← Back to feed
2026-09-20 Mcp SecurityMalware TLP:CLEAR

Critical CVE Chain in AI Inference and Agent Runtime Layers Enables Unauthenticated RCE

Date: 2026-09-20
Tags: mcp-security, malware

Executive Summary

On September 11, 2026, the disclosure of CVE-2026-86793 in the SGLang open-source LLM inference framework extended the authentication gap into the inference server layer. The sequence began on August 25 with NemoClaw (CVE-2026-65105, CVSS 8.1), a vulnerability in Ollama inference backend bound to all network interfaces with Host header validation disabled. Combined with DNS rebinding, an attacker gains full unauthenticated access to the Ollama API through a single website visit. By September 8, DeepSeek Harness (CVE-2026-82533, CVSS 9.4) was disclosed as the first confirmed agent runtime sandbox escape. IBM Langflow (CVE-2026-81204, CVSS 9.8) allows unauthenticated remote code execution during graph construction.

Campaign Summary

FieldDetail
Campaign / MalwareAI Inference Stack Authentication Gap Campaign
AttributionMultiple independent researchers and disclosure vendors (confidence: high)
TargetOrganizations running open-source AI inference frameworks and agent runtimes in production
VectorUnauthenticated remote code execution via misconfigured inference servers, unvalidated Host headers, and code execution in graph-based agent builders
Statusactive
First Observed2026-08-25

Detailed Findings

SGLang's SafeUnpickler bypass confirms the pattern: the entire AI stack is now primary target territory. IBM Langflow uses an incomplete denylist that omits process-spawning primitives, while the lfx CodeParser passes return-type annotation source directly to eval without sanitization. SGLang introduced SafeUnpickler to address an earlier deserialization vulnerability, but the unpickler relies on ALLOWED_MODULE_PREFIXES and DENY_CLASSES to restrict which Python modules can be loaded during deserialization. A single visit to an attacker-controlled webpage is all it takes to give the attacker these capabilities via DNS rebinding against exposed Ollama instances. These vulnerabilities form an exploitation chain: reconnaissance of exposed inference servers via port scanning, unauthenticated API access without authentication, and arbitrary code execution enabling lateral movement to production AI infrastructure.

MITRE ATT&CK Mapping

TechniqueIDContext
Exploit Public-Facing ApplicationT1190Multiple unauthenticated RCE flaws in widely-deployed open-source AI inference frameworks

IOCs

Domains

_Four critical CVEs disclosed within two-week window (Aug 25 - Sept 11). Organizations running open-source AI inference are primary targets._

Full URL Paths

_Four critical CVEs disclosed within two-week window (Aug 25 - Sept 11). Organizations running open-source AI inference are primary targets._

Splunk Format

_No IOCs available for Splunk query_

Affected Platforms

AI inference servers
Agent runtime environments
ML deployment infrastructure

Detection Recommendations

Immediately audit all exposed AI inference servers and agent runtimes for unauthenticated network access. Implement network segmentation to isolate inference infrastructure from internet and untrusted networks. Enforce authentication on all inference APIs using OAuth, mTLS, or similar mechanisms. Apply Host header validation and DNS rebinding protections. Deploy intrusion detection signatures for known exploitation patterns against Ollama, SGLang, Langflow, and DeepSeek Harness. Monitor for suspicious outbound connections from inference servers. Implement strict allow-lists for Python modules that can be deserialized. Disable trust_remote_code in all AI framework configurations.

References