflow	CVE-2026-64849	Critical	9.3	2026-08-17	3.15.0

By product, LiteLLM has 3, Langflow has 2 and MLflow has 1. By severity, 3 are Critical and 3 are High. If you want to know what the scores mean, see how to read a CVSS score.

What the six have in common

All 6 can be attacked over the network (AV:N in the CVSS vector string). An attacker does not need to be in your office or on the machine. They need to be able to reach the service.

Four of the six need no account or privileges at all (PR:N): SA-26-026, SA-26-305, SA-26-338 and SA-26-523. The other 2, SA-26-027 and SA-26-225, need a low-privilege account (PR:L). That is still a barrier, but in a shared tool many people may hold such an account.

LiteLLM: three advisories

LiteLLM is an LLM gateway, a proxy that sits in front of AI model APIs and checks API keys.

• SA-26-026 (Critical, 9.8). From version 1.81.16 up to but not including 1.83.7, a database query used to check proxy API keys mixed the caller’s key value into the query text instead of passing it separately. An attacker with no account could send a crafted Authorization header to any LLM API route, reach the query through the proxy’s error handling, read data from the proxy’s database and possibly change it. Fixed in 1.83.7.
• SA-26-027 (High, 8.8). From 1.74.2 up to before 1.83.7, two endpoints for previewing an MCP server accepted a full server configuration, including the command to run. With a stdio configuration, the proxy ran that command on its own host with the proxy’s privileges. A low-privilege account was enough. Fixed in 1.83.7.
• SA-26-305 (High, 8.2). Before 1.84.0, a fabricated Authorization header sent to the MCP Streamable endpoint could trigger an OAuth2 passthrough fallback that took the place of failed key validation. Requests then reached MCP tooling without a valid LiteLLM key. Fixed in 1.84.0.

Langflow: two advisories

Langflow is an LLM app builder.

• SA-26-338 (Critical, 9.8). Langflow OSS 1.0.0 through 1.10.0 lets an attacker with no account chain two endpoints: /api/v1/auto_login, which hands a superuser token to any network caller, and /api/v1/validate/code, which runs user code. Together they give full remote code execution on default deployments. The record names no fixed version, so check the vendor advisory linked from the advisory page.
• SA-26-225 (High, 8.4). Before 1.9.1, a signed-in user could run any other user’s flow by putting that user’s flow ID in a request to the /api/v1/responses endpoint. This kind of flaw is called an insecure direct object reference (IDOR). Fixed in 1.9.1.

MLflow: one advisory

MLflow is an MLOps platform, used to manage machine learning work.

• SA-26-523 (Critical, 9.3). From 3.3.0 up to before 3.15.0, the webhook test endpoint, which needs no login, checked only the original URL. Webhook delivery, though, followed redirects and looked up the hostname again. An attacker could use this gap to reach internal services or cloud metadata services and read the response status and body. This is a server-side request forgery. Fixed in 3.15.0.

What this does and does not show

KEV status means attacks using the flaw have been seen. It does not say how many organizations were attacked, and our data does not say that either.

All six are in tools that organizations install and run on their own servers. They matter to you if your organization runs one of these tools itself, or has someone else run it for you.

Six is a small share of 727. A flaw that is not on the KEV list can still be serious. Absence from the list means only that the flaw is not in the catalog. It does not mean the flaw is harmless. The full set is on the advisories page.

What to do this week

1. Find out whether you run any of these tools. Ask your IT staff, developers, or whoever set up AI tools for your organization whether LiteLLM, Langflow or MLflow is installed anywhere, including test servers.
2. Check the version. Compare the installed version with the fixed version in the table above. Anything older than the fixed version may be affected.
3. Update. Move to the fixed version or later. For SA-26-338 in Langflow, the record names no fixed version, so check the vendor advisory linked on the advisory page before you decide what to install.
4. Start with the four that need no account. SA-26-026, SA-26-305, SA-26-338 and SA-26-523 can be attacked over the network without any login, so give them first place on your list.
5. Ask whoever runs it to confirm. If a vendor or outside contractor manages the tool, ask them which version is running and when they updated it.
6. Follow the product pages. Each product has a page and an RSS feed listing new advisories: LiteLLM, Langflow and MLflow. Subscribing to the feed for any tool you run means you see the next advisory without having to look for it.