Between July 6 and July 11, 2026, five critical vulnerabilities were disclosed across major AI agent frameworks. These include Langflow IDOR (CVE-2026-55255, CVSS 9.9), Langroid sandbox escape (CVE-2026-54769, CVSS 10.0), and PraisonAI unsandboxed RCE (CVE-2026-61447, CVSS 10.0). Crawl4AI and Ruflo were also identified with vulnerabilities carrying CVSS 10.0 scores, though specific CVE identifiers for these remain unpublished.
On July 7, the Cybersecurity and Infrastructure Security Agency (CISA) added Langflow CVE-2026-55255 to its Known Exploited Vulnerabilities (KEV) catalog. This is the first time an AI agent platform has appeared in the KEV, marking a transition for these tools from experimental research projects to high-value targets for threat actors.
The Langflow vulnerability allows an authenticated attacker to execute any flow belonging to another user via the /api/v1/responses endpoint. The Sysdig Threat Research Team observed active exploitation of this flaw beginning June 25. Attackers chained the IDOR vulnerability with a separate Langflow RCE to harvest LLM API keys and AWS credentials.
AI orchestration platforms are a trove of credentials in their own right, and this operator clearly knew it.
Sysdig Threat Research Team
This wave of disclosures follows a broader trend of vulnerabilities identified earlier in the year. In May, Microsoft Semantic Kernel faced CVE-2026-25592 and CVE-2026-26030, where crafted prompts achieved host-level shell access. Similarly, a chain of vulnerabilities in CrewAI (CERT/CC VU#221883) involving RCE, SSRF, and file read via prompt injection remains a significant concern for security practitioners.
The technical commonality across these incidents is the exploitation of trust boundaries within agentic workflows. For instance, PraisonAI CVE-2026-61447 allowed LLM-generated Python code to execute without AST validation or sandbox enforcement. Langroid CVE-2026-54769 utilized an eval() function with full_eval=True, failing to scrub __builtins__ and enabling os.system() calls.
A structural vulnerability exists in the deployment model of these frameworks. Self-hosted deployments lack the managed-update safety net of traditional SaaS platforms. While managed services like LangChain’s LangSmith Deployment were not affected by the Langgraph chain (CVE-2025-67644 and CVE-2026-28277), self-hosted deployments using SQLite or Redis checkpointers remained exposed to RCE.
The risk extends to the infrastructure supporting these agents. BlueRock Security reported in January 2026 that 36.7% of over 7,000 Model Context Protocol (MCP) servers had SSRF exposure.
One request to reach your internal network. Every tool call is a potential entry point.
BlueRock Security
CISA addressed the accelerating nature of these threats in BOD 26-04, issued on June 10, 2026.
Cyber threat actors exploit unpatched vulnerabilities, and their use of AI may further narrow the time defenders have to react between patch release and possible exploitation.
CISA BOD 26-04
The reliance on complex, often unvetted, third-party code to orchestrate LLM interactions creates a significant attack surface. The capability-security asymmetry is stark: agents are designed to maximize autonomy and tool access, which inherently conflicts with the principle of least privilege.
The current wave of CVEs indicates that the security of AI agent frameworks is a fundamental architectural challenge. As organizations continue to integrate these agents into production environments, the lack of standardized, secure-by-default deployment patterns remains the primary vector for exploitation. The distinction between managed services and self-hosted instances will continue to dictate the speed and efficacy of remediation efforts.