Model Context Problems

Nous Research's Hermes Agent Tracked Its MCP Catalog by Branch Name

Fri, 28 Aug 2026 00:00:00 GMT

VulnCheck published CVE-2026-82021 on August 28, 2026, crediting Zubair Ashraf of Helmet Security. Hermes Agent's bundled MCP catalog referenced a third-party upstream repository through a mutable branch rather than a pinned commit, so whoever controlled that branch controlled what every installing host fetched and ran. The fix commit rewrites the n8n catalog manifest from `ref: main` to `ref: 7a9ae00795593aa1fdb4e61ecd640e8bfd0c3841` and states the reasoning outright: branches and tags can be moved by the upstream owner, SHAs cannot. Affected in 0.18.2 up to 0.19.0, and in the 2026.7.7.2 line up to 2026.7.20. CVSS 8.3 at NVD and 9.0 at VulnCheck, CWE-494.

SiYuan's Fourth MCP Advisory in a Month Is Another Tool That Skips the Workspace Check

Fri, 28 Aug 2026 00:00:00 GMT

VulnCheck published CVE-2026-82233 on August 28, 2026, crediting joysinleung, against SiYuan before v3.8.1. The `asset.upload` MCP tool accepts arbitrary absolute file paths with no workspace boundary validation. An agent talked into calling it copies files from outside the workspace into the notebook's asset store. CVSS 6.9 under CVSS 4.0, with the vector requiring low privileges and user interaction. This is the fourth SiYuan MCP advisory in under four weeks, after the three from August 3 and August 8.

ToolUniverse and Telnyx Serve MCP on Every Interface and Ask for No Credential

Thu, 27 Aug 2026 00:00:00 GMT

VulnCheck published two MCP advisories on August 27, 2026, both crediting Avishai Gonen of Pluto Security, and both are the same bug wearing a different logo. ToolUniverse, the agentic tool platform out of Harvard's MIMS lab, ran caller-supplied Python behind a denylist of attribute names and calls, on a server that asked for no credential at all (CVE-2026-81096). The Telnyx MCP server served MCP at the root path from a listener bound to every interface, and parsed the caller's authentication headers in a mode that did not fail when they were absent (CVE-2026-81098). VulnCheck scores both 9.3. NVD scores them 10.0 and 9.1.

Five DNS Rebinding Findings in One Day, Four of Them an SDK Option Nobody Set

Thu, 27 Aug 2026 00:00:00 GMT

The same August 27 batch carries five host-header findings credited to Avishai Gonen of Pluto Security. `mcp-go` served any request arriving over a loopback connection regardless of the host it named, in both `StreamableHTTPServer.ServeHTTP` and `SSEServer.ServeHTTP`, and its SSE transport's cross-origin handling had the same gap (CVE-2026-81092). Validation landed in v0.56.0, tagged July 8, 2026. The other four are servers that called their SDK's HTTP factory and never set the DNS-rebinding-protection option it offers: Timescale's `pg-aiguide` (CVE-2026-81095) and `tiger-slack` (CVE-2026-81099), `tiger-gh-mcp-server` (CVE-2026-81100), and Dropbox's Dash MCP server (CVE-2026-81102), which restricted its listener to loopback and then accepted whatever host a request named.

Apify's SSRF Fix Shipped in March and the CVE Turned Up in August

Thu, 27 Aug 2026 00:00:00 GMT

Two SSRF advisories from the August 27 batch credit Yotam Perkal of Pluto Security. The `get-html-skeleton` tool in Apify's Actors MCP server validated its `url` argument with `isValidHttpUrl`, which confirmed the string began with an http or https scheme and parsed as a URL, then fetched it without inspecting the hostname or the address it resolved to (CVE-2026-81093, CVSS 8.7). Private ranges and cloud metadata endpoints were in reach. The fix is in `@apify/actors-mcp-server` 0.9.12, published to npm on March 20, 2026, five months before the advisory named it. The mcp-use inspector's proxy middleware read its destination from an `X-Target-URL` header or an `__mcp_target` parameter and proxied there without inspecting the host (CVE-2026-81091, CVSS 8.7); that one was fixed in 2.3.3, published one day before the advisory.

mcp-fetch Asks Node Whether `[::1]` Is an IP Address and Believes the Answer

Wed, 26 Aug 2026 00:00:00 GMT

VulnCheck published CVE-2026-80347 on August 26, 2026, crediting George Chen, against `mcp-fetch` through 1.6.3. `isSafeUrl` reads `hostname` off the parsed URL, which for a literal such as `http://[::1]/` hands back the string with its brackets still attached, and passes that to `net.isIP`. `net.isIP` returns 0 for a bracketed literal, so the guard concludes the target is not an IP address at all and skips the private-range checks it exists to run. The HTTP client then strips the brackets and connects to loopback. CVSS 8.7 at VulnCheck, 7.5 at NVD.

Coroot's MCP OAuth Endpoint Registers Any Redirect URI a Stranger Sends It

Tue, 25 Aug 2026 00:00:00 GMT

VulnCheck published CVE-2026-79786 on August 25, 2026, crediting George Chen, against Coroot 1.20.2 through 1.24.5. The MCP OAuth dynamic client registration endpoint is unauthenticated and accepts any syntactically valid redirect URI without validating where it points, so an attacker registers a client aimed at a host they control. Send the resulting authorization URL to a signed-in user, and their authorization code lands on the attacker's host. CWE-601, CVSS 7.0.

Neo.mjs Checks That the Path Is Inside the Project, Then Hands the Whole String to a Shell

Thu, 20 Aug 2026 00:00:00 GMT

novice-22 disclosed CVE-2026-18482 on August 20, 2026, a command injection in the file-system MCP server that ships inside Neo.mjs at `ai/mcp/server/file-system`. The `checkSyntax()` and `runPlaywrightTest()` tools build command strings by interpolating a caller-supplied `absolutePath` into `node --check ...` and `npx playwright test ...`, then run them through `child_process.exec()`, which spawns a shell. The sandbox check, `ensureSandboxed()`, resolves the path and confirms it sits under the project root. That answers where the path points and says nothing about what follows it, so `/home/user/neo/README.md; touch /tmp/MARKER` passes validation and the shell runs both halves. Versions through 13.1.0 are affected. The fix swaps `exec()` for `execFile()`, passing arguments as an array so there is no shell to parse them.

Spring AI’s MCP Streamable HTTP Transport Keeps Every Session It Has Ever Handed Out

Thu, 20 Aug 2026 00:00:00 GMT

Spring published CVE-2026-59279 on August 20, 2026 against Spring AI 2.0.0. The MCP Streamable HTTP server transport, in both the WebFlux and WebMvc variants, places no limit on the number of sessions it retains, and by default does not require clients to authenticate. A remote attacker sends initialization requests in a loop, the server keeps every session it creates, memory climbs, and the process eventually stops serving anyone. CVSS 7.5. Fixed in 2.0.1 for open source and 2.0.0.1 for enterprise support.

Splunk’s MCP Server App Deserializes Whatever Is Sitting in the Credential Store

Wed, 19 Aug 2026 00:00:00 GMT

Splunk published SVD-2026-0808 on August 19, 2026, covering CVE-2026-76404 in the Splunk MCP Server app below 1.2.1. The app’s credential management component deserializes stored data without checking whether the content is of the expected type, which Splunk classifies as CWE-502. A user holding the `admin` Splunk role can place a crafted object in that store and obtain arbitrary command execution on the underlying operating system. CVSS 9.1. Fixed in 1.2.1. The same bulletin carries a second deserialization bug, CVE-2026-76395 in the Splunk AI Toolkit, where a model codec unpickles sparse matrix data.

PyCharm Shipped Unauthenticated Jupyter MCP Code Execution, and the Public Description Is One Sentence

Mon, 17 Aug 2026 00:00:00 GMT

CVE-2026-75060 was published on August 17, 2026 against JetBrains PyCharm before 2026.2.1. The entire public description reads: "In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP tools." NVD scores it 8.4. JetBrains lists the issue on its shared fixed-issues page rather than in a dedicated advisory, so there is no write-up of the attack path, no statement of what "unauthenticated" reaches, and no proof of concept. The Jupyter MCP tools ship with the IDE, which puts the exposed surface on developer workstations.

