{"schema_version":1,"license":"CC-BY 4.0","attribution":"unauth.dev / Raúl Acedo","url":"https://unauth.dev/advisories","record_count":60,"records":[{"type":"exposure-class","product":"Ollama","title":"Ollama API open to the internet","summary":"Anyone on the internet can talk to your Ollama server: list your models, run inference on your GPU (you pay the power/hardware bill), and pull or delete models. Exposed Ollama instances are scanned for within hours of going online — this is one of the most commonly found exposed AI services, with well over a hundred thousand of them visible on the public internet.","exposure_class":"no-auth-by-design","owasp":null,"observable":"GET :11434/api/version answers {\"version\": ...} and GET /api/tags lists your models — no auth.","severity":"CRITICAL","reachability_note":"Internet-facing exposure — observable from the public internet with GET-only probes (the same probes unauth.dev sends).","fix_card_id":"ollama-exposed","cve":null,"references":["https://github.com/ollama/ollama/blob/main/docs/faq.md#how-do-i-configure-ollama-server","https://www.oligo.security/blog/shadowray-attack-ai-workloads-actively-exploited-in-the-wild"],"in_the_wild":{"service":"ollama","first_seen":"2026-07-28","last_seen":"2026-08-05","probes_30d":367,"probes_observed":367,"source":"unauth.dev botwatch honeypot"},"id":"UNAUTH-2026-0001","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0001 — observed 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0001"},{"type":"exposure-class","product":"n8n","title":"n8n instance open — settings or owner-setup reachable without login","summary":"If your n8n setup page or settings endpoint answers without a login, a stranger can claim the instance as owner or read its configuration — and n8n holds your API keys and workflow credentials. Gate 0 testing showed bots hunting for credential files on exposed n8n within about an hour of the port going online.","exposure_class":"unclaimed-setup","owasp":null,"observable":"GET :5678/rest/settings answers a JSON settings blob without login, or the owner-setup page is reachable.","severity":"CRITICAL","reachability_note":"Internet-facing exposure — observable from the public internet with GET-only probes (the same probes unauth.dev sends).","fix_card_id":"n8n-exposed","cve":null,"references":["https://docs.n8n.io/hosting/configuration/environment-variables/","https://docs.n8n.io/hosting/securing/overview/"],"in_the_wild":{"service":"n8n","first_seen":"2026-07-28","last_seen":"2026-08-05","probes_30d":431,"probes_observed":431,"source":"unauth.dev botwatch honeypot"},"id":"UNAUTH-2026-0002","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0002 — observed 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0002"},{"type":"exposure-class","product":"Open WebUI","title":"Open WebUI reachable from the internet","summary":"Your chat UI — including conversation history and any connected models — is reachable by anyone. If open signup is enabled, strangers can register their own accounts and use your models at your expense.","exposure_class":"no-auth-by-design","owasp":null,"observable":"GET :8080/api/config answers JSON naming \"Open WebUI\" (exact version included) without login.","severity":"HIGH","reachability_note":"Internet-facing exposure — observable from the public internet with GET-only probes (the same probes unauth.dev sends).","fix_card_id":"open-webui-exposed","cve":null,"references":["https://docs.openwebui.com/getting-started/env-configuration/"],"in_the_wild":null,"id":"UNAUTH-2026-0003","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0003 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0003"},{"type":"exposure-class","product":"vLLM","title":"vLLM API open to the internet","summary":"Your model-serving API answers anyone: strangers can list your models and run unlimited inference on your GPU — you pay the compute bill, and they can read anything the model was prompted with through your app.","exposure_class":"no-auth-by-design","owasp":null,"observable":"GET :8000/version and GET /v1/models both answer without an API key.","severity":"HIGH","reachability_note":"Internet-facing exposure — observable from the public internet with GET-only probes (the same probes unauth.dev sends).","fix_card_id":"vllm-exposed","cve":null,"references":["https://docs.vllm.ai/en/latest/serving/security.html"],"in_the_wild":null,"id":"UNAUTH-2026-0004","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0004 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0004"},{"type":"exposure-class","product":"Langfuse","title":"Langfuse reachable from the internet","summary":"Your LLM observability stack is publicly reachable — Langfuse stores prompts, completions, tool calls, and agent session state that can contain customer data and secrets. If the sign-up page is open, anyone can create an account and start reading those traces.","exposure_class":"agent-trace-store","owasp":null,"observable":"GET :3000/api/public/health answers Langfuse's health JSON (version included); the sign-up page is reachable.","severity":"MEDIUM","reachability_note":"Internet-facing exposure — observable from the public internet with GET-only probes (the same probes unauth.dev sends).","fix_card_id":"langfuse-exposed","cve":null,"references":["https://langfuse.com/self-hosting/configuration"],"in_the_wild":{"service":"langfuse","first_seen":"2026-07-28","last_seen":"2026-08-05","probes_30d":2399,"probes_observed":2399,"source":"unauth.dev botwatch honeypot"},"id":"UNAUTH-2026-0005","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0005 — observed 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0005"},{"type":"exposure-class","product":"ComfyUI","title":"ComfyUI open to the internet","summary":"Anyone can upload and run workflows on your ComfyUI server — workflows can execute arbitrary code on the machine, and the open stats endpoint already shows attackers exactly what GPU hardware you have. Treat an internet-exposed ComfyUI as remote code execution waiting to happen.","exposure_class":"no-auth-by-design","owasp":null,"observable":"GET :8188/system_stats answers ComfyUI's system/devices JSON — GPU model, VRAM, driver — without auth.","severity":"CRITICAL","reachability_note":"Internet-facing exposure — observable from the public internet with GET-only probes (the same probes unauth.dev sends).","fix_card_id":"comfyui-exposed","cve":null,"references":["https://github.com/comfyanonymous/ComfyUI"],"in_the_wild":null,"id":"UNAUTH-2026-0006","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0006 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0006"},{"type":"exposure-class","product":"Ray","title":"Ray dashboard open to the internet","summary":"Your Ray dashboard and Jobs API answer anyone without a password. The Jobs API lets a stranger submit a job — and a Ray job is arbitrary code running on your cluster. This is unauthenticated