金融交易产品的向量库写入无鉴权：投毒内容可操纵智能体的工具调用，CVSS 7.3Unauthenticated writes to a financial product's vector store: poisoned content can steer the agent's tool calls, CVSS 7.3

The product's AI agent server accepted unauthenticated writes to its vector store: with no credentials at all, an attacker could write malicious runbook content into the store; once retrieved, that content could steer MCP tool calls, potentially triggering unauthorised payments or leaking payment data. CVSS 7.3.

Limit: this is a vendor vulnerability disclosure, not a confirmed incident, with no confirmed exploitation; the potential exposure is financial institutions running the product. Graded media-reported: IBM's advisory is located and was checked this round via coverage. Compare INC-014: unauthenticated write surfaces, in a vector store here and an error-event system there.

Vector stores are often treated as read-only knowledge bases, leaving the write side bare. For a RAG system, writing to the store is rewriting the agent's textbook; poison the textbook and the tool calls downstream follow. The write side and the read side were never the same risk.

Vector stores and every knowledge write surface need the same authentication as the read side, with provenance checks before external content is admitted.

Authenticate writes equally: write interfaces for vector and knowledge stores are authenticated like read interfaces; unauthenticated writes are refused.

Check provenance at admission: external content is provenance- and integrity-checked before entering the knowledge base; poison stays outside.

Register disclosures as disclosures: vendor vulnerabilities without confirmed exploitation are filed on the disclosure account, limits stated, never merged with confirmed incidents.