CVE-2026-64651 – CyberSecurityBoard

Critical CVEs

AWS, Google, and Vercel Patch Agent Flaws Allowing Tool Execution Without Model Authorization

Security researchers have uncovered a class of vulnerabilities in agent infrastructure from Amazon Web Services (AWS), Google, and Vercel that allow attackers…

Agent Infrastructure AI Security Amazon Bedrock AgentCore Amazon Web Services

August 6, 2026

Critical CVEs

CVE-2026-64651: Vercel AI SDK OpenCode Harness Authorization Bypass

The @ai-sdk/harness-opencode package through version 1.0.27 allows sandboxed code to invoke host-exposed tools by spoofing the process path. CVSS v4.0 score 6.3.…

AI SDK Authorization Bypass CVE-2026-64651 opencode

August 6, 2026

Cyber Products

Vercel AI SDK Harness Vulnerabilities

The Vercel AI SDK harness packages for Codex and OpenCode had authorization bypass vulnerabilities, fixed in versions 1.0.29 and 1.0.28 respectively.

AI SDK Codex CVE-2026-64650 CVE-2026-64651

August 6, 2026