The Official MCP PHP SDK Lets a Hostile Server Eat the Client’s Memory

Fri, 14 Aug 2026 00:00:00 GMT

tonghuaroot reported CVE-2026-53965 in `modelcontextprotocol/php-sdk`, the official PHP SDK, published as GHSA-7m52-jw36-44r3 on August 14, 2026. The HTTP client transport reads Server-Sent Events incrementally and appends every chunk to `$this->sseBuffer`, which is only drained when the `"\n\n"` event delimiter arrives. A server that never sends the delimiter grows that buffer without bound. The advisory ships a proof of concept: 1,000 well-formed events hold the client at 2.0 MB, while 400 MB of delimiter-free data kills a client running the default 256 MB `memory_limit`. Affects 0.5.0 through 0.7.0, fixed in 0.7.1.

argocd-mcp Lends the Operator's Argo CD Token to Whoever Connects First

Tue, 11 Aug 2026 00:00:00 GMT

leoluz published GHSA-rp45-5x3v-48mr on August 11, 2026, crediting shmulc8, against argocd-mcp 0.8.0 and earlier. Three gaps compose. The HTTP transport starts with `app.listen(port)`, so it binds every interface. It accepts MCP sessions without any caller credential whenever `ARGOCD_API_TOKEN` is configured, because the token is for talking outbound to Argo CD and nothing checks inbound. And it never applies the MCP SDK's Host validation. CVSS 10.0, fixed in 0.9.0. NVD ingested it as CVE-2026-82456 eighteen days later.

Grafana's MCP Server Lets the Caller Choose the Destination, Which Is What the Last Fix Was For

Tue, 11 Aug 2026 00:00:00 GMT

Grafana published CVE-2026-19516 on August 11, 2026. The `grafana_api_request` tool in `mcp-grafana` lets the caller choose the HTTP method, path, and body. A caller-supplied `X-Grafana-URL` request header then controls the destination, which is not restricted to the configured Grafana instance. Requests can be aimed at internal, loopback, and link-local services, including metadata endpoints, and the responses come back to the caller. CVSS 9.1. This is an incomplete fix for CVE-2026-15583, which stopped the tool from sending Grafana tokens to arbitrary hosts but left the destination itself unconstrained. Fixed in 1.1.0.

Next AI Draw.io Interpolates Its mcp Query Parameter Into Both a Script Block and the HTML

Tue, 11 Aug 2026 00:00:00 GMT

Hồ Việt Khánh reported CVE-2026-73037 on August 11, 2026 against `@next-ai-drawio/mcp-server` 0.2.1 and earlier, bundled in `next-ai-draw-io` 0.2.1 through 0.4.16. The MCP HTTP server takes the `mcp` query parameter and interpolates it without escaping into two contexts: a JavaScript string literal and the surrounding HTML. A payload of `";alert(1);//` breaks out of the script context, and an `` renders straight into the page. Both execute in the localhost origin. CVSS 6.1. The report was still unpatched when it was filed.

Microsoft's UFO Agent Framework Ships Two Unauthenticated MCP Servers That Drive an Android Phone

Mon, 10 Aug 2026 00:00:00 GMT

GHSA-24fq-m9rr-g3mm, published August 10, 2026, covers `create_mobile_data_collection_server` and `create_mobile_action_server` in `ufo/client/mcp/http_servers/mobile_mcp_server.py`. Both expose Streamable HTTP MCP services, on TCP 8020 and 8021, with no authentication. Port 8020 serves `capture_screenshot`, `get_ui_tree`, and `get_device_info`. Port 8021 serves `tap`, `swipe`, `type_text`, `launch_app`, `press_key`, and `click_control`. When UFO is configured for remote deployment and binds `0.0.0.0`, any client that can reach the ports initializes an MCP session and calls the tools without presenting an API key. The tools reach the connected Android device through ADB subprocesses. CVSS 9.4, affecting v3.0.7 and earlier, fixed in v3.0.8.

GhostSplice Splits One Exfiltration Request Across Three MCP Channels and Compliance Doubles

Mon, 10 Aug 2026 00:00:00 GMT

ASSET Research Group published GhostSplice on August 10, 2026. Researchers Murali Ediga and Sudipta Chattopadhyay call the technique cross-channel trust fragmentation. A malicious MCP server splits a credential-theft request into fragments that each read as routine and delivers them through channels the agent already trusts. The tool description advertises an `integrity_checker` with bland field names. A first tool result returns an ordinary project file scan. A second result supplies the mapping, telling the model which files fill which fields for a server-side hash check. No single channel carries the whole request. Across eleven API-tested models, splitting a request into two halves raised average compliance from 42 percent to 82 percent, and GPT-4o, Gemini, and Llama went from refusing to 100 percent. VS Code adds a third channel through server-initiated sampling. The tests ran in isolated projects seeded with fake credentials, and the group says CVE identifiers will follow coordinated disclosure.

VulDB Files Twelve MCP Server CVEs in Four Days and Most Maintainers Never Answered

Thu, 06 Aug 2026 00:00:00 GMT

Between August 6 and August 9, 2026, VulDB published twelve CVEs against small MCP servers, nearly all of them single-maintainer GitHub projects. The shape repeats: a tool parameter reaches a shell. `codex_mcp` passes the `model` argument (CVE-2026-19329), MCP4EDA passes `design_name` and `vcd_file` (CVE-2026-19332), `mcp-pdf-vision` passes `pdfPath` and `sessionId` (CVE-2026-19279), MCPGateway passes a `since` date (CVE-2026-19268), and `mcp-bridge-api` takes `command` and `args` from its servers endpoint (CVE-2026-19263). Path traversal covers `mcp-ui-probe` (CVE-2026-19270) and MCPyATS (CVE-2026-19338). SSRF covers `mcp-google-search` (CVE-2026-19337) and MissionSquad's `mcp-api` (CVE-2026-19040), which also shipped a command injection in its npm package installer (CVE-2026-19041). HKUDS `nanobot` registered MCP resource and prompt wrappers outside the declared `enabledTools` scope (CVE-2026-19244). The `ssh-mcp-server` entry (CVE-2026-19039) is disputed by its maintainer, whose stated threat model is that the server is a local trusted tool for running SSH commands, so callers already hold execution.

AWS Labs Patches Two MCP Servers in Three Days, One Sending Broker Credentials Wherever the Model Points

Mon, 03 Aug 2026 00:00:00 GMT

Two AWS security bulletins in the same week. Bulletin 2026-070, published August 3, 2026, covers CVE-2026-18655 in `awslabs.amazon-mq-mcp-server` before 2.0.24: the RabbitMQ broker connection tools do not restrict which endpoint they will connect to, so a broker hostname introduced into the MCP client context by prompt injection redirects Amazon MQ broker credentials or OAuth access tokens to a host the attacker controls. CVSS 6.5. Bulletin 2026-076, published August 5, covers CVE-2026-18954 in the DocumentDB MCP Server before 1.0.12: the write-capable aggregation pipeline stages `$out` and `$merge` slip past the read-only mode enforcement, so an authenticated MCP client writes to a database the server was configured to treat as read-only. CVSS 5.5.

SiYuan Ships Three MCP Advisories in Six Days, Each One a Caller the Previous Fix Skipped

Mon, 03 Aug 2026 00:00:00 GMT

SiYuan published GHSA-43jx-gxq4-jpjc on August 3, 2026 and two more on August 8. The first, CVE-2026-74798, is a path traversal in the `database_clean` MCP tool: `RemoveUnusedAttributeView()` checks only that `id` is non-empty before joining it into a filesystem path, so an authenticated MCP client can copy any file the kernel can read into the history directory and delete the original. An earlier fix, GHSA-7hm9-v7vf-7g4w, had hardened the HTTP API caller of that same function and left the MCP one alone. The August 8 pair repeats the shape. CVE-2026-59809 resolves `{{secrets.*}}` placeholders inside the destination URL of the `http_request` tool, so a crafted URL mails stored secrets to any public host, and GET requests skip the confirmation prompt. CVE-2026-60083 is an MCP file tool blocklist covering one of the four paths the HTTP file API blocks, which leaves `data/.siyuan/publishAccess.json` readable. Fixed in v3.7.4 and v3.8.0.

AI Engine for WordPress Hands Out Admin Accounts to Anyone Who Gets an Admin to Click a Link

Sat, 01 Aug 2026 00:00:00 GMT

The AI Engine plugin bundles a chatbot, an AI framework, and an MCP server for WordPress, and every version through 3.6.5 is vulnerable. The `reauth_for_authorize` function in the MCP OAuth path is missing nonce validation, which makes it cross-site request forgery. An unauthenticated attacker who gets a logged-in administrator to click a link can create a brand new administrator account with credentials the attacker chose. WordPress's `?_method=POST` override turns that top-level GET navigation into an authenticated POST against the REST users endpoint, so the attacker needs no account of their own. CVSS 8.8.

