LiteLLM proxy flaw scores 9.9, and Liquid AI ships LFM3
A critical LiteLLM proxy advisory chains a low-privilege user to remote code execution, Liquid AI releases the small LFM3 family, and MCP's C# SDK 2.0 makes HTTP stateless by default.
A loud day for advisories and a quiet one for flagship launches. The useful work today is a version audit and one look at your cache sizing.
1 · Top story
A normal LiteLLM proxy user can become admin, then run code
An advisory for the LiteLLM proxy was added to the GitHub Advisory Database on 27 October. Cross-domain reuse of the salt key lets an authenticated internal_user escalate to proxy_admin and reach remote code execution, scored 9.9 (Critical) on CVSS v3. It is a separate issue from the 1.107.0 supply-chain compromise we covered last week.
If your proxy fronts several teams, the gap between “can call models” and “can administer the gateway” was one flaw wide. The stopgap costs something real: turning off the experimental UI login also breaks CLI SSO and Claude Code gateway login, so patch rather than live with it.
Affected: 1.91.0–1.100.3, 1.101.0–1.101.2, 1.102.0–1.102.1, 1.103.0, 1.104.0rc1 (1.87.0–1.90.x only if EXPERIMENTAL_UI_LOGIN=true) · Fixed in: 1.100.4, 1.101.3, 1.102.2, 1.103.1, 1.104.0rc2 · Severity: 9.9 Critical (CVSS v3) · Stopgap: set EXPERIMENTAL_UI_LOGIN=false · If compromised: not stated in the advisory beyond upgrading to a patched version as soon as possible.
2 · Models & features
Liquid AI’s LFM3 puts text, vision and voice into roughly 2B-class models
Liquid AI’s LFM3 cards on Hugging Face list LFM3-1.7B (text, 256K context), LFM3-VL-2B (vision, 128K) and LFM3-Omni-2B (text, image, video and audio in; text or speech out, 32K). All three use the LFM Open License v1.0. The 1.7B card targets local agents, tool calling and structured output, and says it is not recommended for agentic coding.
Treat the numbers as Liquid’s own: IFEval 96.66 and BFCL V4 71.39 for the text model, and the cards show Qwen3.5-9B ahead on several tests. For on-device routing or extraction, this is a cheap model to put against whatever small model you run today.
3 · Agents
MCP’s C# SDK 2.0 drops the session handshake
The official C# SDK for MCP, maintained with Microsoft, reached 2.0, implementing the 2026-07-28 spec revision. HTTP is stateless by default: the initialize handshake and the Mcp-Session-Id header are gone. Tools can now ask for more input mid-call by throwing InputRequiredException, and the client re-issues the call with the answers.
That removes the sticky-session requirement behind a load balancer, which is the real win for anyone running MCP servers at scale. The cost is breaking changes: Tasks moved to an opt-in package, and OAuth is stricter, with RFC 9207 issuer validation and mandatory advertised PKCE S256 support. Check which of your servers quietly relied on sessions.
4 · People worth following
LangChain’s design agent: one sandbox per Slack thread, rules deleted as models improved
LangChain’s team describes Content Studio, an internal agent on Managed Deep Agents that makes decks and motion graphics in code. Each Slack thread gets its own Linux sandbox, and stage order is enforced in code rather than in prompts. They report the median request cost falling from about $8 to about 50 cents.
The lesson that travels is about deleting. Most hard-coded rules were removed after Opus 5.5, and the memory file is capped at a 200-line index after an early version reached 500K tokens. The figures are self-reported and the post promotes LangChain’s own products.
5 · Architecture
KV cache hit rate decides when chat latency falls off a cliff
At QCon AI, Momento’s Khawaja Shams showed a small vLLM experiment: a 4B FP8 model, a 10,000-token system prompt and 12-turn agentic-coding-style sessions. With 12 concurrent sessions p99 time to first token was 2.6 s; at 14 it was 38.9 s. Adding 16 GB of DRAM as a cache tier brought p99 back to 3.5 s, and 32 GB moved the cliff from 14 to 28 sessions.
Two GPUs without session affinity reached 128 tok/s, and with affinity 201 tok/s. So routing is part of capacity planning, not an afterthought. It is one speaker’s small test, not a production benchmark.
Also worth knowing
🆕 New on the radar
- Baidu Unlimited-OCR-2 — a 3B open-weight document parser under MIT, released 27 October, claiming state of the art on hundred-page document benchmarks, Baidu’s own. Try. Source
- Entire Git Forge — the former GitHub CEO’s git host for agents, with agent code review in sandboxes and hosting in India; the 418 pushes per second figure is the company’s own claim. Watch. Source
🛡️ Security & governance
- vLLM RCE (CVE-2026-114053) — a request-controlled
code_revisioncan import attacker code in vLLM 0.7.3–0.30.0 (CVSS 8.1 High); only setups withtrust_remote_codeenabled are exposed; fixed in 0.31.0. Source - MCP Python SDK token audience —
mcp1.10.0–1.29.1 and 2.0.0–2.1.1 accept bearer tokens issued for another server (CVSS 6.8); fixed in 1.30.0 and 2.2.0, and you must also setvalidate_token_resource=True. Source - MLflow tracking server — versions 3.12.0rc0–3.16.1 allow remote code execution on servers running without authentication, through scorer deserialization (CVSS 9.8); the advisory lists 3.17.0 as fixed. Source
🧰 Models & tools
- Cloudflare Auto Router — set the model to
cloudflare/autoin AI Gateway and a classifier picks a model per request; public beta. Watch. Source - GitHub Copilot assisted permissions — now GA in the CLI, Copilot app and VS Code; safe requests skip approval, and admins can block “Allow All”. Source
🏢 Platforms & enterprise
- AWS kernel CVE triage — a script drops about 70% of Linux kernel CVEs and an agent classifies the rest in about 3.4 seconds each; two engineers usually review each table. Source
- Google IAM Helper — agent skills and read-only MCP tools for IAM troubleshooting and policy changes, with human confirmation by risk tier. Source
Pick one proxy to check today, and let the rest of the list keep until tomorrow.
Middle East, India & events · 3
- Sarvam signs a five-year defence AI MoU — Sarvam and India’s Ministry of Defence (via HQ Integrated Defence Staff) will build AI for the Army, Navy and Air Force, run by its Chanakya division; coverage says human oversight is retained for operational decisions. Project list and dates are not disclosed. Source
- Maya 2 Native — Maya Research released an open-weight streaming text-to-speech model under Apache 2.0, covering 12 languages (11 Indian plus English); it recommends an NVIDIA GPU with 12 GB or more. Source
- Dubai Chambers’ Chamber AI Hub — launched as a chamber-led agent marketplace with 22 agents across seven business areas, available to Dubai’s private-sector firms. Source
Researched and drafted with AI, checked against the linked sources. How we use AI →