remote code execution, and exposed Ray clusters are actively hijacked for cryptomining and data theft.","exposure_class":"no-auth-by-design","owasp":null,"observable":"GET :8265/api/jobs/ or /nodes answers cluster data without auth — unauthenticated job submission is open.","severity":"CRITICAL","reachability_note":"Internet-facing exposure — observable from the public internet with GET-only probes (the same probes unauth.dev sends).","fix_card_id":"ray-exposed","cve":null,"references":["https://docs.ray.io/en/latest/ray-security/index.html","https://www.oligo.security/blog/shadowray-attack-ai-workloads-actively-exploited-in-the-wild"],"in_the_wild":null,"id":"UNAUTH-2026-0007","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0007 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0007"},{"type":"exposure-class","product":"Qdrant","title":"Qdrant vector database open without authentication","summary":"Your vector database answers anyone on the internet. Every embedding you stored can be read, poisoned, modified or deleted. RAG and agent-memory stores often hold document text and long-term agent state (OWASP ASI06). Qdrant ships with no authentication by default, so this is a configuration choice, not a bug.","exposure_class":"agent-memory-store","owasp":["ASI06"],"observable":"GET :6333/collections lists your vector collections with no API key.","severity":"CRITICAL","reachability_note":"Internet-facing exposure — observable from the public internet with GET-only probes (the same probes unauth.dev sends).","fix_card_id":"qdrant-exposed","cve":null,"references":["https://qdrant.tech/documentation/guides/security/","https://qdrant.tech/documentation/guides/configuration/","https://genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications-the-benchmark-for-agentic-security-in-the-age-of-autonomous-ai/"],"in_the_wild":{"service":"qdrant","first_seen":"2026-08-03","last_seen":"2026-08-05","probes_30d":22,"probes_observed":22,"source":"unauth.dev botwatch honeypot"},"id":"UNAUTH-2026-0008","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0008 — observed 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0008"},{"type":"exposure-class","product":"Qdrant","title":"Qdrant gRPC data plane (:6334) accepts connections","summary":"The port where your vectors actually live — Qdrant's gRPC data plane on :6334 — accepts connections from the internet, and the same host was confirmed to be Qdrant. This was measured by a zero-byte TCP connect, so it proves reachability, not that your data is readable: whether gRPC auth or TLS stands behind the open port was not tested. But an open data plane with no API key configured is full read/write access to every embedding, including stores that may hold agent memory (OWASP ASI06) — treat it as exposed until proven otherwise.","exposure_class":"data-plane","owasp":["ASI06"],"observable":"A zero-byte TCP connect to :6334 (Qdrant gRPC data plane) succeeds from the internet; content was not probed.","severity":"HIGH","reachability_note":"Data-plane port — normally internal-only; internet reachability is a misconfiguration. Measured by a zero-byte TCP connect on a host already confirmed by its HTTP API; the hosted scanner never probes data-plane content.","fix_card_id":"qdrant-dataplane-exposed","cve":null,"references":["https://qdrant.tech/documentation/guides/security/","https://qdrant.tech/documentation/guides/configuration/","https://genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications-the-benchmark-for-agentic-security-in-the-age-of-autonomous-ai/"],"in_the_wild":null,"id":"UNAUTH-2026-0009","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0009 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0009"},{"type":"exposure-class","product":"Milvus","title":"Milvus vector database exposed to the internet","summary":"Your Milvus deployment answers anyone on the internet — its health endpoint fingerprints the exact version, and the gRPC data API (:19530) on the same host has no authentication unless you enabled it. Every embedding you stored can be read, poisoned, modified or deleted. RAG and agent-memory stores often hold document text and long-term agent state (OWASP ASI06). An exposed Attu admin UI confirms the deployment and gives an attacker a console to attach to it.","exposure_class":"agent-memory-store","owasp":["ASI06"],"observable":"GET :9091/healthz answers with a Milvus Server header (version included) without auth.","severity":"HIGH","reachability_note":"Internet-facing exposure — observable from the public internet with GET-only probes (the same probes unauth.dev sends).","fix_card_id":"milvus-exposed","cve":null,"references":["https://milvus.io/docs/authenticate.md","https://milvus.io/docs/configure_security.md","https://genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications-the-benchmark-for-agentic-security-in-the-age-of-autonomous-ai/"],"in_the_wild":null,"id":"UNAUTH-2026-0010","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0010 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0010"},{"type":"exposure-class","product":"Milvus","title":"Milvus gRPC data plane (:19530) accepts connections","summary":"The port where your vectors actually live — Milvus's gRPC data plane on :19530 — accepts connections from the internet, and the same host was confirmed to be Milvus. This was measured by a zero-byte TCP connect, so it proves reachability, not that your data is readable: whether gRPC auth or TLS stands behind the open port was not tested. But Milvus has no authentication unless you enabled it, so an open :19530 usually means every embedding readable and writable, including stores that may hold agent memory (OWASP ASI06) — treat it as exposed until proven otherwise.","exposure_class":"data-plane","owasp":["ASI06"],"observable":"A zero-byte TCP connect to :19530 (Milvus gRPC data plane) succeeds from the internet; content was not probed.","severity":"HIGH","reachability_note":"Data-plane port — normally internal-only; internet reachability is a misconfiguration. Measured by a zero-byte TCP connect on a host already confirmed by its HTTP API; the hosted scanner never probes data-plane content.","fix_card_id":"milvus-dataplane-exposed","cve":null,"references":["https://milvus.io/docs/authenticate.md","https://milvus.io/docs/configure_security.md","https://genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications-the-benchmark-for-agentic-security-in-the-age-of-autonomous-ai/"],"in_the_wild":null,"id":"UNAUTH-2026-0011","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0011 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0011"},{"type":"exposure-class","product":"Dify","title":"Dify console exposed to the internet","summary":"Your Dify admin console is reachable from the internet. If the setup never finished, the first visitor becomes admin and owns every app, prompt and model API key you configured. Even with setup