Skip to content
AgentProv

2026-07-10 · 2026-Q3

Wave of Critical RCE Flaws Across AI Agent Frameworks (CVE-2026-61447, CVE-2026-54769, CVE-2026-57572, CVE-2026-59726)

Primary layerL5 ConfigSecondary:L6 Identity / RunL1 Credential

Who wrote the file that runs on open?

The question layer 5 asks, and failed here.
Fixable
Vendor patch
Vendor response
Patched
In the wild
No
Actor
Attacker

Target

PraisonAI before 1.6.78; Langroid before 0.65.2; Crawl4AI before 0.9.0; Ruflo before 3.16.3

Impact

Four separate critical remote code execution paths were disclosed the same week. PraisonAI's CodeAgent runs LLM-generated Python with no AST validation or sandbox (CVE-2026-61447); Langroid escapes its evaluation sandbox in `TableChatAgent`/`VectorStore` when `full_eval=True` (CVE-2026-54769); Crawl4AI's Docker API accepts attacker-supplied Chromium arguments for unauthenticated RCE (CVE-2026-57572); and Ruflo, a meta-harness for Claude Code and Codex, exposes an unauthenticated MCP bridge whose `terminal_execute` tool grants shell access and provider-key theft (CVE-2026-59726)

Root cause

LLM-generated code, SQL, or shell arguments executed without validation or isolation, plus MCP and dashboard endpoints exposed with no authentication

CVEs

Sources

Catalog

View this entry in the catalog

Cite this: AgentProv incident record: Wave of Critical RCE Flaws Across AI Agent Frameworks (CVE-2026-61447, CVE-2026-54769, CVE-2026-57572, CVE-2026-59726) (2026-07-10). https://agentprov.com/incidents/2026-07-10-wave-of-critical-rce-flaws-across-ai-agent-frameworks-cve-2026-61447-cve-2026

Related