Critical AI Framework Vulnerability Exposes Millions to Remote Code Execution Researchers at OX Security have uncovered a severe architectural flaw in the Model Context Protocol (MCP), a communication standard developed by Anthropic and embedded in AI frameworks across Python, TypeScript, Java, and Rust. The vulnerability enables remote code execution (RCE), exposing sensitive data including API keys, internal databases, and chat histories across the AI supply chain. The flaw affects Flowise, a widely used open-source AI workflow builder, and extends to over 200,000 vulnerable instances, with 150 million downloads and 7,000 publicly accessible servers at risk. During testing, OX Security successfully executed live commands on six production platforms, demonstrating the flaw’s real-world impact. Key Exploitation Vectors Identified: - Unauthenticated UI injection in major AI frameworks. - Hardening bypasses in "protected" environments like Flowise. - Zero-click prompt injection in AI IDEs (e.g., Windsurf, Cursor). - Malicious MCP server distribution, with 9 out of 11 registries compromised in testing. At least ten CVEs have been issued, covering critical vulnerabilities in platforms such as LiteLLM, LangChain, GPT Researcher, DocsGPT, and IBM’s LangFlow. Despite OX Security’s recommendations for root-level patches, Anthropic declined to implement protocol-wide fixes, describing the behavior as "expected." The company did not oppose the public disclosure of the findings. The incident underscores systemic risks in AI infrastructure, with the flaw inherited by any developer building on MCP expanding the attack surface across the ecosystem. Security teams are advised to restrict public exposure of AI services, treat MCP inputs as untrusted, and enforce sandboxed environments. Patches for affected platforms are now available.

Critical Flowise AI Platform Vulnerability Exploited in the Wild (CVE-2025-59528) A severe code injection vulnerability in Flowise, a widely used open-source AI development platform, is actively being exploited by attackers. Tracked as CVE-2025-59528 with a CVSS score of 10.0, the flaw allows remote attackers to execute arbitrary code and gain full control of affected servers. The vulnerability stems from improper handling of external server configurations in Flowise’s CustomMCP (Model Context Protocol) node. When processing user-provided input, the platform evaluates the data as unfiltered JavaScript code via Node.js’s `Function()` constructor, enabling attackers to inject malicious commands. Exploitation requires only a single crafted request to a vulnerable API endpoint, granting attackers access to system modules, file operations, and command execution. Security firm VulnCheck detected the first live attacks, originating from a Starlink IP address. Successful exploitation can lead to full system compromise, unauthorized file access, data exfiltration, and silent execution of system-level commands. Approximately 15,000 Flowise instances remain exposed on the public internet, heightening the risk for organizations using the platform. This is not the first time Flowise has been targeted previous vulnerabilities (CVE-2025-8943 and CVE-2025-26319) were also exploited in recent months. The flaw affects Flowise versions 3.0.5 and earlier, with a patch released in version 3.0.6. Security teams are urged to upgrade immediately to mitigate the threat.

Critical Flowise RCE Vulnerability (CVE-2025-59528) Actively Exploited in the Wild A maximum-severity remote code execution (RCE) vulnerability in Flowise, tracked as CVE-2025-59528, is now under active exploitation. The flaw allows attackers to execute arbitrary code on vulnerable systems, potentially leading to full compromise. The vulnerability stems from unsafe handling of user input in the CustomMCP node, a component used to connect with external Model Context Protocol (MCP) servers. Attackers can inject malicious JavaScript via the `mcpServerConfig` setting, bypassing validation checks. The issue was first disclosed in September 2024, with warnings that exploitation could enable command execution and unauthorized file system access. Flowise, an open-source low-code platform for building AI agents and LLM workflows, released a patch in version 3.0.6, with the latest secure version (3.1.1) released two weeks ago. Despite the fix, real-world exploitation has been observed. Exploitation Evidence & Attack Surface Security researchers at VulnCheck detected initial exploitation attempts originating from a Starlink IP address. Their analysis identified 12,000–15,000 publicly exposed Flowise instances, though the exact number of vulnerable deployments remains unclear. While current activity appears limited, the broad attack surface increases the risk of wider exploitation as exploit techniques proliferate. Additional Vulnerabilities Under Attack CVE-2025-59528 is not the only Flowise flaw being targeted. Two other vulnerabilities CVE-2025-8943 and CVE-2025-26319 have also been added to VulnCheck’s Known Exploited Vulnerabilities (KEV) catalog, indicating a pattern of attackers leveraging multiple flaws to gain unauthorized access. Organizations using Flowise are urged to upgrade to the latest patched version to mitigate risks. The incident underscores the growing threat to AI-driven development platforms as attackers increasingly target low-code environments.