finished, the console and its API sit one phished password away from a stranger.","exposure_class":"unclaimed-setup","owasp":null,"observable":"GET :5001/console/api/setup answers {\"step\": \"not_started\"} — the first visitor becomes admin.","severity":"CRITICAL","reachability_note":"Internet-facing exposure — observable from the public internet with GET-only probes (the same probes unauth.dev sends).","fix_card_id":"dify-exposed","cve":null,"references":["https://docs.dify.ai/getting-started/install-self-hosted/docker-compose"],"in_the_wild":null,"id":"UNAUTH-2026-0012","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0012 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0012"},{"type":"exposure-class","product":"AnythingLLM","title":"AnythingLLM open without authentication","summary":"Your AnythingLLM answers anyone on the internet with no login at all. Strangers can chat with your models (you pay for the tokens or the GPU), read every document you uploaded for RAG, and change your settings.","exposure_class":"no-auth-by-design","owasp":null,"observable":"GET :3001/ serves the AnythingLLM app with no login — single-user mode has no auth at all.","severity":"CRITICAL","reachability_note":"Internet-facing exposure — observable from the public internet with GET-only probes (the same probes unauth.dev sends).","fix_card_id":"anythingllm-exposed","cve":null,"references":["https://docs.anythingllm.com/installation-selfhosted/security"],"in_the_wild":null,"id":"UNAUTH-2026-0013","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0013 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0013"},{"type":"exposure-class","product":"Jupyter","title":"Jupyter notebook server exposed","summary":"An open Jupyter server is a terminal on your machine for anyone who finds it. Bots scan for it constantly (it is one of the most hijacked services on the internet) and use it for crypto mining or as a foothold into the rest of your network.","exposure_class":"no-auth-by-design","owasp":null,"observable":"GET :8888/api/status or /api/kernels answers 200 without a token.","severity":"CRITICAL","reachability_note":"Internet-facing exposure — observable from the public internet with GET-only probes (the same probes unauth.dev sends).","fix_card_id":"jupyter-exposed","cve":null,"references":["https://jupyter-notebook.readthedocs.io/en/stable/security.html"],"in_the_wild":null,"id":"UNAUTH-2026-0014","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0014 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0014"},{"type":"exposure-class","product":"Gradio","title":"Gradio app exposed to the internet","summary":"Your ML demo is public. Anyone can use it (you pay for compute), poke at its inputs, and if the app accepts file uploads or runs shell-adjacent code, probe it for escapes. Demos have a way of quietly becoming production.","exposure_class":"no-auth-by-design","owasp":null,"observable":"GET :7860/config answers a Gradio app config without auth.","severity":"HIGH","reachability_note":"Internet-facing exposure — observable from the public internet with GET-only probes (the same probes unauth.dev sends).","fix_card_id":"gradio-exposed","cve":null,"references":["https://www.gradio.app/guides/sharing-your-app"],"in_the_wild":{"service":"gradio","first_seen":"2026-08-02","last_seen":"2026-08-04","probes_30d":3,"probes_observed":3,"source":"unauth.dev botwatch honeypot"},"id":"UNAUTH-2026-0015","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0015 — observed 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0015"},{"type":"exposure-class","product":"Langflow","title":"Langflow instance exposed to the internet","summary":"Your Langflow UI is reachable from the internet. Flows, stored credentials and model API keys sit behind it, and older versions have unauthenticated remote-code-execution vulnerabilities that bots exploit within hours of disclosure.","exposure_class":"no-auth-by-design","owasp":null,"observable":"GET :7860/api/v1/version or /health answers Langflow JSON without login.","severity":"HIGH","reachability_note":"Internet-facing exposure — observable from the public internet with GET-only probes (the same probes unauth.dev sends).","fix_card_id":"langflow-exposed","cve":null,"references":["https://docs.langflow.org/"],"in_the_wild":null,"id":"UNAUTH-2026-0016","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0016 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0016"},{"type":"exposure-class","product":"Flowise","title":"Flowise agent builder / public chatflows exposed","summary":"Your Flowise agent builder is public. Chatflows and agentflows, stored credentials, and model API keys sit behind it. Flowise also whitelists /api/v1/public-chatflows and /api/v1/prediction/ — strangers can discover public flows and run your agents on your bill without logging in.","exposure_class":"no-auth-by-design","owasp":null,"observable":"GET :3000/api/v1/public-chatflows lists callable chatflows without auth.","severity":"CRITICAL","reachability_note":"Internet-facing exposure — observable from the public internet with GET-only probes (the same probes unauth.dev sends).","fix_card_id":"flowise-exposed","cve":null,"references":["https://docs.flowiseai.com/configuration/authorization"],"in_the_wild":null,"id":"UNAUTH-2026-0017","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0017 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0017"},{"type":"exposure-class","product":"Chroma","title":"Chroma vector database open without authentication","summary":"Your Chroma database answers anyone. Every embedding can be read, poisoned, or deleted. Embeddings usually contain document text and may hold agent memory (OWASP ASI06). Chroma runs without auth unless you configure it.","exposure_class":"agent-memory-store","owasp":["ASI06"],"observable":"GET :8000/api/v2/heartbeat answers {\"nanosecond heartbeat\": ...