An unauthenticated request to an Enterprise-licensed LiteLLM proxy could make it read a local file and send it to the attacker, master key included. 1.106.5 and backports to three older lines shipped yesterday evening, 50 minutes before the advisory. NVIDIA disclosed a 10.0 in its NeMo Agent Toolkit that 1.9.0 fixed in September and three TensorRT-LLM flaws fixed only in release candidates, and GitHub's database caught up on Authlib's October advisories, which Open WebUI's pin keeps it from reaching.

A scanner will raise only Authlib from this table, eight of its nine records, now that GitHub's reviewed feed is back: it resumed at 13:27 UTC yesterday after 87 hours without a record. The LiteLLM and AWS advisories return 404 in GitHub's database, and the NVIDIA and llama.cpp CVEs sit in its unreviewed feed with no package attached.

Worth your morning

LiteLLM: the master key, for anyone who can reach an LLM route. GHSA-w4c7-34wj-hqm8 (10.0), published at 20:33 UTC yesterday: on a LiteLLM proxy running with an Enterprise license, an unauthenticated request to any LLM route could make the proxy read a local file and send its contents to a URL the attacker chose. The process environment is one such file. It holds LITELLM_MASTER_KEY and the provider API keys, which give full admin control of the proxy, and in some configurations that extends to running Python as root. Open-source deployments without a license never load the affected code. Two researchers reported it independently.

Fixes went to PyPI on four lines between 19:39 and 19:44 UTC: 1.106.5, 1.105.6, 1.104.8 and 1.103.10. Nothing older than 1.103.10 got a backport, so move to one of those. If you can't upgrade today, the advisory's interim measures are to reject request bodies carrying callback parameters at the edge (it lists the five JSON keys) and to limit the proxy's outbound traffic to your model providers, because the file contents leave in an outbound request. If an Enterprise proxy has been reachable from the internet, rotate the master key and the provider keys it holds. The advisory also recommends loading the master key from a secret manager rather than the environment, and setting a separate LITELLM_SALT_KEY.

NVIDIA: a 10.0 fixed in September, and fixes that exist only as release candidates. NVIDIA published two bulletins yesterday. The NeMo Agent Toolkit bulletin covers CVE-2026-65145 (10.0), missing authentication in versions 1.0 through 1.8.0 that can lead to code execution, and CVE-2026-65151 (8.4, local), an SQL injection in 1.4 through 1.6. It doesn't say which component either one sits in. The fixes are 1.9.0, on PyPI as nvidia-nat since September 10, and 1.7.0 from May. The fix shipped seven weeks ago; the bulletin explaining why you needed it shipped yesterday. On 1.9.0 you have nothing to do.

The TensorRT-LLM bulletin covers three flaws, all rated with a local attack vector: CVE-2026-65119 (8.4), where tokenizer loading in the KV-cache-aware router can pull in code from an untrusted source, and two server-side request forgeries, CVE-2026-65120 and CVE-2026-24269 (7.1 each). NVIDIA lists 1.3.0rc24 as affected and 1.3.0rc25 (August 28) as fixed. Every fixed build is a pre-release, up to 1.4.0rc1 last week. The bulletin doesn't mention 1.2.1, the stable release that pip install tensorrt-llm picks, although its serve/router.py defines the same router class. If you use that router on 1.2.1, ask NVIDIA or move to a release candidate.

Authlib: nine advisories two weeks old, and Open WebUI pinned inside all of them. Authlib, the Python OAuth and JOSE library, published nine advisories on October 10 and 14 and fixed them in 1.8.0, 1.9.0 and 1.9.1, the last two both on October 14. This digest missed them, because Authlib wasn't on its watch list. GitHub's database added eight between 14:50 and 16:09 UTC yesterday, so scanners now raise them; the ninth, GHSA-c73q (8.8), isn't in it yet.