IBM's Second Langflow Bulletin in Three Weeks Carries Five More MCP Findings

Fri, 31 Jul 2026 00:00:00 GMT

IBM published bulletin 7282147 on July 31, 2026, seventeen days after the one covering the `SHELLOPTS` blocklist gap. Seven CVEs, five of them in MCP handling, all fixed in Langflow OSS 1.11.0. CVE-2026-17623 (CVSS 8.8) is improper validation of the `command` field in MCP server configurations, giving a remote authenticated attacker arbitrary command execution. CVE-2026-17626 (8.8) is incomplete filtering of Docker volume-mount and device-mapping arguments for Docker-based MCP servers, exposing host files for read or modification. CVE-2026-9077 (8.5) lets a remote authenticated attacker bypass localhost-only restrictions and write arbitrary MCP server configurations into IDE config files on the host. CVE-2026-8446 (7.5) is an authentication bypass in the MCP composer endpoint, which ships enabled by default. CVE-2026-7646 (6.5) is a URL-encoded path traversal in `resources/read` that returns the JWT signing secret, the SQLite database, other users' uploads, and process environment variables.

Google's mcp-toolbox Patches Five, Including an OAuth Path That Accepts Any Google Token

Fri, 31 Jul 2026 00:00:00 GMT

Google shipped fixes for five mcp-toolbox CVEs on July 31, 2026. CVE-2026-14541 is the loudest: a Google `authService` initialized with `mcpEnabled: true` but no explicit audience or clientId skips audience validation for opaque tokens entirely, so the toolbox accepts any valid Google OAuth access token, including ones minted for unrelated applications. CVE-2026-14537 lets an unauthenticated caller invoke tools protected by `scopeRequired` through legacy HTTP endpoints when `--enable-api` is on. CVE-2026-14540 is SSRF: the generic HTTP client is built with no `CheckRedirect` policy and no target IP validation, so a crafted path parameter walks it into internal endpoints. CVE-2026-14538 has `bigquery-execute-sql` trusting the BigQuery dry-run API to enforce `allowedDatasets`, then failing open when that API returns an empty array. CVE-2026-14539 rounds it off with `io.ReadAll` on the `/mcp` handler and no size cap.

Flowise Blocked npx --yes, So the Custom MCP Node Reads npm_config_yes Instead

Wed, 29 Jul 2026 00:00:00 GMT

Two Flowise advisories published on July 29, 2026, both fixed in 3.1.3. CVE-2026-69263 is a bypass of the CVE-2025-8943 patch. That patch blocked the `-y` and `--yes` flags on `npx`, and `packages/components/nodes/tools/MCP/core.ts` denied environment variables by exact name: `PATH`, `LD_LIBRARY_PATH`, `DYLD_LIBRARY_PATH`, and `NODE_OPTIONS`. npm also reads its own configuration from `npm_config_*` variables, so setting `npm_config_yes=true` reproduces `--yes` without touching a blocked flag, and launching a Custom MCP server then auto-installs and executes the named package. CVSS 8.7. CVE-2026-69257 landed the same day: `httpSecurity.ts` did not normalize IPv4-mapped IPv6 addresses before testing them, so `::ffff:169.254.169.254` was classified as IPv6 and skipped every IPv4 CIDR rule in `isDeniedIP()`, the check used for MCP server URL validation. CVSS 7.6.

Flowise's Custom MCP Node Takes a Second RCE in the Same Release, This Time Through PYTHONWARNINGS

Wed, 29 Jul 2026 00:00:00 GMT

GHSA-g98q-rm45-q9h8, reported by igor-magun-wd and published July 29, 2026, is the third Flowise advisory fixed in 3.1.3 and the second in the Custom MCP node. With `CUSTOM_MCP_PROTOCOL` set to `stdio`, which is the default, the node's environment-variable denylist still leaves an authenticated user two routes to code execution. Against a `python3` server, `PYTHONWARNINGS` set to `module::antigravity.` alongside a chosen `BROWSER` value runs a command during interpreter startup. Against `node`, the spawned process has `/` as its working directory, which defeats the absolute-path validation, and a `HOME` carrying JavaScript is picked up through `require()`. Refreshing the available actions on the node triggers either one. CVSS 9.0, affecting `flowise` and `flowise-components` 3.1.2 and earlier.

Ruflo MCP Bridge Binds 233 Unauthenticated Tools to 0.0.0.0 by Default (RufRoot, CVSS 10.0)

Wed, 29 Jul 2026 00:00:00 GMT

Noma Labs publicly disclosed CVE-2026-59726 on July 29, 2026, codenamed RufRoot, against Ruflo, an open-source AI-agent platform with 67,000+ GitHub stars that sits at #2 on MCPMarket. Ruflo's MCP Bridge is an Express.js server that exposes 233 internal tools over MCP: shell command execution, database operations, agent management, and memory storage. The shipped `docker-compose.yml` binds port 3001 to `0.0.0.0`, and the bridge's tool-invocation endpoints require no authentication. A single unauthenticated HTTP POST from anywhere on the network reaches `terminal_execute` and any of the other 232 tools. Noma reported the finding to maintainer Reuven Cohen on June 30, 2026 with a working proof-of-concept against a default deployment; a fix shipped in Ruflo 3.16.3 within 24 hours, binding the bridge to loopback, gating `terminal_execute` behind server-side executeTool controls, and turning on MongoDB authentication. CVSS 10.0.

HashiCorp Ships Terraform and Consul MCP Server Advisories on Consecutive Days, Both Session-State in Stateless Mode

Wed, 29 Jul 2026 00:00:00 GMT

HashiCorp posted HCSEC-2026-23 on July 28, 2026 for `terraform-mcp-server` and HCSEC-2026-24 on July 29, 2026 for `consul-mcp-server`. Both bulletins document session-state failures in each server's streamable-HTTP stateless transport. In Terraform MCP Server, CVE-2026-14869 (CVSS 8.6, High) lets an unauthenticated client override the outbound Terraform API destination so the server sends its own authorization bearer token to an attacker-controlled endpoint, and CVE-2026-16496 lets a caller who obtains another user's MCP session ID run tool calls under that user's Terraform credentials. In Consul MCP Server, CVE-2026-16326 (CVSS 10.0, Critical) lets one client reuse another client's Consul authentication token across requests, and a companion issue lets clients override the Consul backend address to redirect API traffic to an attacker-controlled endpoint. Fix versions are `terraform-mcp-server` 1.1.0 and `consul-mcp-server` 0.1.4. Both defective ranges are 0.2.1 through 1.0.0 for Terraform and 0.1.0 through 0.1.3 for Consul.

Model Context Protocol 2026-07-28 Spec Rips Out the Stateful Handshake, Deprecates Sampling and Roots and Legacy HTTP+SSE

Tue, 28 Jul 2026 00:00:00 GMT

The MCP maintainers published the 2026-07-28 specification on July 28, 2026, the largest revision since launch. The bidirectional stateful protocol becomes a stateless request/response protocol. The `Mcp-Session-Id` header is gone; every request carries its own protocol version, client identity, and capabilities. Server-initiated sampling and elicitation streams are replaced by Multi Round-Trip Requests (`resultType: input_required`) so the client re-issues the call with the required inputs. New `Mcp-Method` and `Mcp-Name` HTTP headers let gateways route without parsing JSON bodies. Authorization moves to RFC 9207 issuer validation, credentials are bound to the issuing server, and Dynamic Client Registration is being deprecated in favor of Client ID Metadata Documents. Roots, Sampling, Logging, and the legacy HTTP+SSE transport are all on a 12-month sunset. Tier 1 SDKs (TypeScript, Python, Go, C#) ship day-one support; Rust ships in beta.

GitHub's Own MCP Server Panics on a Completion Request With No Ref, Before It Checks Your Token

Tue, 28 Jul 2026 00:00:00 GMT

CVE-2026-47427 covers GitHub's official MCP Server prior to 1.1.0. The `CompletionsHandler` function in `pkg/github/server.go` reads `params.Ref` without first checking whether it is nil, so a `completion/complete` request with a missing or empty `ref` field dereferences nil and takes the Go runtime down with a panic. The crash happens before any authentication or token validation runs, so any unauthenticated client that can send JSON-RPC messages can do it. Fixed in 1.1.0.