} and /api/v2/collections lists data — no auth.","severity":"CRITICAL","reachability_note":"Internet-facing exposure — observable from the public internet with GET-only probes (the same probes unauth.dev sends).","fix_card_id":"chroma-exposed","cve":null,"references":["https://docs.trychroma.com/deployment/auth","https://genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications-the-benchmark-for-agentic-security-in-the-age-of-autonomous-ai/"],"in_the_wild":{"service":"chroma","first_seen":"2026-08-03","last_seen":"2026-08-05","probes_30d":245,"probes_observed":245,"source":"unauth.dev botwatch honeypot"},"id":"UNAUTH-2026-0018","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0018 — observed 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0018"},{"type":"exposure-class","product":"Weaviate","title":"Weaviate vector database open without authentication","summary":"Your Weaviate instance answers anyone: full schema and every stored vector readable, writable, poisonable and deletable — including stores that may hold agent memory (OWASP ASI06). Weaviate is wide open unless you turn on authentication.","exposure_class":"agent-memory-store","owasp":["ASI06"],"observable":"GET :8080/v1/meta and /v1/schema answer without auth.","severity":"CRITICAL","reachability_note":"Internet-facing exposure — observable from the public internet with GET-only probes (the same probes unauth.dev sends).","fix_card_id":"weaviate-exposed","cve":null,"references":["https://weaviate.io/developers/weaviate/configuration/authentication","https://genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications-the-benchmark-for-agentic-security-in-the-age-of-autonomous-ai/"],"in_the_wild":null,"id":"UNAUTH-2026-0019","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0019 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0019"},{"type":"exposure-class","product":"Weaviate","title":"Weaviate gRPC data plane (:50051) accepts connections","summary":"The port where your vectors actually live — Weaviate's gRPC data plane on :50051 — accepts connections from the internet, and the same host was confirmed to be Weaviate. This was measured by a zero-byte TCP connect, so it proves reachability, not that your data is readable: whether gRPC auth or TLS stands behind the open port was not tested. But Weaviate is wide open unless you turned on authentication, so an open :50051 usually means every vector readable and writable, including stores that may hold agent memory (OWASP ASI06) — treat it as exposed until proven otherwise.","exposure_class":"data-plane","owasp":["ASI06"],"observable":"A zero-byte TCP connect to :50051 (Weaviate gRPC data plane) succeeds from the internet; content was not probed.","severity":"HIGH","reachability_note":"Data-plane port — normally internal-only; internet reachability is a misconfiguration. Measured by a zero-byte TCP connect on a host already confirmed by its HTTP API; the hosted scanner never probes data-plane content.","fix_card_id":"weaviate-dataplane-exposed","cve":null,"references":["https://weaviate.io/developers/weaviate/configuration/authentication","https://genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications-the-benchmark-for-agentic-security-in-the-age-of-autonomous-ai/"],"in_the_wild":null,"id":"UNAUTH-2026-0020","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0020 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0020"},{"type":"exposure-class","product":"Redis","title":"Redis management console exposed to the internet","summary":"A RedisInsight or Redis Commander console is reachable without login. From there anyone can browse (and often change) keys in the Redis instances it manages — sessions, caches, and agent memory / tool state that RAG and agent stacks commonly park in Redis (OWASP ASI06). We detect the HTTP console, not the raw Redis wire protocol.","exposure_class":"agent-memory-store","owasp":["ASI06"],"observable":"GET :5540/api/health answers with a RedisInsight marker (or the Redis Commander page on :8081) without login.","severity":"CRITICAL","reachability_note":"Internet-facing exposure — observable from the public internet with GET-only probes (the same probes unauth.dev sends).","fix_card_id":"redis-exposed","cve":null,"references":["https://redis.io/docs/latest/operate/redisinsight/","https://redis.io/docs/latest/operate/oss_and_stack/management/security/acl/","https://genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications-the-benchmark-for-agentic-security-in-the-age-of-autonomous-ai/"],"in_the_wild":null,"id":"UNAUTH-2026-0021","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0021 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0021"},{"type":"exposure-class","product":"LangServe","title":"LangServe chain API exposed without authentication","summary":"LangServe publishes your LangChain/LangGraph runnable over HTTP with a playground UI. Without auth, anyone can open /playground or call /invoke and run your chain against your models, tools, and data.","exposure_class":"no-auth-by-design","owasp":null,"observable":"GET /openapi.json lists LangServe /invoke + /playground/ paths without auth.","severity":"CRITICAL","reachability_note":"Internet-facing exposure — observable from the public internet with GET-only probes (the same probes unauth.dev sends).","fix_card_id":"langserve-exposed","cve":null,"references":["https://github.com/langchain-ai/langserve","https://python.langchain.com/docs/langserve/"],"in_the_wild":null,"id":"UNAUTH-2026-0022","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0022 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0022"},{"type":"exposure-class","product":"OpenClaw","title":"OpenClaw control plane exposed to the internet","summary":"OpenClaw (also seen as Clawdbot/Moltbot) is a personal AI agent gateway. A public control UI — especially with auth_mode none — lets strangers drive the agent, its tools, and its skills.","exposure_class":"no-auth-by-design","owasp":null,"observable":"GET :18789/__openclaw/control-ui-config.json answers serverVersion/auth_mode without login.","severity":"CRITICAL","reachability_note":"Internet-facing exposure — observable from the public internet with GET-only probes (the same probes unauth.dev sends).","fix_card_id":"openclaw-exposed","cve":null,"references":["https://github.com/openclaw/openclaw"],"in_the_wild":null,"id":"UNAUTH-2026-0023","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0023 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0023"},{"type":"exposure-class","product":"OpenHands","title":"OpenHands agent server exposed to the internet","summary":"OpenHands Agent Server is a coding-agent control plane. Without auth on a public interface, strangers can start agent sessions, run tools, and burn your LLM budget.","exposure_class":"no-auth-by-design","owasp":null,"observable":"GET :8000/server_info answers JSON titled \"OpenHands Agent Server\" without auth.","severity":"CRITICAL","reachability_note":"Internet-facing exposure — observable from the public internet with GET-only probes (the same probes unauth.dev sends).","fix_card_id":"openhands-exposed","cve":null,"references":["https://docs.openhands.dev/","https://github.com/OpenHands/software-agent-sdk"],"in_the_wild":null,"id":"UNAUTH-2026-0024","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0024 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0024"},{"type":"exposure-class","product":"OpenAI-compatible API","title":"OpenAI-compatible API exposed without authentication","summary":"An anonymous /v1/models (and usually /v1/chat/completions) surface lets strangers inventory models and burn inference — whether the backend is vLLM-shaped, a LiteLLM/OpenRouter-style proxy, or another OpenAI-compatible server we have not named yet.","exposure_class":"no-auth-by-design","owasp":null,"observable":"GET /v1/models answers an OpenAI-style model list without an API key.","severity":"HIGH","reachability_note":"Internet-facing