• Four concern code that verifies tokens with Authlib. In GHSA-6v38 (9.1), a relying party that calls JsonWebSignature.deserialize_json() on input it didn't produce accepts a payload the attacker wrote as signed. Two 7.4s allow HMAC token forgery: GHSA-7vr2 from the issuer's public key alone (an incomplete fix of CVE-2024-37568), and GHSA-8m4g when the configured HMAC key is empty. A 4.2 lets an ID token switch off its own nonce check.
• Four concern authorization servers built on Authlib (8.8, 6.8, 5.4, 4.6), and a 2.6, fixed in 1.8.0, concerns its transport-security check.

Upgrade to 1.9.1. Open WebUI can't follow: 0.12.4, its newest release, pins authlib==1.7.2, and so do its main and dev branches. 1.7.2 is inside all nine ranges. Open WebUI's OAuth and OIDC sign-in is built on Authlib, but none of the advisories says whether that path reaches the affected code, and this digest hasn't tested it. If you run Open WebUI with OAuth sign-in, watch for a release that lifts the pin. Google's ADK already requires Authlib 1.9.1 or later, and Gradio's oauth extra takes whatever version the environment has.

Also on the AI stack.

• AWS API MCP Server 1.6.0 (yesterday): in OAuth mode on the streamable HTTP transport, 1.3.0 through 1.5.6 checked a bearer token's signature, issuer and expiry but not which application it was issued to. A token the same identity provider issued to another app, such as another client in the same Cognito user pool, could run AWS calls with the server's credentials (CVE-2026-115413, 7.8; 7.3 on v4). 1.6.0 requires you to set the expected audience or client ID. The default stdio transport isn't affected.
• llama.cpp: VulnCheck's CVE-2026-118375 (9.2 on v4; 8.1 on v3.1) covers the RDMA transport of the RPC backend from b8841 (April) until b11865 (Saturday): an unauthenticated peer could overflow a stack buffer in rpc-server. Exposure needs a build with GGML_RPC, which is off by default, with RDMA support, which the build switches on by itself when it finds the RDMA library, and a running rpc-server. Ollama doesn't include the RPC backend.
• CrewAI 1.15.31 (last night) fixes three flaws credited to an advisory it hasn't published yet: checkpoint restore could load arbitrary Python objects, the NL2SQL tool's read-only mode could be bypassed, and skill archive extraction had a race. Restoring unregistered tool types now needs CREWAI_DESERIALIZE_CALLBACKS=1. It doesn't touch ZDI-26-706 (CVE-2026-92206, 8.8), covered on October 22, which still has no fix at 1.15.32.
• pypdf 6.21.3 (yesterday) fixes four mediums in which crafted PDFs cause long runtimes or heavy memory use: page labels, encrypted files, cross-reference streams and exceptions in strict mode.
• VulnCheck filed ten CVEs at 14:16 UTC yesterday against small MCP servers and agent tools: ai-sdlc, DroidMind, the ATXP Gemini CLI extension, sf-mcp, esp-mcp, mcp-ffmpeg, Kali-GPT, hagent, Tabularis and nmap-mcp. Eight are command injection through tool parameters (up to 7.8; 8.5 on v4), Tabularis has an SQL injection fixed in 0.28.0, and nmap-mcp an allowlist bypass. Only Tabularis names a fix. Don't point an agent that uses any of the others at content you don't control.

On the Venicecom stack. Quiet. MSRC's overnight revisions to three October .NET CVEs (CVE-2026-70007, CVE-2026-70161, CVE-2026-96225) only update acknowledgements, and Angular and PrimeNG released nothing. follow-redirects 1.16.2 (Sunday, 94 million downloads a week) fixes a 5.9 in 1.16.0 and 1.16.1 (GHSA-mrwp-f3q8-3g9p, now CVE-2026-116689): a custom credential header could follow a cross-origin redirect when the caller passed its sensitiveHeaders list from another realm. The advisory says axios isn't affected, and axios 1.x picks up 1.16.2 on a lockfile refresh anyway.

