the websocket auth token issue (CVE-2026-25253) is nasty - basically lets anyone on the same network hijack your session. got patched in 2026.1.29 but a lot of self-hosted installs are probably still running older versions.

honestly not suprised to see prompt injection issues in agentic tools. the attack surface is huge when you give an LLM access to real tools. most security reviews i've seen focus on traditional vulns and completely miss the injection angle.