exposure — observable from the public internet with GET-only probes (the same probes unauth.dev sends).","fix_card_id":"openai-compat-exposed","cve":null,"references":["https://platform.openai.com/docs/api-reference/models"],"in_the_wild":null,"id":"UNAUTH-2026-0025","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0025 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0025"},{"type":"exposure-class","product":"AutoGen Studio","title":"AutoGen Studio agent API exposed without authentication","summary":"AutoGen Studio publishes multi-agent teams, sessions, and debugging over HTTP. Without auth, strangers can orchestrate agents against your models and tools.","exposure_class":"no-auth-by-design","owasp":null,"observable":"GET :8080/api/version answers \"AutoGen Studio API\" without auth.","severity":"CRITICAL","reachability_note":"Internet-facing exposure — observable from the public internet with GET-only probes (the same probes unauth.dev sends).","fix_card_id":"autogen-studio-exposed","cve":null,"references":["https://microsoft.github.io/autogen/stable//user-guide/autogen-studio/index.html"],"in_the_wild":null,"id":"UNAUTH-2026-0026","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0026 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0026"},{"type":"exposure-class","product":"CrewAI Studio","title":"CrewAI Studio exposed to the internet","summary":"CrewAI Studio is the control plane for multi-agent crews and flows. A public login page means strangers can reach the surface that holds crew definitions and model credentials.","exposure_class":"no-auth-by-design","owasp":null,"observable":"GET /auth/login serves the CrewAI Studio control-plane login page to anyone.","severity":"HIGH","reachability_note":"Internet-facing exposure — observable from the public internet with GET-only probes (the same probes unauth.dev sends).","fix_card_id":"crewai-exposed","cve":null,"references":["https://docs.crewai.com/"],"in_the_wild":null,"id":"UNAUTH-2026-0027","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0027 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0027"},{"type":"exposure-class","product":"MCP","title":"MCP server exposed without authentication","summary":"Your MCP server answers anyone on the internet — via an open SSE/HTTP transport, a public /messages/ session surface, a /.well-known MCP discovery card, or a static tools catalog on that card (the GET equivalent of unauthenticated tools/list). MCP servers are built for local use and ship with no auth by default; once public, strangers can discover and often CALL your tools (files, shell, databases — whatever the server exposes). That is anonymous tool execution, not just information disclosure.","exposure_class":"tool-transport","owasp":null,"observable":"GET /sse or /mcp answers an MCP transport (SSE stream or JSON-RPC) without auth — tool discovery is open.","severity":"CRITICAL","reachability_note":"Internet-facing exposure — observable from the public internet with GET-only probes (the same probes unauth.dev sends).","fix_card_id":"mcp-exposed","cve":null,"references":["https://modelcontextprotocol.io/specification/2025-06-18/basic/transports","https://modelcontextprotocol.io/docs/concepts/transports","https://datatracker.ietf.org/doc/html/draft-serra-mcp-discovery-uri"],"in_the_wild":{"service":"mcp","first_seen":"2026-08-02","last_seen":"2026-08-05","probes_30d":304,"probes_observed":304,"source":"unauth.dev botwatch honeypot"},"id":"UNAUTH-2026-0028","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0028 — observed 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0028"},{"type":"exposure-class","product":"MLflow","title":"MLflow tracking UI/API reachable without authentication","summary":"An open MLflow server lets strangers list experiments, read artifact paths, and often pull logged models or credentials stored as params.","exposure_class":"no-auth-by-design","owasp":null,"observable":"GET :5000 serves the MLflow tracking UI/API without auth.","severity":"HIGH","reachability_note":"Internet-facing exposure — observable from the public internet with GET-only probes (the same probes unauth.dev sends).","fix_card_id":"mlflow-exposed","cve":null,"references":["https://mlflow.org/docs/latest/auth/index.html"],"in_the_wild":null,"id":"UNAUTH-2026-0029","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0029 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0029"},{"type":"exposure-class","product":"LiteLLM","title":"LiteLLM proxy reachable without a master key","summary":"An open LiteLLM proxy exposes your model catalog and often lets strangers burn your upstream API budget through /v1/chat/completions.","exposure_class":"no-auth-by-design","owasp":null,"observable":"GET :4000 answers the LiteLLM proxy model catalog without a master key.","severity":"HIGH","reachability_note":"Internet-facing exposure — observable from the public internet with GET-only probes (the same probes unauth.dev sends).","fix_card_id":"litellm-exposed","cve":null,"references":["https://docs.litellm.ai/docs/proxy/virtual_keys"],"in_the_wild":null,"id":"UNAUTH-2026-0030","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0030 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0030"},{"type":"exposure-class","product":"Kubeflow","title":"Kubeflow dashboard reachable without authentication","summary":"An open Kubeflow central dashboard exposes pipelines, notebooks, and cluster ML workflows to anyone who can reach the URL.","exposure_class":"no-auth-by-design","owasp":null,"observable":"GET :8080 serves the Kubeflow dashboard without auth.","severity":"HIGH","reachability_note":"Internet-facing exposure — observable from the public internet with GET-only probes (the same probes unauth.dev sends).","fix_card_id":"kubeflow-exposed","cve":null,"references":["https://www.kubeflow.org/docs/components/central-dash/overview/"],"in_the_wild":null,"id":"UNAUTH-2026-0031","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0031 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0031"},{"type":"exposure-class","product":"LM Studio","title":"LM Studio local API reachable without authentication","summary":"LM Studio's OpenAI-compatible API is meant for localhost. On the public internet, strangers can list and run your local models on your hardware.","exposure_class":"no-auth-by-design","owasp":null,"observable":"GET :1234/api/v0/models answers the LM Studio local API without auth.","severity":"HIGH","reachability_note":"Internet-facing exposure — observable from the public internet with GET-only probes (the same probes unauth.dev sends).","fix_card_id":"lmstudio-exposed","cve":null,"references":["https://lmstudio.ai/docs"],"in_the_wild":null,"id":"UNAUTH-2026-0032","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0032 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0032"},{"type":"cve","product":"n8n","title":"n8n CVE-2026-21858 (Ni8mare)","summary":"Unauthenticated file access via improper webhook/form request parsing (Content-Type confusion). A vulnerable form-based workflow lets an unauthenticated attacker read arbitrary files (credentials, OAuth tokens) and can cascade to full instance takeover / RCE. CVSS 10.0.","exposure_class":null,"owasp":null,"observable":null,"severity":"CRITICAL","reachability_note":null,"fix_card_id":"cve-2026-21858","cve":"CVE-2026-21858","affected":">=1.65.0,<1.121.0","fixed_in":"1.121.0","kev":false,"human_approved":true,"last_verified":"2026-07-29","references":["https://github.com/advisories/GHSA-v4pr-fm98-w9pg"],"in_the_wild":null,"id":"UNAUTH-2026-0033","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0033 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0033","verification_state":"verified"},{"type":"cve","product":"Ollama","title":"Ollama CVE-2024-37032 (Probllama)","summary":"Path traversal via unvalidated digest format lets a remote attacker (no auth needed on default Ollama) overwrite arbitrary files on the server, leading to remote code execution.","exposure_class":null,"owasp":null,"observable":null,"severity":"CRITICAL","reachability_note":null,"fix_card_id":"cve-2024-37032","cve":"CVE-2024-37032","affected":"<0.1.34","fixed_in":"0.1.34","kev":false,"human_approved":true,"last_verified":"2026-07-29","references":["https://nvd.nist.gov/vuln/detail/CVE-2024-37032"],"in_the_wild":null,"id":"UNAUTH-2026-0034","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0034 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0034","verification_state":"verified"},{"type":"cve","product":"ComfyUI-Manager","title":"ComfyUI-Manager CVE-2025-67303","summary":"Data and configuration directories are not protected by the ComfyUI web API access control. An unauthenticated attacker can overwrite the manager config (security_level=weak) and install a malicious custom node, achieving remote code execution.","exposure_class":null,"owasp":null,"observable":null,"severity":"CRITICAL","reachability_note":null,"fix_card_id":"cve-2025-67303","cve":"CVE-2025-67303","affected":"<3.38","fixed_in":"3.38","kev":false,"human_approved":true,"last_verified":"2026-07-29","references":["https://nvd.nist.gov/vuln/detail/CVE-2025-67303"],"in_the_wild":null,"id":"UNAUTH-2026-0035","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0035 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0035","verification_state":"verified"},{"type":"cve","product":"Open WebUI","title":"Open WebUI CVE-2026-44551","summary":"LDAP empty-password authentication bypass: when LDAP auth is enabled and the directory accepts unauthenticated simple binds, an attacker can log in as any user with an empty password. CVSS Critical.","exposure_class":null,"owasp":null,"observable":null,"severity":"CRITICAL","reachability_note":null,"fix_card_id":"cve-2026-44551","cve":"CVE-2026-44551","affected":"<0.9.0","fixed_in":"0.9.0","kev":false,"human_approved":true,"last_verified":"2026-07-29","references":["https://github.com/advisories/GHSA-2r4p-jpmg-48f4"],"in_the_wild":null,"id":"UNAUTH-2026-0036","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0036 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0036","verification_state":"verified"},{"type":"cve","product":"Langfuse","title":"Langfuse CVE-2025-64504","summary":"Certain project membership APIs trusted a user-controlled orgId in authorization checks, letting any authenticated user enumerate names and email addresses of users in another organization on the same instance.","exposure_class":null,"owasp":null,"observable":null,"severity":"MEDIUM","reachability_note":null,"fix_card_id":"cve-2025-64504","cve":"CVE-2025-64504","affected":[">=2.70.0,<2.95.11",">=3.0.0,<3.124.1"],"fixed_in":"2.95.11 / 3.124.1","kev":false,"human_approved":true,"last_verified":"2026-07-29","references":["https://github.com/langfuse/langfuse/security/advisories/GHSA-94hf-6gqq-pj69"],"in_the_wild":null,"id":"UNAUTH-2026-0037","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0037 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0037","verification_state":"verified"},{"type":"cve","product":"Langfuse","title":"Langfuse CVE-2026-41487","summary":"RBAC flaw in the LLM connection update flow: an authenticated project member could point an existing LLM connection at an attacker-controlled baseUrl, exposing the stored plaintext provider API key. CVSS 5.4.","exposure_class":null,"owasp":null,"observable":null,"severity":"MEDIUM","reachability_note":null,"fix_card_id":"cve-2026-41487","cve":"CVE-2026-41487","affected":">=3.68.0,<3.167.0","fixed_in":"3.167.0","kev":false,"human_approved":true,"last_verified":"2026-07-29","references":["https://github.com/langfuse/langfuse/security/advisories/GHSA-2524-j966-gfgh"],"in_the_wild":null,"id":"UNAUTH-2026-0038","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0038 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0038","verification_state":"verified"},{"type":"cve","product":"vLLM","title":"vLLM CVE-2026-22778","summary":"Remote code execution via the video-processing path of multimodal endpoints. Only deployments actually serving a video model are affected, but the exploit works even when the optional API key is configured.","exposure_class":null,"owasp":null,"observable":null,"severity":"CRITICAL","reachability_note":null,"fix_card_id":"cve-2026-22778","cve":"CVE-2026-22778","affected":">=0.8.3,<0.14.1","fixed_in":"0.14.1","kev":false,"human_approved":true,"last_verified":"2026-07-29","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-4r2x-xpjr-7cvv"],"in_the_wild":null,"id":"UNAUTH-2026-0039","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0039 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0039","verification_state":"verified"},{"type":"cve","product":"vLLM","title":"vLLM CVE-2026-54236","summary":"Incomplete fix for CVE-2026-22778: error responses from the Anthropic-compatible router and speech-to-text realtime endpoint leak Python object representations containing process memory addresses (CWE-532), useful for bypassing ASLR in follow-on exploitation.","exposure_class":null,"owasp":null,"observable":null,"severity":"MEDIUM","reachability_note":null,"fix_card_id":"cve-2026-54236","cve":"CVE-2026-54236","affected":"<=0.23.0","fixed_in":"0.24.0","kev":false,"human_approved":true,"last_verified":"2026-07-29","references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-hgg8-fqqc-vfmw"],"in_the_wild":null,"id":"UNAUTH-2026-0040","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0040 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0040","verification_state":"verified"},{"type":"cve","product":"Langflow","title":"Langflow CVE-2026-33017","summary":"Unauthenticated RCE: POST /api/v1/build_public_tmp/{flow_id}/flow accepts attacker-controlled flow definitions whose node code is passed to exec() without sandboxing. Actively exploited within ~20h of disclosure. CVSS 