Aokigahara is an infostealer malware targeting traditional data sources such as browsers, VPN clients, cryptocurrency wallets, FTP/SFTP clients, password managers, and email applications. It uniquely targets AI applications and development tools, stealing authentication files, session data, and configuration files from services like Claude, ChatGPT Desktop, Codex, and GitHub Copilot. It also collects developer credentials including Git files, SSH private keys, and cloud service credentials (AWS, Azure, Google Cloud). The stolen AI credentials may be used for unauthorized access, account resale, or data extortion. The malware uses anti-analysis techniques and secures its command-and-control communications with AES-256 encryption and X25519 key exchange.
Aokigahara is a newly observed infostealer malware that targets a wide range of sensitive data on Windows systems. It steals traditional credentials such as browser passwords, cookies, cryptocurrency wallets, VPN and FTP client data, email profiles, and password manager files. Uniquely, it also targets AI applications and developer tools including Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, and Gemini CLI, collecting authentication files, session tokens, and configuration data. The malware additionally targets cloud environment credentials for AWS, Azure, and Google Cloud, as well as developer environment secrets like Git credentials and SSH private keys. Stolen AI and cloud credentials could enable unauthorized access to paid AI services, cloud resources, and source code repositories. The malware includes capabilities such as screenshot capture, clipboard theft, and a clipper component for cryptocurrency manipulation. There is no confirmed information on how the stolen data is monetized. No patch or remediation guidance is provided.
PraisonAI is a multi-agent teams system. From version 4.2.1 to before version 4.6.59, PraisonAI's AgentOS FastAPI deployment surface remains unauthenticated in current main and in releases after the published patched version for GHSA-pm96-6xpr-978x / CVE-2026-40151. The chat route directly calls agent.chat(request.message). No-auth and wrong-bearer requests both execute the deployed agent. This is broader than passive metadata disclosure. In any deployment where AgentOS wraps agents with tools, private context, memory, API integrations, or cost-bearing model calls, an unauthenticated reachable client can drive those agents. This issue has been patched in version 4.6.59.
CVE-2026-111702 is an authorization bypass vulnerability in sugarforever's chat-ollama product, present through commit 96c3ce5. It allows remote attackers to access other users' private knowledge bases by supplying sequential IDs in API requests. Attackers can enumerate these IDs via GET /api/knowledgebases/{id} or the knowledgebaseId parameter in POST /api/models/chat, enabling them to read metadata and document content without authorization. The vulnerability has a high severity with a CVSS score of 8.7.
n8n versions before 2.41.4 and 2.42.0 contain an authorization bypass vulnerability in the agent chat resume endpoint. This flaw allows authenticated project members to access and manipulate other members' private agent conversations by providing a run identifier without proper ownership verification. Exploitation can lead to unauthorized reading of private conversations and execution of tool calls within the victim's context.
Telegram-Stremio versions up to 5.1.0 suffer from an authorization bypass vulnerability that allows authenticated users to access arbitrary chat messages without proper authorization. This is due to broken object-level authorization involving user-controlled keys and unsigned stream IDs. Attackers can enumerate message IDs and manipulate request routing to access private chats and thumbnails without token validation.
CVE-2026-57118 is a critical vulnerability in MervinPraison's PraisonAI multi-agent teams system. Versions prior to 1.6.59 allow unauthenticated remote clients to access critical functions such as listing agents and invoking agent chat endpoints without authentication. This lack of access control enables attackers to enumerate agents, consume model resources, access private context, and trigger agent tools or workflows. The issue is fixed in version 1.6.59.
MOVO versions 0.1.0 through 0.2.3 contain an authorization bypass vulnerability in the chat-api document endpoints. Authenticated users can exploit this flaw by supplying arbitrary object paths to access or overwrite other users' private documents and presentation blueprints. This vulnerability allows reading and modification of sensitive data without proper authorization.
### Summary
Before **Langflow 1.10.1**, two deprecated but still-routed endpoints in the chat API did not check that the authenticated caller owns the flow referenced in the URL path:
- `POST /api/v1/build/{flow_id}/vertices` (`retrieve_vertices_order`)
- `POST /api/v1/build/{flow_id}/vertices/{vertex_id}` (`build_vertex`)
Any authenticated user who knows (or obtains) another user's `flow_id` could load that user's private flow graph, enumerate its vertex IDs, and build (execute) individual vertices of it, receiving the vertex results in the response.
