A rapid sequence of four critical CVEs in 18 days this year shows AI inference infrastructure becoming the primary attack surface, not just middleware or runtimes.

NemoClaw (CVE-2026-65105) arose on August 25 via a bound Ollama backend with DNS rebinding, DeepSeek Harness (CVE-2026-82533) on September 8 demonstrated a sandbox escape through a local-port API, IBM Langflow (CVE-2026-81204) on September 8 enabled unauthenticated remote code execution during graph construction, and SGLang (CVE-2026-86793) on September 11 extended to inference server authentication gaps.

Context notes show NemoClaw exploiting misconfigurations, DeepSeek Harness exposing vulnerable sandbox mechanics, Langflow permitting code execution on graph creation, and SGLang exposing SafeUnpickler weaknesses tied to partial whitelists for deserialization.

Industry implications stress that rapid adoption and default-exposed APIs in AI components amplify risk, underscoring the need for secure configurations, robust denylists, and authentication at all layers of AI stacks.

For enterprises, production deployments with high-velocity AI integrations face broad blast radii when authentication controls fail at the inference server layer, especially in frameworks shipped with default, permissive configurations.

The vulnerabilities underscore that secure deserialization cannot rely on blocking known dangerous functions alone and highlight the need for strong access controls at the inference server to protect model weights, tensor processing, and prediction serving.

These vulnerabilities illustrate a pattern of insecure defaults in AI components that prioritize ease of integration over security, enabling unauthenticated access or code execution through flawed deserialization, sandboxing, or API exposure.

Disclosures show a rising rate in 2026—from about one vulnerability per month in 2025 to roughly one per week in Q3 2026—pointing to urgent needs for secure defaults, robust access controls, and thorough deserialization safeguards.

The story ties into the broader authentication gap concept, stressing that secure authentication must extend to AI inference servers, not only intermediaries, with implications for deployment practices and security tooling.

CVE-2026-86793 in SGLang enables arbitrary function calls via a SafeUnpickler bypass due to overly broad builtins and an incomplete denylist, granting unauthenticated access to /update_weights_from_tensor when no API key is configured and no vendor patch exists at disclosure.

Specifically, the SGLang flaw stems from a SafeUnpickler bypass where broad builtins prefixes and a partial denylist enable a gadget chain to reach arbitrary functions, allowing unauthenticated access to critical endpoints.

Together, NemoClaw, DeepSeek Harness, IBM Langflow, and SGLang illustrate a trend: insecure defaults and exposed control interfaces in AI tooling create high-risk surfaces as deployment velocity accelerates.