Correction. Yesterday's digest said Hydra's GHSA-wf6j had gone. GitHub's database published a record under that ID at 17:08 UTC yesterday, pointing at the new hydra-ecosystem/hydra repository, so it's the ID scanners will raise; the repository's own advisory is GHSA-757g. Same ranges, same fixes: 1.3.8 and 1.4.0rc3.

Paperwork your scanner may raise. The reviewed feed's 90 records include many fixes this digest already covered. MLflow's three (CVE-2026-116690 to CVE-2026-116692: 9.8, 7.5 and 6.5, fixed in 3.17.0, covered on October 10 and October 13), the MCP Python SDK's three (CVE-2026-116684 to CVE-2026-116686, fixed in 1.30.0 and 2.2.0), GitPython's six (3.2.0, October 1), three LiteLLM records including the 9.9 admin escalation, six undici records (6.29.1 / 7.30.1 / 8.12.2), the MCP TypeScript SDK's body-size record (1.30.1), MONAILabel's 9.3 (1.6.1), two vLLM, msgpack (1.2.3), rembg (2.0.82), Satori (0.33.5) and NLTK's WekaClassifier record (3.10.4). Two never named here: Strands Agents, AWS's agent SDK, had two records from October 5 for session files that other local users could read or tamper with, fixed in 1.48.0. Still not in the database: Mercury, AutoGPT, the GitLab MCP server and the .NET out-of-band records.

vLLM published six more advisories late yesterday (5.3 to 6.5), for request-driven exhaustion in video and image preprocessing, an incomplete earlier fix and a log-sanitising pattern, all fixed in 0.30.0 or 0.31.0; 0.32.0 is current. Google filed CVE-2026-115522 (5.3 on v4) for ADK's file artifact service, where apps sharing one storage root could reach each other's artifacts, fixed in 1.39.1 and 2.7.0 in August (2.13.0 is current). Nuxt Ollama's CVE-2026-59158, covered on September 10, reached NVD.

Standing items. The MCP Kotlin SDK's 0.16.0 (yesterday) caps inbound WebSocket messages at 16 MiB for Application.mcpWebSocket, the transport in CVE-2026-108714, followed here since October 12. With Route.mcpWebSocket, set maxFrameSize when you install WebSockets; the cap doesn't apply there. GitHub's record still names no fixed version. 0.16.0 also expires idle streamable HTTP sessions and limits how many there can be, and its SSE client refuses an endpoint on another origin. Gradio 6.31.0 (this morning) requires Brotli 1.2.1 or later. Weaviate 1.39.14 and 1.38.23 and NVIDIA Dynamo 1.6.1 drop the eMudhra (emSign) certificates covered on October 21. Archon 0.13.0 (this morning) doesn't mention CVE-2026-111322, so keep HOST=127.0.0.1. The GitLab MCP server's 2.3.13 (last night) carries no security notes; 2.3.12 remains the fix. MLflow has released nothing since 3.17.2, so the fix for CVE-2026-53995 is still on master only. GitHub's records for .NET's CVE-2026-70197 and CVE-2026-102870 still name 8.0.32, 9.0.21 and 10.0.13; go by 8.0.33, 9.0.22 and 10.0.14. Unchanged: OpenHands' Apptainer launcher at 1.58.2, Aider issue 5885, Hugging Face Datasets PR 8879, Open WebUI's promised advisories, SGLang 0.5.22 with PRs 45017, 44314 and 44653 open, DB-GPT 0.8.2, picomatch PR 194, Chroma 1.5.9, Portkey AI Gateway 1.15.2, BotSharp, Unla 0.10.0, Vearch 3.5.9, openapi-typescript-codegen 0.31.0, cc-connect, pandas-ai 3.0.0, LightLLM v1.2.0, GPT-SoVITS, Langchain-Chatchat 0.3.1.3, BrowserSkill (PR 363 unmerged), AstronRPA 1.1.7 and mcp-remote 0.15.2.