MCP RCE Debate: Treat Agent Plugins Like Executable Code
OX Security found a remote code execution design flaw in MCP's official SDKs: 10 CVEs, 30+ disclosures, 7,000+ exposed servers. Treat MCP servers as code.
#rce
2 articles with this tag.
Langflow Exploited in 20 Hours: The AI Framework Attack Surface
Langflow's CVSS 9.3 unauthenticated RCE was exploited in the wild 20 hours after disclosure, with no public PoC. Three LangChain and LangGraph CVEs followed.