Both routes are declared with `deprecated=True, include_in_schema=False`, so they do not appear in the OpenAPI docs, but they remained registered on the router. The Langflow UI no longer calls them (it uses `POST /api/v1/build/{flow_id}/flow`), so they are only reachable by direct HTTP requests.
The issue is fixed in **Langflow 1.10.1** (`langflow-base` 0.10.1) by [#13153](https://github.com/langflow-ai/langflow/pull/13153).
### Details
In affected versions, both handlers go straight to the graph loader:
- `retrieve_vertices_order` (`src/backend/base/langflow/api/v1/chat.py`, lines 81-159 in 1.9.1) only required authentication via `dependencies=[Depends(get_current_active_user)]`. The user was never injected into the handler, and the flow was loaded with `build_graph_from_db(flow_id=flow_id, ...)`.
- `build_vertex` (`chat.py`, lines 320-491 in 1.9.1) receives `current_user`, but only uses it for variable resolution (`user_id=str(current_user.id)`). It is never used to scope the flow lookup. The graph is taken from the chat-service cache keyed by `flow_id`, or rebuilt with `build_graph_from_db` on a cache miss.
- `build_graph_from_db_no_cache` (`src/backend/base/langflow/api/utils/flow_utils.py`) does a bare primary-key lookup, `session.get(Flow, flow_id)`, with no owner filter.
The supported replacement, `POST /api/v1/build/{flow_id}/flow`, already restricted the lookup to the owner or a `PUBLIC` flow (added in #12305 for GHSA-qj98-rhf8-v93f). The deprecated siblings were not covered by that fix, nor by the `_read_flow` fix for GHSA-8c4j-f57c-35cf.
Additional side effects in affected versions:
- `retrieve_vertices_order` stores the graph in the chat-service cache under the victim's `flow_id` (`chat_service.set_cache(str(flow_id), graph)`). When the request includes a `data` body, the cached graph is attacker-supplied.
- `build_vertex` schedules `log_vertex_build` for the victim's `flow_id`, so attacker-triggered builds are recorded in the victim flow's vertex build history.
Note on older versions: up to and including **1.7.1**, these two routes had no authentication dependency at all. Authentication was added in 1.7.2 by #10977, but no ownership check was added. This advisory covers the missing ownership check, which is present in every release from 1.0.0 (when the routes were introduced) through 1.10.0.
### Attack scenario
1. The attacker authenticates as any valid user.
2. The attacker obtains a victim `flow_id` (shared URLs, exported flow files, logs, screenshots, etc.).
3. `POST /api/v1/build/{victim_flow_id}/vertices` returns **200 OK** with `{"ids": [...], "run_id": "...", "vertices_to_run": [...]}` listing the victim flow's vertex IDs (component type plus suffix, e.g. `ChatInput-abc12`).
4. The attacker calls `POST /api/v1/build/{victim_flow_id}/vertices/{vertex_id}` for a returned ID. The victim's graph is loaded and the vertex is built. Its results, outputs and artifacts are returned to the attacker.
### Impact
- **Confidentiality (Low):** Discloses the structure of private flows (vertex IDs and component types) and the outputs of vertices the attacker chooses to build. That includes values hardcoded in node configuration, such as prompt text or fixed inputs.
- Global variables and credentials in the variable store are **not** exposed, because variable resolution uses the caller's `user_id`.
- The victim's stored flow definition is not returned wholesale.
- **Integrity (Low):** The attacker can trigger execution of the victim's nodes, including any side effects baked into their configuration (fixed endpoints, webhooks, hardcoded API keys). Build records are written under the victim's `flow_id`. The attacker cannot modify the stored flow.
- **Availability:** None.
The attacker must be authenticated and must know the target flow UUID. Flow UUIDs are random v4 values, so blind enumeration is not practical.