A critical vulnerability (CVE-2025-58434, CVSS 9.8) in FlowiseAI’s password reset mechanism exposes all versions before 3.0.5 to account takeover attacks. The flaw in the `/api/v1/account/forgot-password` endpoint discloses sensitive user data—including user IDs, emails, hashed credentials, and valid password reset tokens—directly in the API response, bypassing email verification. Attackers need only a victim’s email (often publicly obtainable) to execute two simple HTTP requests: one to fetch the token and another to reset the password. No authentication or user interaction is required, enabling silent, full account compromise.High-privilege and administrator accounts are equally vulnerable, risking unauthorized AI workflow manipulation, data exfiltration, or malicious automation injection. The absence of a patch (as of discovery) amplifies risks, with potential consequences ranging from operational disruption to full organizational takeover. Mitigation relies on temporary access restrictions, MFA enforcement, and real-time monitoring of reset activities. The flaw underscores systemic API security gaps, demanding urgent remediation to prevent large-scale exploitation.

AI Infrastructure Security Crisis: Exposed Systems, Hardcoded Flaws, and Rampant Misconfigurations A recent investigation by the Intruder team reveals a alarming trend in AI infrastructure security, as rapid adoption outpaces safeguards. Scanning over 2 million hosts with 1 million exposed services, researchers found AI deployments riddled with vulnerabilities more severe than any other software category they’ve analyzed. No Authentication by Default A core issue: many self-hosted AI projects ship without authentication enabled, leaving sensitive data and tools exposed. Real-world examples included chatbots with unrestricted access to user conversation histories, multimodal LLMs vulnerable to jailbreaking, and even NSFW chatbots leaking API keys in plaintext. One OpenUI-based instance exposed full LLM conversation logs, while others allowed malicious users to bypass safety guardrails using corporate infrastructure to generate illegal content or solicit criminal advice. Exposed Agent Platforms and Business Logic Agent management platforms like n8n and Flowise were frequently found misconfigured, with some instances mistakenly exposed to the internet. One Flowise deployment revealed an entire LLM chatbot’s business logic, including credential lists (though stored values remained protected). Another exposed parsing tools and local functions capable of server-side code execution. Across sectors government, finance, and marketing over 90 exposed instances were identified, enabling attackers to modify workflows, redirect traffic, or poison responses. Unsecured Ollama APIs: A Gateway to Frontier Models Researchers discovered 5,200+ exposed Ollama APIs with connected models, 31% of which responded to unauthenticated queries. While Ollama doesn’t store conversation data, many instances wrapped paid models from Anthropic, Google, Deepseek, Moonshot, and OpenAI 518 in total. Responses ranged from health-focused assistants to cloud management integrations, highlighting the risks of unauthorized access to enterprise systems. Insecure by Design Lab analysis uncovered systemic flaws: - Poor deployment practices: Misconfigured Docker setups, hardcoded credentials, and applications running as root. - No authentication on fresh installs: Users granted high-privilege access by default. - Static credentials: Embedded in setup examples and `docker-compose` files. - New vulnerabilities: Arbitrary code execution found in a popular AI project within days. Root Cause: Speed Over Security The findings underscore a broader industry shift vendors and adopters prioritizing rapid deployment over decades of security best practices. While some projects abandon safeguards entirely, the pressure to outpace competitors exacerbates the problem. The result: AI infrastructure with a 2.6 CVE-per-day average (as seen in the ClawdBot incident), where misconfigurations and weak sandboxing amplify risks. The investigation serves as a stark reminder of the security debt accumulating in the AI gold rush.