Tracking vulnerabilities in LiteLLM, MCP servers and AI agent tools
Quick answer, Oct 28, 2026As of 28 October 2026, list_ai_stack_vulnerabilities on the Distributed Risk MCP server lists new advisories against the software AI agents run on: agent frameworks, LLM gateways such as LiteLLM, MCP servers and SDKs, model serving and ML platforms. Malicious-package reports come first. Each entry gives package, severity, fixed versions, CVEs and EPSS.
What it covers
New advisories, newest and most severe first, for: agent frameworks (LangChain, LlamaIndex, CrewAI, n8n, Langflow), LLM gateways (LiteLLM), MCP servers and SDKs, model serving (vLLM, Ollama), ML platforms (MLflow, Ray, Jupyter), model libraries, AI apps and coding agents. Malicious-package reports (a compromised or lookalike release) come first. CISA KEV entries in the same stack are included. Each entry gives the package, severity, fixed versions, CVEs, EPSS and the advisory.
Source: OSV.dev (GitHub, PyPI and OpenSSF advisories), with CISA KEV.
Connect
claude mcp add --transport http distributed-risk https://www.distributedrisk.com/mcp
See the AI access page. search_kev and list_cyber_advisories accept an AI-stack filter too.
How to act on an entry
- Is the package or version in your build or deployment?
- Is there a fixed version, and is it pinned?
- For a malicious-package report: which release, and did anything install it? Rotate secrets reachable from any host that did.
- Is the CVE in CISA KEV or high in EPSS? Raise the priority.
Examples on the desk
Malicious litellm versions on PyPI (MAL-2026-2144), MCP TypeScript server SDK: shared transport delivered one HTTP client's messages to another, Langflow OS command injection via MCP stdio server configuration and Jupyter Server gateway WebSocket handler bypass.
Questions
Does it scan my code? No. It reads the public advisory record; you match it to what you run.
How current is it? CISA's advisories are read every 30 minutes and the catalogs every hour; see the method.