### Proof of concept
Observed on `langflow==1.9.1` using the project's test client and in-memory SQLite fixtures (see the attached `poc.zip`):
| Request | Expected (hardened) | Observed on 1.9.1 |
|---|---|---|
| Attacker → `POST /api/v1/build/{victim_flow_id}/vertices` | `404 Not Found` | `200 OK` with vertex order payload |
| Attacker → `POST /api/v1/build/{victim_flow_id}/vertices/<bogus-id>` | `404 Not Found` | `500` `{"detail":"Vertex <id> not found"}`: the victim graph was loaded before the vertex lookup failed |
| Owner (
OpenClaw is an npm-distributed gateway application. In versions >= 2026.7.1 and < 2026.8.1, Synology Chat attachment delivery could lose DNS pinning: the Gateway validated a single DNS result for a supplied file URL but then passed the original hostname to the Synology NAS, where it could resolve to a different destination. When attachment delivery accepted a remotely influenced hostname, an attacker could use DNS rebinding to make the NAS fetch a private or otherwise policy-denied resource and return its contents to the addressed conversation (server-side request forgery). Practical impact depends on NAS routing, resolver behavior, and the response available at the private destination. The issue is fixed in 2026.8.1; as a workaround, disable remote URL attachment forwarding in Synology Chat.
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via User Display Name in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users because WordPress core's sanitize_text_field() preserves HTML-entity-encoded payloads (e.g., an iframe srcdoc attribute), allowing the encoded string to be stored as a display name without requiring the unfiltered_html capability, and the plugin subsequently decodes it server-side before rendering.
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to generic SQL Injection via 'group_id' Message Meta Parameter in all versions up to, and including, 3.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the BuddyBoss Platform plugin to be installed with its Social Groups component disabled, a state that persists on any site that has previously toggled the Groups component off since BuddyBoss does not drop the wp_bp_groups table upon deactivation.
The Better Messages plugin for WordPress up to version 2.15.33 has an authentication bypass vulnerability. This flaw allows unauthenticated attackers to impersonate internal AI bot accounts by manipulating the X-Real-IP header during guest registration. As a result, attackers can bypass access controls to join restricted chat rooms, post messages, and read private message histories.
The Better Messages plugin for WordPress has an authorization bypass vulnerability in all versions up to and including 2.15.33. This flaw allows authenticated users with custom-level access or higher to access message transcripts, thread metadata, and user data of any chat-room thread without proper authorization. Exploitation requires the chat room setting 'only_joined_can_read' to be set to its default value of '0'.
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'icn' parameter in all versions up to, and including, 2.15.22 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.7 via the 'mediaId' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to access and retrieve the transcribed contents of private audio attachments belonging to other users, including Administrators, via a supplied attachment ID. This vulnerability requires the Public API module to be enabled in the plugin settings; when disabled, the REST route is absent and the endpoint returns HTTP 404.
LangBot's plugin runtime (pip package langbot_plugin) through 0.4.17 starts a debug WebSocket server on 0.0.0.0:5401 (/plugin/ws) whose authentication is gated on plugin_debug_key, which defaults to an empty string and is never set by the upstream repository, Docker image, or docker-compose (which additionally publishes port 5401 to the host); the key check is therefore skipped entirely. Any remote attacker able to reach the port can register an arbitrary "debug plugin" without credentials. Because events are broadcast to all initialized plugins without filtering, the attacker's plugin receives the full context of every IM message event (including private chats, message chains, and user/sender IDs in plaintext) and can inject forged replies, send messages as any configured bot, enumerate bot UUIDs, invoke configured LLM models, read knowledge-base contents, and register malicious tools that feed every user's LLM pipeline. Registering with "prod_mode": true causes later legitimate installations of a plugin with the same author/name to be rejected, resulting in persistent denial of service. No patched version was available at the time of publication.
Chatbot UI contains an authorization bypass vulnerability in the retrieval endpoint that allows authenticated attackers to access private file content belonging to other users by supplying arbitrary file UUIDs. The endpoint uses a service-role Supabase client that bypasses row-level security and fails to validate file ownership, enabling attackers to retrieve indexed content chunks from victim files through crafted POST requests.
Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/{chat_id}/history, DELETE /chat/{chat_id}, and POST /chat/{chat_id}/question/answer endpoints. Authenticated attackers can read other users' conversation histories including private knowledge base content, delete arbitrary chats, and inject fabricated messages into other users' conversations.
FastGPT versions prior to 4.15.2 have a missing authorization vulnerability in the WeChat (iLink) share-channel endpoints. These endpoints rely solely on a public shareId for authorization, which is exposed in shared URLs and embeds, allowing unauthenticated attackers to hijack or disrupt victim teams' WeChat bots. Attackers can log out the victim's bot or bind the victim's app to their own bot, exposing private responses and consuming victim resources. This issue is fixed in version 4.15.2.