FrontMCP's Sandbox Returns the Raw Host Object Because a Proxy Is Not Allowed to Lie

Sun, 26 Jul 2026 00:00:00 GMT

FrontMCP is a TypeScript framework for MCP. Its `codecall:execute` tool runs caller-supplied scripts behind a Proxy-based security membrane, and `getTool()` exposes live Zod schema instances to those scripts. Zod v4 defines `_zod` as a non-configurable, non-writable own property, and ECMAScript requires a Proxy to report the true value for exactly that kind of property. The membrane is therefore obliged to hand back the unwrapped host object. From there, `_zod.constr.constructor` is the host `Function` constructor. Assembling those property names at runtime also slips past the lexical denylist, which inspects the AST. Affects `@frontmcp/plugin-codecall` through 1.5.6, fixed in 1.5.7. CVSS 9.3, and the framework default of `auth: { mode: 'public' }` means no credentials are needed.

AWS API MCP Server Logs a Warning When Its Policy Engine Fails to Load, Then Serves Every Request Unchecked

Thu, 23 Jul 2026 00:00:00 GMT

CVE-2026-16584, published July 23, 2026, covers `awslabs.aws-api-mcp-server` 0.2.13 through 1.3.46. The server loads a read-only operations index at startup and uses it to apply the operator's deny and gate rules to AWS CLI commands. If that load throws, whether from a transient network failure, a file permission problem, or anything else, the server writes a warning to the log and keeps running. The per-request policy check is then skipped for the entire lifetime of the process, and so are the consent prompts. Classified CWE-455, non-exit on failed initialization. Version 1.3.47 refuses to start when the index will not initialize and blocks command execution if it goes missing at runtime. CVSS 7.3.

n8n's MCP Client Node Sends Its Requests Around the Platform's SSRF Protection

Wed, 22 Jul 2026 00:00:00 GMT

GHSA-vhf8-cg2h-cg3p, published July 22, 2026, covers two n8n maintenance lines: the 2.31 line below 2.31.5, and the 2.32 line below 2.32.1. The MCP Client node sends requests to user-supplied endpoints without routing them through the configured SSRF protections, and it does not pin resolved addresses, so a hostname that resolves acceptably during a check can resolve elsewhere on the request itself. CVSS 6.4, and NVD later assigned CVE-2026-72768. Fixed in 2.31.5 and 2.32.1. For operators who cannot upgrade, n8n suggests restricting access to trusted users, disabling the node through `NODES_EXCLUDE`, or applying network-level egress rules.

Microsoft Azure DevOps MCP Server Returns Invisible PR Comments Verbatim, Prompt Injection Turns Reviewer Agent Into a Cross-Project Exfiltrator

Wed, 22 Jul 2026 00:00:00 GMT

Manifold Security published `When Your AI Reviewer Works for the Attacker` on July 22, 2026, describing a confused-deputy flaw in Microsoft's official `azure-devops-mcp` server. Azure DevOps PR descriptions accept Markdown, and the PR-description tool the server exposes to the agent returns the raw body from the API without stripping HTML comments. An attacker with contributor access to any project the victim's Azure DevOps account can see opens a PR whose description is an ordinary human sentence in the rendered UI and a paragraph of instructions inside an `` block underneath. When the victim tells their agent to review the PR, the agent ingests the invisible block as tool output and follows the instructions, which typically direct it to read work-item contents or files from a private project the attacker has no direct access to and stitch them into the review comment the attacker will get to see. Microsoft ships a prompt-injection guardrail called `spotlighting` on some tools in the same server, but not the pull-request-description tool the bug lives on. MSRC has acknowledged the report; no CVE and no fix as of publication.

AWS Kiro Fetches a Poisoned Web Page, Follows the Hidden Instructions to Rewrite Its Own mcp.json, and Auto-Loads the Attacker's Server

Wed, 22 Jul 2026 00:00:00 GMT

Intezer Research, with Kodem Security, published `When the AI Edits Its Own Trust Boundary` on July 21, 2026 against AWS Kiro, Amazon's agentic IDE. The agent has unattended write access to `~/.kiro/settings/mcp.json` and Kiro auto-reloads that file the instant it changes. A page hosted anywhere on the public web can carry an invisible block of prompt-injection payload; a developer asking Kiro to summarize the URL sends the whole page through the model, and the payload instructs the agent to add an attacker-controlled MCP server entry to the settings file. The reload fires, the attacker's server process starts under the developer's account, and the tool description it advertises to the agent becomes the next prompt-injection surface. Amazon assigned CVE-2026-10591 on July 22, 2026 and shipped the fix in Kiro 0.11.130. Kiro now marks `mcp.json`, `.vscode/tasks.json`, `.git`, and other paths as protected so the agent has to obtain explicit developer approval before writing them.

Island Security Publishes AgentBaiting: 800+ Fake MCP Servers Inside a 7,600-Repo FakeGit Campaign Deliver SmartLoader When AI Agents Recommend Them

Tue, 21 Jul 2026 00:00:00 GMT

Island Security published `AgentBaiting: How Fake AI Skills Deliver Malware at Scale` on July 21, 2026, and Bleeping Computer and Help Net Security wrote it up the same week. The wider FakeGit operation, ~7,600 GitHub repositories across ~6,600 accounts, seeds convincing lookalikes of common developer tooling; roughly 800 of those repositories pose as MCP servers or `awesome-ai-skills`-style catalogs. The AI-skill wave built through March and peaked in April 2026 and the repositories have appeared more than 600 times in public AI registries and catalogs. Island's testing found Claude Code, Google Gemini, and ChatGPT surfacing the fake repositories unprompted when asked for an MCP server for a given task and then handing the README's install instructions to the developer. The install ZIP drops SmartLoader, which pulls in the StealC infostealer. About 200 of the FakeGit repositories account for the 14 million measured downloads across GitHub Release assets to date.

Onyx Copies Every User’s MCP OAuth Token Into One Shared Admin Row

Mon, 20 Jul 2026 00:00:00 GMT

Onyx published GHSA-q62f-rv3h-f822 on July 20, 2026. In `backend/onyx/server/features/mcp/api.py`, `OnyxTokenStorage.set_tokens` and `set_client_info` wrote per-user OAuth tokens into a shared admin `MCPConnectionConfig` row, and `_db_mcp_server_to_api_mcp_server` returned that row through `auth_template.headers`. `GET /api/mcp/servers` and `GET /api/mcp/servers/persona/{persona_id}` therefore returned another user’s `Authorization` header to any BASIC_ACCESS user. CVSS 9.6 with scope changed. The code fix landed in PR #11238 on May 20, the advisory followed two months later, and NVD assigned CVE-2026-71424 on August 17. Fixed in 3.1.10, 3.2.14, and 4.0.0.

ArcadeDB's MCP Transport Never Binds the Authenticated User, So Every Permission Check Passes

Fri, 17 Jul 2026 00:00:00 GMT

Two advisories landed against ArcadeDB before 26.7.3 on July 17, 2026. CVE-2026-68578 is the structural one: the MCP HTTP transport fails to bind the authenticated principal, so every engine permission check silently passes as a no-op. Any non-root user allowed to reach MCP can perform arbitrary database writes, DDL, and schema mutations, and can execute arbitrary JavaScript through the `query` tool. CVE-2026-67357 sits next to it: the `get_server_settings` MCP tool returns `arcadedb.ha.clusterToken` in cleartext, and that token combined with the `X-ArcadeDB-Cluster-Token` and `X-ArcadeDB-Forwarded-User` headers is enough to impersonate root. Both rated CVSS 7.5.

Adversa AI's DeepJack Turns Cursor's cursor:// MCP Install Handler Into One-Click RCE

Wed, 15 Jul 2026 00:00:00 GMT

Adversa AI published DeepJack on July 15, 2026, an attack class against the `cursor://` protocol handler that Cursor registers with the operating system at install time. A deeplink pointing at Cursor's `mcp/install` endpoint pops the MCP server install dialog, and that dialog is the only consent step between a clicked link and an attacker-controlled command running with the developer's privileges. The researchers pad the command with whitespace so trailing arguments sit off the right edge of the dialog's single-line box, and they nest a double-URL-encoded `mcp/install` URI inside a `pr-review` parameter that Cursor never recursively decodes, so a link that presents as a pull-request review carries an install instruction. Cursor's triage closed both reports as duplicates of an issue filed internally on April 27, 2026. Build 3.9.8, shipped after the disclosure, still reproduces it. No CVE was assigned.

