Four self-hosted AI agent frameworks shipped unauthenticated RCE

On October 20, 2026, the NVD published five critical CVEs — scored 9.8 to 9.9 — against the AI agent frameworks Letta, Langchain-Chatchat, DB-GPT, and Piflow: tool-execution endpoints with no authentication and databases shipped with default credentials. If you run one of these frameworks, take it off the public internet until you have checked the version and port exposure.