Noma Labs

In this novel attack vector disclosure by Noma Labs, Workflow Identity Hijacking is explained and documented. Described as a scenario where the underlying model is not manipulated, tricked, or jailbroken. Attackers are able to bypass standard controls by sending normal, benign requests through an unauthenticated entry point (such as a support inbox, GitHub issue, web form, or shared document). The enterprise AI pipeline reads the input, interprets the request, and executes the action exactly as designed. The core failure is that the requester had no authority to make that request. The root cause is an authorization design flaw in modern enterprise AI pipelines: the identity and permissions of the user who triggers a workflow are decoupled from the identity and permissions used to execute it.

At Noma, our mission is simple: identify and reduce emerging AI risk before it impacts your business. Following our discoveries of ForcedLeak, GeminiJack, and DockerDash, the Noma Labs Team has identified a new critical vulnerability: GrafanaGhost.

Trust is the most vulnerable component of the modern development stack. Today, we are disclosing a critical vulnerability in Upstash’s Context7 MCP Server, one of the most popular MCP servers on GitHub, with approximately 50,000 stars and more than 8 million npm downloads.