IBM Langflow's MCP stdio Launcher Blocklist Forgot SHELLOPTS, BASHOPTS, and PS4

Tue, 14 Jul 2026 00:00:00 GMT

IBM published CVE-2026-12940 on July 14, 2026 against Langflow OSS 1.0.0 through 1.10.1: unauthenticated remote code execution through environment variable injection in the MCP stdio launcher. `src/lfx/src/lfx/base/mcp/util.py` keeps a `DANGEROUS_ENV_VARS` blocklist of variables it refuses to pass into a spawned MCP server process. Three names were missing from it, and they happen to be the three that let you talk a shell into running a command at startup: `SHELLOPTS`, `BASHOPTS`, and `PS4`. Turning on shell tracing and pointing the trace prompt at a command substitution has been a documented bash execution trick for years. CVSS 9.8.

AWS HealthLake MCP Server Doesn't Validate Its Own Pagination URLs, Ships Temp Credentials to Whoever Sends a next_token

Tue, 14 Jul 2026 00:00:00 GMT

AWS Security Bulletin 2026-054-AWS landed on July 14, 2026 for CVE-2026-15643, a server-side request forgery in `awslabs.healthlake-mcp-server`, the AWS-published MCP server that fronts AWS HealthLake FHIR datastores. The pagination handler accepts a caller-supplied `next_token` value and dereferences it without checking that the URL points back at HealthLake. A crafted `next_token` sends the server's outbound request, together with the temporary AWS credentials the MCP server uses to call HealthLake, to any endpoint the attacker names. CVSS 3.1 is 7.3, High. Authenticated remote attacker, no user interaction. The fix ships as version 0.0.14.

mcp-atlassian Has a Path Validator, and confluence_upload_attachment Never Calls It

Fri, 10 Jul 2026 00:00:00 GMT

GHSA-g5r6-gv6m-f5jv, published July 10, 2026, covers `mcp-atlassian` before 0.22.0. `confluence_upload_attachment` passes its client-supplied `file_path` straight to `open(file_path, "rb")` in `src/mcp_atlassian/confluence/attachments.py`, by way of `_upload_attachment_direct()`. The codebase already ships `validate_safe_path` and applies it elsewhere; this call site does not. CVSS 7.7. The fix is one validation call added ahead of the open, released in 0.22.0.

CKAN MCP Server Patches Three: A Prefix-Only Regex, a Cache Key That Collides, and Errors That Repeat Everything

Thu, 09 Jul 2026 00:00:00 GMT

Three advisories for `@aborruso/ckan-mcp-server`, all published July 9, 2026. `isValidMqaServer` validates the `server_url` parameter against `/^https?:\/\/(www\.)?dati\.gov\.it/i`, which has no end anchor and no host boundary, so `https://dati.gov.it.attacker.com/x` and `https://dati.gov.it@attacker.com/x` both pass and the MQA quality tools return an attacker's response (CVE-2026-73845, CVSS 5.3, fixed in 0.4.111). `canonicalizeParams` in `src/utils/cache.ts` joins sorted key-value pairs with unescaped `&`, `=`, and `|` delimiters, so `{ q: "budget", rows: 10 }` and `{ q: "budget&rows=10" }` build the same key and share one entry in a cache that is enabled by default (CVE-2026-73846, CVSS 6.5, fixed in 0.4.111). Error paths return raw upstream response bodies and internal exception messages verbatim rather than a generic message (CVE-2026-73844, CVSS 3.7, fixed in 0.4.112).

tumf mcp-text-editor Path Traversal in _validate_file_path, Maintainer Closes the Report

Thu, 09 Jul 2026 00:00:00 GMT

CVE-2026-15138 landed on July 9, 2026 against tumf's `mcp-text-editor`, an MCP server that gives an AI assistant read and write access to files on the developer's machine. The `_validate_file_path` function in `mcp_text_editor/text_editor.py` accepts a caller-supplied `file_path` argument and does not normalize it before deciding whether the target sits inside the allowed directory, so a `../`-laden path walks past the intended sandbox and back to any file the server process can reach. Versions 1.0.0, 1.0.1, and 1.0.2 are affected. The disclosure is a 5.3 Medium under CVSS 4.0 and requires that the operator invoke the vulnerable tool with attacker-influenced input, which for an MCP server is what the whole product does. The reporter filed an issue on the project's GitHub before publication; the maintainer closed it without a comment, a patch, or a release.

SPELLSMITH Study Puts Numbers on Taint-Style Bugs Being the Median MCP Server Vulnerability

Wed, 08 Jul 2026 00:00:00 GMT

A team from Tongji University posted `Mitigating Taint-Style Vulnerabilities in MCP Servers via Security-Aware Tool Descriptions` on arXiv on July 8, 2026 (2607.07461). The paper catalogs the vulnerability landscape of published MCP servers, finds that taint-style flaws (SSRF, path traversal, SQL injection, command injection, and their cousins) account for a substantial fraction of reported issues, and reports that these bugs require significant code changes to remediate and are met with slow or absent community responses. The authors propose SPELLSMITH, a defense that packages security guidance for the model into the tool description itself so the agent is nudged away from feeding tainted input into the tool in the first place. The paper is one of a small cluster of academic papers this quarter that back the informal observation that MCP servers keep shipping the same bug classes into the CVE database.

MCP Ruby SDK Ships Five Advisories in One Day, Including Session Poisoning the Spec Warned About

Wed, 08 Jul 2026 00:00:00 GMT

The `modelcontextprotocol/ruby-sdk` repo published five advisories against the `mcp` gem on July 8, 2026, one day after 0.23.0 shipped the fixes. Every one of them affects 0.22.0 and earlier. CVE-2026-67431 is session poisoning: the Streamable and SSE HTTP transports never verify session ownership, so anyone holding a stolen session ID can POST tool calls to `/messages/{session-id}`, and the server executes them and streams the results back down the victim's SSE connection where they read as the victim's own. CVE-2026-67432 reads the full HTTP body into memory with no upper bound, and does it before session validation; the reporter's 512 MB request took RSS from 44 MB to 1.66 GB. CVE-2026-63118 skips `Host` and `Origin` validation, so any page a developer visits can reach a loopback MCP server by DNS rebinding and call its tools. CVE-2026-63119 and CVE-2026-67430 finish the set with unbounded `IO#gets` on the stdio transports and sessions that never expire, 50,000 of which fit in 27 seconds.

AWS mcp-gateway-registry Metrics Service Interpolates table_name Straight Into SQL

Mon, 06 Jul 2026 00:00:00 GMT

AWS Security Bulletin 2026-052-AWS landed on July 6, 2026 for CVE-2026-14471, an authenticated SQL injection in `mcp-gateway-registry`, the open-source gateway and registry that agentic-community publishes for centralizing MCP servers behind OAuth. The metrics-service retention policy management component takes a caller-supplied `table_name` value and interpolates it into SQL statements in identifier position with no neutralization. An authenticated remote user submits a crafted `table_name` and executes arbitrary SQL against the metrics database, which the bulletin notes stores API key material alongside the metrics themselves. CVSS 3.1 comes in at 8.1 and CVSS 4.0 at 8.6, both High. The fix ships as version 1.0.13; there is no workaround.

AIAnytime Awesome-MCP-Server wiki-summary Hands the URL Argument to requests, SSRF to Anywhere

Sun, 05 Jul 2026 00:00:00 GMT

CVE-2026-14748 published on July 5, 2026 against `AIAnytime/Awesome-MCP-Server`, whose `mcp-wiki` subproject ships an MCP tool that summarizes wiki pages for the connected agent. The `wiki-summary` handler in `mcp-wiki/src/mcp_wiki/server.py` takes a caller-supplied `url` argument and passes it into the outbound HTTP client with no scheme allow-list, no host allow-list, and no block for link-local ranges. A prompt-injected wiki summary request to `http://169.254.169.254/latest/meta-data/iam/security-credentials/` returns the instance profile credentials for whichever cloud account the agent happens to be running in. The disclosure is Medium at CVSS 6.3 and the exploit has been published. The reporter filed the issue with the project ahead of publication and, per the CVE record, the project has not responded.

fast-mcp-telegram Uses Bearer Tokens as Session-File Paths; Path Traversal Grabs the Default Account

Thu, 02 Jul 2026 00:00:00 GMT

CVE-2026-52830 (CVSS 9.4) landed in the NVD on July 2, 2026 against `fast-mcp-telegram`, an MCP server that bridges HTTP requests to Telegram's MTProto API and supports multi-user Bearer-token authentication. The server authenticates incoming HTTP clients by joining the raw Bearer-token string into a session-file path and checking whether that file exists on disk. The verifier explicitly rejects the reserved literal `telegram` so HTTP callers cannot select the stdio/legacy default session, but it does not reject `..` and does not normalize the path before the existence check. A remote HTTP client that sends `Authorization: Bearer ../fast-mcp-telegram/telegram` walks the traversal back to the documented default session file at `~/.config/fast-mcp-telegram/telegram.session`, and the server hands the caller that session. With account-prefixed MCP tools enabled, the prefix middleware still exposes tools for the default account, so the intended isolation between the HTTP transport and the legacy default account collapses. Every version prior to 0.19.1 is vulnerable.

