Four AI Stack Vulnerabilities, and What They Share

None of them is a model bug. MLflow CVE-2026-64849 is a server-side request forgery caused by validating a URL as a string and then fetching it with a client that re-resolved the hostname. Vanna.AI CVE-2024-5565 is code execution caused by passing model-generated Python to an execution call. mcp-remote CVE-2025-6514 is operating system command injection from an unsanitised OAuth authorization endpoint value. The Slack AI exfiltration was indirect prompt injection reaching a retrieval layer that did not enforce channel permissions. Three of the four are ordinary application security bugs that happen to live in AI infrastructure, and the fourth is an authorization failure in a retrieval path. Every one of them is found with test cases that predate large language models, which is why an AI pentest that only tests the prompt misses all four.

No, and the distinction is practical rather than pedantic. MLflow CVE-2026-64849 carries a CVSS v3.1 base score of 9.3, sits in the CISA Known Exploited Vulnerabilities catalog, and was published by India's CERT-In as vulnerability note CIVN-2026-0416 on 20 August 2026 at Critical severity. No model, prompt or inference path appears anywhere in the bug. It is a server-side request forgery in a machine learning platform's webhook delivery path: the validator checked the original URL while the delivery code followed a redirect and re-resolved the hostname without pinning the validated address. It is found with OWASP WSTG v4.2 test case WSTG-INPV-19, which is a standard web test. Calling it an AI vulnerability sends teams looking in the wrong place.

Validate-then-fetch is a time-of-check-to-time-of-use bug in which a URL is validated as text and then handed to an HTTP client that resolves the hostname again and follows redirects. The check and the fetch look at two different destinations, so a validator can be completely correct about the string it inspected and still allow a request to an internal address. It keeps appearing because the two halves usually live in different files, written at different times by different people, and neither file looks wrong on its own. Any product that accepts a URL from a user and fetches it later has this shape: webhooks, callbacks, link previews, image imports, PDF rendering and avatar fetching. The fix is to pin the resolved address that was validated, rather than to improve the string validation.

Output handling, not prompt filtering. Vanna.AI is an open source Python library that turns a natural language question into a SQL query, and it also asked the model to write the Python charting code for the answer and then ran that code. CVE-2024-5565 was published on 31 May 2024, classified as CWE-94, Improper Control of Generation of Code, with a CVSS 3.1 base score of 8.1 assigned by JFrog as the CVE Numbering Authority. In OWASP Top 10 for LLM Applications terms, prompt injection is how it starts and Improper Output Handling is what makes it matter. The dangerous line is the sink rather than the prompt: remove or isolate the execution step and the same injection produces a bad chart instead of a bad outcome. The advisory's own mitigation is to disable the code generation path for untrusted input.

CVE-2025-6514 is an operating system command injection in mcp-remote, triggered by an unsanitised OAuth authorization endpoint value, with a CVSS score of 9.6, affecting versions 0.0.5 through 0.1.15, disclosed by JFrog Security Research. It affects you if you run mcp-remote at an affected version, which is a version pinning question rather than an architectural one. The broader point for anyone operating Model Context Protocol servers is that an MCP server is ordinary software on your network with a tool surface attached, so it inherits every ordinary software risk plus a new one. The most common cause of MCP incidents we see is unmanaged drift on a community server that was fine at install and changed later, which is why pinning versions is the highest-value hour available to most teams.

No, and that matters for how you track this class. In August 2024 researchers at PromptArmor showed that Slack AI could be made to surface content from private channels the requesting user had no access to. The attacker needed no elevated privileges and never interacted with the victim. They posted text in a public channel, and the assistant later read that text as instructions while answering somebody else's unrelated question. Slack initially described the underlying behaviour as intended, then investigated the composed scenario and deployed a patch. Because it was treated as a product behaviour rather than a software defect, there is no CVE identifier to track, which means a vulnerability management programme keyed only to CVE feeds would never have seen it.

Because three of the four vulnerabilities here have no prompt in them at all, and the fourth is an authorization failure in the retrieval layer rather than a filtering failure at the input. A test plan built around jailbreak attempts and prompt injection payloads will find neither the SSRF in a webhook delivery path, nor the command injection in an OAuth parameter, nor the execution sink that runs generated code. Our AI agent testing methodology treats the agent as four layers: the model, the planning loop, the tool calls, and memory and state. The interesting findings cluster at the tool call boundary and in memory, which is where untrusted content meets a privileged action. Prompt testing is one layer of four, and on its own it is the layer least likely to produce a finding that changes anything.

Start at the sinks, because the sinks are where a prompt becomes a consequence. List every place model output reaches an interpreter, a shell, a query engine, a template, a browser or an HTTP client, and treat each one as an untrusted input boundary. Then list every place your system fetches a URL that a user supplied, and check whether the address that was validated is the address that gets connected to. Then check the authorization boundary of any retrieval layer, meaning whether the assistant can read content the requesting user cannot. Those three passes would have caught the Vanna.AI class, the MLflow class and the Slack AI class respectively, and none of them requires a model specialist.

Yes, and it is a useful lever that Indian teams under-use. CERT-In published MLflow CVE-2026-64849 as vulnerability note CIVN-2026-0416 on 20 August 2026 at Critical severity. For an Indian engineering team, a CERT-In note is a nationally recognised reference to attach to an out-of-cycle upgrade request, which is frequently the difference between a patch shipping this sprint and next quarter. CERT-In also runs a separate incident reporting obligation under its April 2022 directions, which is a different mechanism from the vulnerability notes and carries its own six-hour clock. Knowing which of the two you are dealing with matters, because one is advisory and the other is a reporting duty with a deadline.

Three things, in increasing order of effort. Maintain an inventory of AI and machine learning components with pinned versions, which includes MCP servers, model serving platforms, vector databases, orchestration libraries and anything that turns model output into an action. Subscribe to the vendor advisories and the CVE feed for each, and for Indian teams add CERT-In vulnerability notes. Then accept that feeds will not cover everything, because the Slack AI exfiltration never received a CVE identifier and a feed-only programme would have missed it entirely. That last gap is the argument for periodic testing rather than purely reactive patching: some of this class arrives as a research disclosure or a product behaviour change rather than as a numbered record.

It depends which of the four classes you care about, and the honest answer is that a good web and API test covers more of this than vendors selling AI-specific testing usually admit. The MLflow class is a web SSRF and a standard web test finds it. The mcp-remote class is command injection in a parameter and a standard API test finds it. The Vanna.AI class sits at the boundary: a tester has to know that generated text reaches an execution call, which is a scoping question rather than a skill question. The Slack AI class needs testing of the retrieval layer's authorization behaviour, which is genuinely different work. Scope the agent surface explicitly and you get both; assume your web test covers the agent because the agent is on the web and you get neither.

We treat the agent as four layers and test the boundaries between them: the model, the planning loop, tool calls, and memory and state. In practice most findings cluster where untrusted content reaches a privileged action, which means tool call authorization, output handling at every sink, the retrieval layer's permission model, and the MCP server inventory including versions and OAuth configuration. We also run the ordinary web and API test cases against the surrounding application, because three of the four vulnerabilities on this page are ordinary web bugs living in AI infrastructure. Testing is led by Rathnakara GN, who holds the OSCP and an M.Sc in Cyber Security, and both founders work on every engagement.