Loading story…
Two newly disclosed vulnerabilities affect widely used security and AI-adjacent platforms. Chainlit versions earlier than 2.10.1 are vulnerable to CVE-2026-56104, a critical flaw in WebSocket session restoration that lets an unauthenticated attacker supply a valid sessionId and inherit an authenticated user’s session without ownership verification. The issue can allow attackers to assume victim roles and permissions, invoke tools without authorization, and access data available only to the compromised user. The published guidance is to upgrade to Chainlit 2.10.1 or later and ensure session restoration enforces ownership checks.
OpenCTI is also affected by CVE-2026-21887, a server-side request forgery vulnerability in its data ingestion component that allows an authenticated attacker to force the platform to fetch attacker-controlled URLs. Because OpenCTI often runs as a trusted internal node in security operations environments, the flaw can be used to reach internal services, bypass perimeter controls, and in cloud deployments query the instance metadata service at 169.254.169.254 to obtain temporary AWS IAM credentials, potentially enabling broader infrastructure compromise. The issue was scored CVSS 7.7, and remediation centers on validating outbound destinations and blocking requests to private and link-local address ranges.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
A critical session hijacking vulnerability affecting Chainlit versions earlier than 2.10.1 was published. The flaw allows unauthenticated attackers to restore authenticated WebSocket sessions by supplying a valid sessionId without ownership verification.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cvereports.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported two **high-severity vulnerabilities** in the open-source AI chatbot framework **Chainlit** that could enable sensitive data exposure and, in some environments, broader cloud compromise. The issues—**CVE-2026-22218** (arbitrary file read) and **CVE-2026-22219** (server-side request forgery, SSRF)—were described as “easy-to-exploit” and particularly risky because Chainlit-based applications are often deployed internet-facing and integrated with other enterprise services (for example, via common AI tooling and cloud backends). Technical details indicate CVE-2026-22218 can be triggered via a malicious element update request using a tampered custom element, allowing attackers to read files such as `/proc/self/environ` and potentially exfiltrate environment variables containing **API keys, credentials, and other secrets**. CVE-2026-22219 could allow SSRF against servers hosting AI applications, creating a path to access internal resources. Zafran reported responsible disclosure to maintainers in November and stated it had not observed in-the-wild exploitation; Chainlit released **version 2.9.4** to address both flaws, and organizations running Chainlit were advised to update to the patched release.
Jun 29, 2026
CISA added **CVE-2026-42271** to its Known Exploited Vulnerabilities catalog after evidence emerged that attackers are exploiting a command injection flaw in BerriAI **LiteLLM**. The bug affects MCP server test endpoints in self-hosted LiteLLM deployments, where crafted `stdio` parameters can trigger arbitrary command execution on the proxy host. On its own, the flaw requires a valid proxy API key, but researchers reported it is being chained with **CVE-2026-48710** in **Starlette**—a Host header validation bypass known as **BadHost**—to bypass authentication and achieve unauthenticated remote code execution. The exposed attack path affects LiteLLM versions **1.74.2 through 1.83.6** when deployed with **Starlette 1.0.0 or earlier**, and researchers rated the combined chain as effectively **critical** with a CVSS score of **10.0**. Successful compromise can let attackers run OS commands, steal model provider credentials, API keys, secrets, and environment variables, and pivot into connected AI infrastructure. BerriAI patched the issue in **LiteLLM 1.83.7** by restricting the vulnerable test endpoints to the `PROXY_ADMIN` role, while defenders are being urged to upgrade LiteLLM and Starlette, limit network access to the affected endpoints, rotate stored credentials, and review logs for suspicious Host header and subprocess activity.
Jun 29, 2026
Public disclosures highlighted multiple high-severity vulnerabilities across industrial control systems, open-source software, and consumer networking gear, with several issues enabling **unauthenticated remote compromise**. Johnson Controls disclosed **CVE-2025-26385** (CVSS 10.0), a critical SQL injection affecting multiple building/ICS management products (including *ADS/ADX, LCS8500, NAE8500, SCT, CCT*) that can allow remote, unauthenticated attackers to execute arbitrary SQL to alter/delete/exfiltrate data; CISA guidance emphasized isolating control system networks from the internet, segmentation, and controlled remote access (e.g., VPNs). Additional unauthenticated remote issues include **CVE-2026-25069** in *SunFounder Pironman Dashboard* (path traversal in log API endpoints enabling arbitrary file read/deletion) and **CVE-2025-51958** in the *DokuWiki* `runcommand` plugin (unauthenticated command execution via `lib/plugins/runcommand/postaction.php`). Other disclosures include developer-tooling and application-layer injection flaws and multiple router memory-corruption bugs with public exploit references. *Orval* fixed **CVE-2026-25141**, a code-injection issue where incomplete escaping can be bypassed using **JSFuck**-style payloads, and *Cybersecurity AI (CAI)* addressed **CVE-2026-25130**, where `subprocess.Popen(..., shell=True)` enables argument/command injection leading to RCE (notably via the `find_file()` tool). Data-layer issues include **CVE-2025-69662** in *geopandas* (`to_postgis()` SQL injection) and **CVE-2026-24854** in *ChurchCRM* (authenticated SQL injection via `PerID` in `/PaddleNumEditor.php`, patched in 6.7.2), while **CVE-2025-36384** affects *IBM Db2 for Windows* (local privilege escalation via unquoted search path). SOHO router flaws **CVE-2026-1686** (*Totolink A3600R*) and **CVE-2026-1637** (*Tenda AC21*) describe remotely reachable buffer/stack overflows with publicly available exploit material, increasing the likelihood of opportunistic exploitation where exposed management interfaces exist.
Jun 29, 2026