Microsoft Incident Response: Enterprise Copilot Agents Trust Poisoned MCP Tool Descriptions

Tue, 30 Jun 2026 00:00:00 GMT

Microsoft's Detection and Response Team, the incident-response arm inside Microsoft Security, published guidance on June 30, 2026 flagging tool-description poisoning as an active attack path against enterprise agents built on Microsoft 365 Copilot, Copilot Studio, and Azure AI Foundry. Every MCP tool ships a plain-text description that tells the agent what the tool does and when to invoke it, and the guidance notes that the description lives in the agent's working memory next to its real orders. Third-party MCP servers can change that description at runtime and, in default enterprise configurations, the poisoned version becomes active without a new consent prompt. Microsoft's worked scenario has a finance team wiring a vendor-enrichment MCP server into a Copilot Studio invoice agent. The tool's visible name and summary stay unchanged, while the description grows a formatting-note-shaped instruction to attach the last thirty unpaid invoices to the next call. The next routine supplier lookup ships those invoices to whatever endpoint the tool's HTTP client points at. Microsoft's mitigation stack is a tenant-level MCP publisher allowlist (disabling `Allow all`), Prompt Shields inspection of tool metadata and responses, Purview DLP on tool parameters, human approval on high-impact actions, Entra Agent ID plus Conditional Access on agent identities, and Sentinel correlation between agent behavior and MCP telemetry.

Djinn Stealer Adds ~/.claude/mcp.json to Its Loot List After SimpleHelp Auth Bypass

Mon, 29 Jun 2026 00:00:00 GMT

Blackpoint Cyber's Adversary Pursuit Group published an intrusion investigation on June 29, 2026 that started with CVE-2026-48558, a critical (CVSS 10.0) authentication bypass in SimpleHelp RMM's OpenID Connect flow originally disclosed by Horizon3.ai on June 12. The server accepted OIDC identity tokens without verifying their cryptographic signature, so an unauthenticated attacker submitted a forged token with arbitrary claims and got a fully authenticated technician session on an internet-facing SimpleHelp install. From that foothold the operator dropped TaskWeaver, a heavily obfuscated Node.js loader that runs as `jquery.js` under `node.exe`, then used TaskWeaver's encrypted channel to deliver a second previously undocumented family, Djinn Stealer. Djinn ships collection rules for Windows, macOS, and Linux and, alongside the standard AWS/Azure/GCP/Oracle/Okta/Cloudflare/Vault/Terraform/browser/crypto-wallet sweep, has a dedicated section for AI-assisted development tools. It reads configuration, session, and auth material from Anthropic Claude, Google Gemini, and OpenAI Codex, plus open-source coding agents Cline, OpenCode, and Kilo, and it explicitly walks paths like `~/.claude/mcp.json` where MCP server URLs and tokens live. CISA added CVE-2026-48558 to the Known Exploited Vulnerabilities catalog the same day Blackpoint published, with a BOD 26-04 remediation deadline of July 7 for federal civilian agencies.

Amazon Q for VS Code Auto-Loads .amazonq/mcp.json From Any Cloned Repo

Fri, 26 Jun 2026 00:00:00 GMT

Wiz Research's Maor Dokhanian disclosed that the Amazon Q Developer extension for Visual Studio Code reads `.amazonq/mcp.json` from any opened workspace and spawns the MCP servers it defines without checking workspace trust, surfacing a prompt, or even logging the action. The spawned processes inherit the developer's full environment, so anything the shell carries, including AWS access keys, cloud CLI tokens, SSH agent sockets, and API secrets, is handed directly to whatever command the config pointed at. Wiz reported the issue to AWS on April 20, 2026; AWS deployed an initial fix on May 12 and publicly disclosed on June 26 under Security Bulletin 2026-047-AWS as CVE-2026-12957 (CVSS 8.5). The same bulletin tracks a second flaw, CVE-2026-12958, a missing symlink check in Language Servers for AWS that lets a maliciously crafted symlink inside an opened workspace point at a target outside the workspace trust boundary, enabling arbitrary file writes. Both are remediated in Language Servers for AWS 1.65.0; AWS asks customers to upgrade to 1.69.0 for the broader rollup.

Three MCP Servers Fetch Whatever URL You Name, Reported in June and Given CVEs in August

Thu, 25 Jun 2026 00:00:00 GMT

TianYu-0829 opened public GitHub issues on June 25, 2026 against three MCP servers, all the same shape. The `parse-csv` tool in `mcp-dominican-layer` validates `csvUrl` with `z.string().url()` and passes it to `axios.get()` (CVE-2026-19751). Its `parse-pdf` tool does the same with `pdfUrl` (CVE-2026-19752). The `explore_url` tool in `mcp-rdf-explorer` hands `url` to `requests.get()` in `server.py` (CVE-2026-19753). None of the three restrict scheme, hostname, resolved IP range, port, redirects, or timeouts. Each proof of concept drives the server at a local HTTP listener through the MCP Inspector. VulDB filed the CVEs on August 13, seven weeks after the issues went public.

Red Hat Satellite foreman-mcp-server Treats Session IDs as Auth, Logs Them

Tue, 23 Jun 2026 00:00:00 GMT

Red Hat published advisories for two issues in foreman-mcp-server, the Technology Preview MCP server bundled with Satellite 6.18. CVE-2026-12112 (CVSS 7.8, Important) is the session-management bug. The server caches authenticated client connections and trusts the session ID on subsequent requests without re-validating the underlying authentication tokens, so anyone holding a session ID inherits the active administrative session. CVE-2026-9073 (Moderate) is how that session ID gets obtained. The server writes every newly created session ID to standard logs at the informational level, and when debug logging is enabled, also persists HTTP authorization headers in cleartext. Both advisories landed on June 23, 2026, without a fixed-version pointer at publication. Red Hat's interim mitigation is to restrict access to foreman-mcp-server, scrub log forwarding, and watch for suspicious session activity.

Ouroboros Rebuilds Its .env Denylist After the First One Left the MCP Config Root Reachable

Thu, 18 Jun 2026 00:00:00 GMT

Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies. CVE-2026-47211 was closed by adding `_UNTRUSTED_ENV_DENYLIST`, which stops a `.env` in an untrusted project directory from redirecting execution. That list did not cover every key. Through 0.42.0, `OUROBOROS_MCP_CONFIG` still pointed the runtime at a YAML file whose server `command` and `args` are executed through the stdio client, while `OUROBOROS_PLUGIN_LOCKFILE` and `OUROBOROS_PLUGIN_TRUST_ROOT` redirected the installed-plugin roster and its trust root. A `.env` is auto-loaded at import with no review step, so cloning a hostile repo is the entire delivery mechanism. Version 0.42.1 denylisted those keys and separately stopped auto-loading `./.ouroboros/mcp_servers.yaml` from the working directory, a path that reached the same place with no `.env` involved at all. CVSS 8.4.

Mastra AI npm Scope Hijacked by Sapphire Sleet, 142 MCP Framework Packages Backdoored

Wed, 17 Jun 2026 00:00:00 GMT

Between 01:12 and 02:39 UTC on June 17, 2026, a single compromised npm account named `ehindero` republished 142 packages across the `@mastra` scope, the TypeScript AI agent framework whose `@mastra/core`, `@mastra/mcp`, and `@mastra/mcp-docs-server` packages clear roughly a million weekly downloads between them. The compromised versions were byte-for-byte identical to the legitimate builds; the only change in each manifest was a single injected dependency, `easy-day-js`, a typosquat of `dayjs` published one hour earlier under the alias `sergey2016`. The dependency's `postinstall` hook disabled TLS certificate verification, fetched a second-stage payload from attacker infrastructure, executed it as a detached background process, and deleted itself to limit forensic traces. The cross-platform infostealer harvested browser data from Chrome, Edge, and Brave, extracted credentials from 166 cryptocurrency wallet extensions, and swept GitHub tokens, npm tokens, SSH keys, and `.env` files before exfiltrating to attacker C2. Microsoft Threat Intelligence attributed the activity to Sapphire Sleet (BlueNoroff), a North Korean state actor that has been running fake-recruiter LinkedIn campaigns against open-source maintainers; Mastra confirmed the compromised maintainer was a current employee whose machine was taken over after exactly that kind of contact. Socket flagged the malicious wave within six minutes of publication and Mastra force-published clean releases across all 142 packages.