9.3.","exposure_class":null,"owasp":null,"observable":null,"severity":"CRITICAL","reachability_note":null,"fix_card_id":"cve-2026-33017","cve":"CVE-2026-33017","affected":"<1.9.0","fixed_in":"1.9.0","kev":false,"human_approved":true,"last_verified":"2026-07-29","references":["https://nvd.nist.gov/vuln/detail/CVE-2026-33017"],"in_the_wild":null,"id":"UNAUTH-2026-0041","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0041 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0041","verification_state":"verified"},{"type":"cve","product":"n8n","title":"n8n CVE-2025-68613","summary":"Authenticated RCE via expression injection: the {{ }} expression sandbox fails to isolate execution, letting any user with workflow edit rights reach process.mainModule and run system commands as the n8n process. Actively exploited (CISA KEV). CVSS 9.9.","exposure_class":null,"owasp":null,"observable":null,"severity":"CRITICAL","reachability_note":null,"fix_card_id":"cve-2025-68613","cve":"CVE-2025-68613","affected":[">=0.211.0,<1.120.4","==1.121.0"],"fixed_in":"1.120.4 / 1.121.1 / 1.122.0","kev":true,"human_approved":true,"last_verified":"2026-07-29","references":["https://nvd.nist.gov/vuln/detail/CVE-2025-68613"],"in_the_wild":null,"id":"UNAUTH-2026-0042","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0042 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0042","verification_state":"verified"},{"type":"cve","product":"Langflow","title":"Langflow CVE-2025-3248","summary":"Unauthenticated code injection in /api/v1/validate/code: the endpoint executes attacker-supplied Python. Remote code execution with no login. Actively exploited (CISA KEV). CVSS 9.8.","exposure_class":null,"owasp":null,"observable":null,"severity":"CRITICAL","reachability_note":null,"fix_card_id":"cve-2025-3248","cve":"CVE-2025-3248","affected":"<1.3.0","fixed_in":"1.3.0","kev":true,"human_approved":true,"last_verified":"2026-07-29","references":["https://nvd.nist.gov/vuln/detail/CVE-2025-3248"],"in_the_wild":null,"id":"UNAUTH-2026-0043","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0043 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0043","verification_state":"verified"},{"type":"cve","product":"Langflow","title":"Langflow CVE-2026-0770","summary":"Unauthenticated RCE via the exec_globals parameter of the validate endpoint (ZDI-26-036). Remote code execution as root, no login. Actively exploited (CISA KEV, added 2026-07-21). CVSS 9.8.","exposure_class":null,"owasp":null,"observable":null,"severity":"CRITICAL","reachability_note":null,"fix_card_id":"cve-2026-0770","cve":"CVE-2026-0770","affected":"<=1.7.3","fixed_in":"latest (advisory lists no fixed version; run the newest release)","kev":true,"human_approved":true,"last_verified":"2026-07-29","references":["https://github.com/advisories/GHSA-g22f-v6f7-2hrh"],"in_the_wild":null,"id":"UNAUTH-2026-0044","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0044 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0044","verification_state":"verified"},{"type":"cve","product":"Langflow","title":"Langflow CVE-2026-55255","summary":"IDOR in /api/v1/responses: any authenticated user can execute another user's flows by ID, harvesting embedded credentials and API keys. Actively exploited (CISA KEV). CVSS 9.9 (vendor) / 8.4 (NVD).","exposure_class":null,"owasp":null,"observable":null,"severity":"CRITICAL","reachability_note":null,"fix_card_id":"cve-2026-55255","cve":"CVE-2026-55255","affected":"<1.9.1","fixed_in":"1.9.1","kev":true,"human_approved":true,"last_verified":"2026-07-29","references":["https://github.com/advisories/GHSA-qrpv-q767-xqq2"],"in_the_wild":null,"id":"UNAUTH-2026-0045","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0045 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0045","verification_state":"verified"},{"type":"cve","product":"Langflow","title":"Langflow CVE-2025-34291","summary":"CORS/CSRF chain: allow_origins='*' with credentials + SameSite=None refresh cookie lets a malicious page hijack a victim's session, then execute code via the validate endpoint. Account takeover → RCE. Actively exploited (CISA KEV). CVSS 9.4 (v4).","exposure_class":null,"owasp":null,"observable":null,"severity":"CRITICAL","reachability_note":null,"fix_card_id":"cve-2025-34291","cve":"CVE-2025-34291","affected":"<=1.6.9","fixed_in":"latest (upgrade past 1.6.9 and review CORS settings)","kev":true,"human_approved":true,"last_verified":"2026-07-29","references":["https://www.sentinelone.com/vulnerability-database/cve-2025-34291/"],"in_the_wild":null,"id":"UNAUTH-2026-0046","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0046 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0046","verification_state":"verified"},{"type":"cve","product":"n8n","title":"n8n CVE-2026-65014","summary":"n8n: Unauthenticated Endpoint Allows Cancellation of Any User's Active Test Webhook","exposure_class":null,"owasp":null,"observable":null,"severity":"MEDIUM","reachability_note":null,"fix_card_id":"cve-2026-65014","cve":"CVE-2026-65014","affected":"<2.27.4","fixed_in":"2.27.4","kev":false,"human_approved":true,"last_verified":"2026-07-29","references":["https://osv.dev/vulnerability/CVE-2026-65014"],"in_the_wild":null,"id":"UNAUTH-2026-0047","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0047 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0047","verification_state":"verified"},{"type":"cve","product":"n8n","title":"n8n CVE-2026-65015","summary":"n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool","exposure_class":null,"owasp":null,"observable":null,"severity":"HIGH","reachability_note":null,"fix_card_id":"cve-2026-65015","cve":"CVE-2026-65015","affected":">=2.30.0,<2.30.1","fixed_in":"2.30.1","kev":false,"human_approved":true,"last_verified":"2026-07-29","references":["https://osv.dev/vulnerability/CVE-2026-65015"],"in_the_wild":null,"id":"UNAUTH-2026-0048","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0048 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0048","verification_state":"verified"},{"type":"cve","product":"n8n","title":"n8n CVE-2026-65016","summary":"n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner","exposure_class":null,"owasp":null,"observable":null,"severity":"HIGH","reachability_note":null,"fix_card_id":"cve-2026-65016","cve":"CVE-2026-65016","affected":"<1.123.64","fixed_in":"1.123.64","kev":false,"human_approved":true,"last_verified":"2026-07-29","references":["https://osv.dev/vulnerability/CVE-2026-65016"],"in_the_wild":null,"id":"UNAUTH-2026-0049","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0049 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0049","verification_state":"verified"},{"type":"cve","product":"n8n","title":"n8n