Live AI Security Brief for August 1, 2026: Agents, Prompt Injection, and Model Risk

CVE-2026-55255: Langflow cross-user flow authorization bypass

NIST NVD and CISA KEV | July 7, 2026 | Known Exploited | CVSS 8.4 | Langflow Langflow before 1.9.1

Before version 1.9.1, an authenticated attacker could specify another user's flow ID and execute that flow. The CNA rates the issue 8.4 High, and CISA lists active exploitation.

Why it matters: Langflow Langflow before 1.9.1 can combine untrusted text with connectors, stored credentials, and tool permissions. The meaningful risk is what the surrounding agent is allowed to read, change, or send.

What to verify: Test with hostile input in an isolated environment, inspect connector scopes and retained context, require approval for sensitive actions, and confirm that tool calls are logged and attributable.

CISA remediation date: 2026-07-10. Apply the current Langflow fix and follow CISA KEV remediation guidance.

Operational focus: Inventory tool permissions, connector access, stored credentials, and network reach available to the agent.

Open the original NIST NVD and CISA KEV record

CVE-2026-12942: IBM Langflow OSS 1.0.0 through 1.10.1 could allow a remote attacker to…

NIST National Vulnerability Database | July 31, 2026 | HIGH | CVSS 7.5

IBM Langflow OSS 1.0.0 through 1.10.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences ( /.. /) to view arbitrary files on the system.

Why it matters: CVE-2026-12942 can combine untrusted text with connectors, stored credentials, and tool permissions. The meaningful risk is what the surrounding agent is allowed to read, change, or send.

What to verify: Test with hostile input in an isolated environment, inspect connector scopes and retained context, require approval for sensitive actions, and confirm that tool calls are logged and attributable.

Operational focus: Treat repository text, retrieved documents, web pages, and user prompts as untrusted input.

Open the original NIST National Vulnerability Database record

CVE-2026-54785: gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode

GitHub Advisory Database | August 1, 2026 | MEDIUM | CVSS 6.2 | GitHub Advisory Database gemini-bridge

### Summary `consult_gemini_with_files` in **inline mode** read any file path supplied in the `files` argument without confining it to the working `directory`, then forwarded the contents to the Gemini CLI. Because the caller also controls `query`, the file contents are echoed back through the Gemini round-trip (and sent to Google), making this an arbitrary local file read. ###…

Why it matters: GitHub Advisory Database gemini-bridge can combine untrusted text with connectors, stored credentials, and tool permissions. The meaningful risk is what the surrounding agent is allowed to read, change, or send.

What to verify: Test with hostile input in an isolated environment, inspect connector scopes and retained context, require approval for sensitive actions, and confirm that tool calls are logged and attributable.