Agentjacking Turns Fake Sentry Errors Into AI Coding Agent RCE via MCP

Fri, 12 Jun 2026 00:00:00 GMT

Tenet Security disclosed `agentjacking`, an attack class that uses Sentry's open event-ingestion architecture to plant prompt-injection payloads inside fake bug reports, then waits for an AI coding agent connected to the Sentry MCP server to read them. A Sentry DSN is a write-only credential that every frontend ships in its JavaScript, so finding one is a GitHub search. The injected event's `message` field and context keys carry markdown that renders identically to Sentry's own system template: headings, code blocks, tables. When Claude Code, Cursor, or Codex retrieves the event over MCP as a triage prompt, the agent treats the embedded instructions as legitimate diagnostic steps and executes attacker-controlled commands with the developer's own privileges. Tenet reported an 85% success rate against the three agents across more than 100 organizations in controlled tests and identified at least 2,388 organizations with injectable DSNs in production. The Cloud Security Alliance AI Safety Initiative published the research as a CSA Research Note on June 12, 2026, with parallel coverage at The Hacker News the same day.

gemini-bridge Reads Any File You Name, Then Ships It to Google

Tue, 09 Jun 2026 00:00:00 GMT

gemini-bridge is a small MCP server that hands AI agents a path to Google's Gemini through the official CLI. From 1.0.0 until 1.3.1, `consult_gemini_with_files` in inline mode read any path supplied in the `files` argument without confining it to the working directory, then forwarded the contents to the Gemini CLI. Because the caller also controls `query`, the contents come straight back through the Gemini round trip. Fixed in 1.3.1. CVSS 6.2.

Shai-Hulud 'Hades' Wave Drops Split-Loader Malware on MCP-Themed PyPI Packages

Tue, 09 Jun 2026 00:00:00 GMT

Socket's Threat Research team disclosed on June 9, 2026 that the active Mini Shai-Hulud / Miasma / Hades supply-chain campaign had added 23 fresh malicious PyPI artifacts the day prior, five of them aimed directly at developers building MCP integrations: `langchain-core-mcp`, `openai-mcp`, `instructor-mcp`, `tiktoken-mcp`, and `ray-mcp-server`. The wheels follow the Hades pattern earlier waves established on npm: a `.pth` startup hook fires during Python's site initialization, downloads the Bun JavaScript runtime as a living-off-the-land binary, then runs an obfuscated stealer staged through Bun with a fake prompt-injection header at the top of the payload. The `langchain-core-mcp` wheel ships only the `.pth` loader and no bundled `_index.js`, instead walking every entry in `sys.path` for the payload at runtime. The split-staging architecture decouples loader from payload so static scanners that audit the wheel they were handed see nothing executable. The June 8 PyPI wave brought the campaign's cross-ecosystem total to 471 artifacts spanning 411 npm packages and 60 PyPI wheels since June 1, with Socket tracking it pivoting delivery mechanisms every 48 to 72 hours.

Claude Code GitHub Action Prompt Injection Hijacks Any Downstream Repo

Tue, 02 Jun 2026 00:00:00 GMT

GMO Flatt Security's RyotaK and Microsoft Threat Intelligence published parallel research disclosing prompt-injection bypasses in Anthropic's official `claude-code-action` GitHub Action. Flatt's writeup, posted June 2, traced the `checkWritePermissions` function unconditionally trusting any actor whose login ended in `[bot]`, which let any GitHub App author crafted issues whose contents Claude then treated as authorized instructions. Microsoft's June 5 post documented a second path: the agent's `Read` tool sat outside the Bubblewrap sandbox that wrapped `Bash`, so `/proc/self/environ` was reachable from inside any triage run. Both chains exfiltrated the workflow's `ANTHROPIC_API_KEY`, OIDC token, and any other CI secrets via the GitHub MCP server's `update_issue` tool, WebFetch, or echoed log output. Anthropic rated the issues 7.8 under CVSS v4.0, shipped fixes across `claude-code-action` v1.0.94 and Claude Code 2.1.128, and paid a bounty. A variant of the same misconfiguration class was already exploited in February against Cline's triage workflow to steal an npm publish token and push an unauthorized `cline@2.3.0`.

better-auth's MCP Plugin Takes a javascript: Redirect URI and Advertises the none Algorithm

Sun, 31 May 2026 00:00:00 GMT

Two better-auth advisories landed on May 31, 2026, and both reach MCP deployments through the `mcp` plugin that wraps the deprecated `oidc-provider`. In CVE-2026-67333, registered `redirect_uris` are never scheme-validated, so an attacker registers a client with a `javascript:` URI and the authorization server hands it back unchanged in the consent response. A consent page that assigns that value to `window.location.href` executes the attacker's script in the authorization server's own origin. Fixed in 1.6.13. CVE-2026-67336 covers the cryptographic defaults in the same two plugins: they advertise the `none` algorithm and accept plain PKCE, so an attacker can negotiate down to unsigned tokens or intercept authorization codes that S256 would have protected. Fixed in 1.6.11.

mcp-memory-service Guards /api/memories and Serves /api/documents to Anyone

Thu, 28 May 2026 00:00:00 GMT

GHSA-84hp-mqvj-3p8h, published May 28, 2026, covers `mcp-memory-service` before 10.67.1. Every HTTP route under `/api/documents/*` is served with no authentication dependency, whether the server is configured with an `MCP_API_KEY` or with OAuth. The `documents.py` router is constructed without a `dependencies=` argument, and the file never imports `Depends`. Six endpoints are exposed this way: upload, batch upload, history, content search, and two deletion routes. The neighbouring `/api/memories` router applies `Depends(require_write_access)` correctly, so the guard exists in the codebase and was not wired into this file. CVSS 9.8.

Cortex Trusts CLAUDE_PROJECT_DIR, So Any Cloned Repo Can Claim to Be the Cortex Install

Wed, 27 May 2026 00:00:00 GMT

GHSA-gvpp-v77h-5w8g, published May 27, 2026, covers `neuro-cortex-memory` 3.17.0 and earlier. Claude Code sets `CLAUDE_PROJECT_DIR` to whatever project the user has open, and Cortex's `_find_dev_source()` treats that path as a trusted developer checkout of Cortex itself. The check that decides, `_is_cortex_root()`, looks for an `mcp_server/` subdirectory and a `ui/unified-viz.html` file. When `open_visualization` is invoked, the handler builds a bootstrap path under that directory and runs it with `subprocess.run([sys.executable, str(bootstrap_path)])`. A second path in `http_launcher.py` rsyncs the same untrusted source into the Cortex plugin cache. CVSS 7.8, fixed in 3.17.1.

auth-fetch-mcp Blocks ::ffff:127.0.0.1 and Node Hands It Back ::ffff:7f00:1

Wed, 27 May 2026 00:00:00 GMT

Two SSRF-guard bypasses published May 27, 2026. In `auth-fetch-mcp` 3.0.1 and earlier, `assertSafeUrl()` in `src/security.ts` blocks private and loopback addresses, and `isPrivateV6()` handles the IPv4-mapped form by stripping the `::ffff:` prefix and calling `net.isIPv4()` on the remainder. Node's WHATWG URL parser hex-normalizes `[::ffff:127.0.0.1]` to `[::ffff:7f00:1]` before that check runs, so the remainder is `7f00:1`, `net.isIPv4()` returns false, and the address is classified as public. The `auth_fetch` and `download_media` tools then reach `127.0.0.1` (CVE-2026-49857, CVSS 7.4, fixed in 3.0.2). The same day, `@jshookmcp/jshook` 0.3.1 and earlier shipped a central SSRF authorization policy that its HTTP, TCP, and TLS RTT tools enforce through `resolveAuthorizedTransportTarget`, and that `network_icmp_probe` and `network_traceroute` skip entirely, calling native probes straight after hostname resolution (CVE-2026-49856, CVSS 4.3, fixed in 0.3.2).

mcp-server-kubernetes Ships Two Access Control Bypasses in Two Weeks

Thu, 21 May 2026 00:00:00 GMT

Flux159's `mcp-server-kubernetes` shipped two access-control failures disclosed two weeks apart in late May and early June 2026. CVE-2026-46519 (CVSS 8.8), published May 21, found that the `ALLOWED_TOOLS`, `ALLOW_ONLY_READONLY_TOOLS`, and `ALLOW_ONLY_NON_DESTRUCTIVE_TOOLS` environment variables were enforced only inside the `tools/list` handler. The `tools/call` handler had none of those checks, so any client that already knew a tool name could invoke `kubectl_delete`, `exec_in_pod`, or `kubectl_generic` regardless of the configured restriction mode. v3.6.0 added matching enforcement at the execution layer. CVE-2026-47250 (CVSS 3.1), published June 5, showed that `kubectl_generic` still passed user-supplied flags straight to `kubectl` with no allowlist. A prompt injection planted in pod logs could nudge the agent to call `kubectl_generic` with `--server=https://attacker.example/` and `--insecure-skip-tls-verify=true`, sending the operator's bearer token to the attacker. v3.7.0 added flag filtering. The researcher confirmed the full prompt-injection-to-token-exfiltration chain end to end against a live `kind` cluster with Claude Haiku as the agent.