CVE-2026-65589","summary":"n8n: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data","exposure_class":null,"owasp":null,"observable":null,"severity":"MEDIUM","reachability_note":null,"fix_card_id":"cve-2026-65589","cve":"CVE-2026-65589","affected":"<1.123.64","fixed_in":"1.123.64","kev":false,"human_approved":true,"last_verified":"2026-07-29","references":["https://osv.dev/vulnerability/CVE-2026-65589"],"in_the_wild":null,"id":"UNAUTH-2026-0050","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0050 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0050","verification_state":"verified"},{"type":"cve","product":"n8n","title":"n8n CVE-2026-65590","summary":"n8n: computer-use Shell Sandbox Not Enforced on Linux and Windows","exposure_class":null,"owasp":null,"observable":null,"severity":"MEDIUM","reachability_note":null,"fix_card_id":"cve-2026-65590","cve":"CVE-2026-65590","affected":">=2.30.0,<2.30.1","fixed_in":"2.30.1","kev":false,"human_approved":true,"last_verified":"2026-07-29","references":["https://osv.dev/vulnerability/CVE-2026-65590"],"in_the_wild":null,"id":"UNAUTH-2026-0051","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0051 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0051","verification_state":"verified"},{"type":"cve","product":"n8n","title":"n8n CVE-2026-65591","summary":"n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution","exposure_class":null,"owasp":null,"observable":null,"severity":"HIGH","reachability_note":null,"fix_card_id":"cve-2026-65591","cve":"CVE-2026-65591","affected":"<1.123.64","fixed_in":"1.123.64","kev":false,"human_approved":true,"last_verified":"2026-07-29","references":["https://osv.dev/vulnerability/CVE-2026-65591"],"in_the_wild":null,"id":"UNAUTH-2026-0052","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0052 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0052","verification_state":"verified"},{"type":"cve","product":"n8n","title":"n8n CVE-2026-65592","summary":"n8n: Stored DOM XSS via Resource Locator `cachedResultUrl`","exposure_class":null,"owasp":null,"observable":null,"severity":"HIGH","reachability_note":null,"fix_card_id":"cve-2026-65592","cve":"CVE-2026-65592","affected":"<1.123.64","fixed_in":"1.123.64","kev":false,"human_approved":true,"last_verified":"2026-07-29","references":["https://osv.dev/vulnerability/CVE-2026-65592"],"in_the_wild":null,"id":"UNAUTH-2026-0053","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0053 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0053","verification_state":"verified"},{"type":"cve","product":"n8n","title":"n8n CVE-2026-65593","summary":"n8n: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access","exposure_class":null,"owasp":null,"observable":null,"severity":"MEDIUM","reachability_note":null,"fix_card_id":"cve-2026-65593","cve":"CVE-2026-65593","affected":"<1.123.64","fixed_in":"1.123.64","kev":false,"human_approved":true,"last_verified":"2026-07-29","references":["https://osv.dev/vulnerability/CVE-2026-65593"],"in_the_wild":null,"id":"UNAUTH-2026-0054","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0054 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0054","verification_state":"verified"},{"type":"cve","product":"n8n","title":"n8n CVE-2026-65594","summary":"n8n: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check","exposure_class":null,"owasp":null,"observable":null,"severity":"MEDIUM","reachability_note":null,"fix_card_id":"cve-2026-65594","cve":"CVE-2026-65594","affected":">=2.30.0,<2.30.1","fixed_in":"2.30.1","kev":false,"human_approved":true,"last_verified":"2026-07-29","references":["https://osv.dev/vulnerability/CVE-2026-65594"],"in_the_wild":null,"id":"UNAUTH-2026-0055","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0055 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0055","verification_state":"verified"},{"type":"cve","product":"n8n","title":"n8n CVE-2026-65595","summary":"n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTs","exposure_class":null,"owasp":null,"observable":null,"severity":"HIGH","reachability_note":null,"fix_card_id":"cve-2026-65595","cve":"CVE-2026-65595","affected":">=2.30.0,<2.30.1","fixed_in":"2.30.1","kev":false,"human_approved":true,"last_verified":"2026-07-29","references":["https://osv.dev/vulnerability/CVE-2026-65595"],"in_the_wild":null,"id":"UNAUTH-2026-0056","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0056 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0056","verification_state":"verified"},{"type":"cve","product":"n8n","title":"n8n CVE-2026-65596","summary":"n8n: GraphQL Node Bypasses \"Allowed HTTP Request Domains\" Restriction","exposure_class":null,"owasp":null,"observable":null,"severity":"MEDIUM","reachability_note":null,"fix_card_id":"cve-2026-65596","cve":"CVE-2026-65596","affected":"<1.123.64","fixed_in":"1.123.64","kev":false,"human_approved":true,"last_verified":"2026-07-29","references":["https://osv.dev/vulnerability/CVE-2026-65596"],"in_the_wild":null,"id":"UNAUTH-2026-0057","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0057 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0057","verification_state":"verified"},{"type":"cve","product":"n8n","title":"n8n CVE-2026-65597","summary":"n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview","exposure_class":null,"owasp":null,"observable":null,"severity":"HIGH","reachability_note":null,"fix_card_id":"cve-2026-65597","cve":"CVE-2026-65597","affected":"<1.123.64","fixed_in":"1.123.64","kev":false,"human_approved":true,"last_verified":"2026-07-29","references":["https://osv.dev/vulnerability/CVE-2026-65597"],"in_the_wild":null,"id":"UNAUTH-2026-0058","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0058 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0058","verification_state":"verified"},{"type":"cve","product":"n8n","title":"n8n CVE-2026-65598","summary":"n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution","exposure_class":null,"owasp":null,"observable":null,"severity":"HIGH","reachability_note":null,"fix_card_id":"cve-2026-65598","cve":"CVE-2026-65598","affected":"<1.123.64","fixed_in":"1.123.64","kev":false,"human_approved":true,"last_verified":"2026-07-29","references":["https://osv.dev/vulnerability/CVE-2026-65598"],"in_the_wild":null,"id":"UNAUTH-2026-0059","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0059 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0059","verification_state":"verified"},{"type":"cve","product":"n8n","title":"n8n CVE-2026-65599","summary":"n8n: Google Service Account Private Key Exposed in JWT Header","exposure_class":null,"owasp":null,"observable":null,"severity":"MEDIUM","reachability_note":null,"fix_card_id":"cve-2026-65599","cve":"CVE-2026-65599","affected":"<1.123.64","fixed_in":"1.123.64","kev":false,"human_approved":true,"last_verified":"2026-07-29","references":["https://osv.dev/vulnerability/CVE-2026-65599"],"in_the_wild":null,"id":"UNAUTH-2026-0060","published":"2026-08-05","updated":"2026-08-05","citation":"unauth.dev advisory UNAUTH-2026-0060 — published 2026-08 · CC-BY 4.0","url":"https://unauth.dev/advisories/UNAUTH-2026-0060","verification_state":"verified"}]}