Meta Ads MCP Server Skips the 401, Then Returns the Operator's Access Token in the Error Body

Wed, 20 May 2026 00:00:00 GMT

pipeboard-co's meta-ads-mcp lets AI assistants run Meta Ads campaigns. Through 1.0.108, `AuthInjectionMiddleware.dispatch()` at `http_auth_integration.py:272` handles an unauthenticated Streamable HTTP request by noting that no authentication tokens were found in the headers, then calling `call_next(request)` anyway. No 401 is ever issued. Tool handlers that find no per-request credential fall back to the `META_ACCESS_TOKEN` environment variable, so they run as the operator. When the downstream Meta Graph API call fails, `api.py:263-269` serializes the raw httpx request URL into the JSON-RPC response body, and that URL carries the access token as a query parameter. Fixed in 1.0.109. CVSS 9.1.

Claude Code SOCKS5 Sandbox Bypass Exfiltrates Credentials and MCP Configs

Wed, 20 May 2026 00:00:00 GMT

Aonan Guan, who leads cloud and AI security at Wyze Labs, publicly disclosed his second Claude Code network sandbox bypass in five months. The latest issue is a SOCKS5 hostname null-byte injection. Claude Code's proxy enforces its egress allowlist by passing the raw DOMAINNAME bytes from a CONNECT request through a JavaScript `endsWith()` check against the user's wildcard policy. JavaScript treats `\x00` as an ordinary UTF-16 code unit, so a crafted host like `attacker-host.com\x00.google.com` matches an allowlist entry for `.google.com` and is approved. When libc later resolves the hostname via `getaddrinfo()`, the C runtime truncates at the null byte and dials `attacker-host.com` instead. Every release from v2.0.24 (sandbox GA on Oct 20, 2025) through v2.1.89 was vulnerable. Anthropic shipped a fix in v2.1.90 on April 1, 2026, with no security note in the changelog, no advisory on the Claude Code page, and no CVE assigned. Exfiltration paths reachable from inside the sandbox include MCP server configs, `~/.claude.json`, project source, and anything else the agent could read.

NSA Publishes MCP Security Design Considerations

Wed, 20 May 2026 00:00:00 GMT

The NSA's Artificial Intelligence Security Center released a Cybersecurity Information Sheet titled "Model Context Protocol (MCP): Security Design Considerations for AI-Driven Automation." The document flags MCP's "rapid proliferation [that] has outpaced the development of its security model." It calls out the protocol's inversion of the typical client-server pattern (the server can prompt the client to take actions) and enumerates systemic concerns: trust boundary ambiguity, unverified task propagation, session-replay risk, and serialization issues. It urges "heightened scrutiny" for production deployments, especially in national-security and high-assurance environments.

Mini Shai-Hulud Worm Weaponizes Claude Code and MCP Configs for Persistence

Tue, 19 May 2026 00:00:00 GMT

TeamPCP's Mini Shai-Hulud worm campaign ran through April and May 2026, hijacking npm maintainer accounts and publishing self-propagating malware across more than 600 packages on npm and PyPI. The May 19 wave compromised the `atool` and `prop` accounts and pushed 639 malicious versions across 323 packages in Alibaba's @antv data visualization ecosystem in a 22-minute automated burst. Earlier waves hit SAP CAP / `mbt` (April 29), TanStack (May 11), Mistral AI, Guardrails AI, UiPath, and OpenSearch. Each compromised release ships a preinstall hook that downloads the Bun JavaScript runtime as a living-off-the-land binary, then executes a credential harvester that sweeps cloud tokens, CI secrets, and password-manager vaults. The novel part: the payload reads `~/.claude.json` and the host's MCP server configurations, then appends `SessionStart` hooks to `.claude/settings.json` so the next time Claude Code opens any project on the machine, the malware re-executes with full agent privileges. Researchers at Akamai, Snyk, Wiz, StepSecurity, and Phoenix Security all confirmed the AI-coding-agent persistence behavior independently.

TrustFall Puts an MCP Server in a Cloned Repo, and Anthropic Says the Trust Dialog Covers It

Thu, 07 May 2026 00:00:00 GMT

Adversa AI disclosed TrustFall on May 7, 2026. A cloned repository ships two files, `.mcp.json` and `.claude/settings.json`. Opening the folder and accepting the generic trust dialog applies those project settings, including `enableAllProjectMcpServers` and `enabledMcpjsonServers`, which start an attacker-controlled MCP server as an unsandboxed Node.js process holding the developer's privileges. Alex Polyakov and Sergey Malenkovich reported the same pattern across Claude Code, Gemini CLI, Cursor CLI, and Copilot CLI. Adversa counts it as the third flaw of this class in six months, following CVE-2025-59536.

nginx-ui MCP Endpoint Unauthenticated RCE

Sat, 25 Apr 2026 00:00:00 GMT

Pluto Security disclosed a critical (CVSS 9.8) vulnerability in nginx-ui's Model Context Protocol implementation. The MCP integration split traffic across two HTTP endpoints. `/mcp` handles session establishment and was correctly gated by an IP whitelist and auth middleware. `/mcp_message` handles tool invocation, including configuration writes and server restart, and shipped with no authentication at all. The default IP whitelist is empty, so the unauthenticated endpoint accepted connections from any address. Shodan turned up over 2,600 publicly exposed nginx-ui instances on the default port 9000. Pluto disclosed in early March 2026, v2.3.4 fixed it, and Recorded Future later listed the CVE among 31 vulnerabilities actively exploited by threat actors in March 2026.

Anthropic MCP SDK STDIO Command Injection (Declined to Patch)

Wed, 15 Apr 2026 00:00:00 GMT

OX Security disclosed a systemic command-injection vulnerability in Anthropic's official MCP SDKs across Python, TypeScript, Java, and Rust. The STDIO transport invokes a configured command string through the OS shell unconditionally. If the intended MCP binary doesn't exist, the shell still executes whatever command was supplied. OX identified four distinct exploitation families all tracing back to the same root cause, affecting more than 7,000 publicly accessible servers and 150 million package downloads, with an estimated 200,000 vulnerable instances across the ecosystem. Anthropic acknowledged the behavior, declined to modify the protocol, and updated its security guidance to advise that STDIO adapters be "used with caution." The company characterized the existing design as a *secure default* with sanitization being the developer's responsibility. Downstream CVEs already cluster around the same root cause: CVE-2026-22252 (LibreChat), CVE-2026-22688 (WeKnora), CVE-2025-54994 (@akoskm/create-mcp-server-stdio).

Apache SkyWalking’s MCP Server Lets the Caller Set the Backend URL, and NVD Got There in August

Mon, 13 Apr 2026 00:00:00 GMT

Qiuxia Fan announced CVE-2026-34884 on the oss-security list on April 13, 2026, crediting Andrea Cosentino. Apache SkyWalking MCP 0.1.0 carries two issues: the `set_skywalking_url` tool accepts a caller-supplied URL and turns it into server-side requests, and the MCP server passes GraphQL expressions through without adequate sanitization. Users were told to upgrade to 0.2.0. NVD scored the pair 9.8 and published its record on August 18, four months and five days after Apache announced it.

Proofpoint's CursorJack: Cursor MCP Deeplinks Let Any Link Claim Any Vendor's Name

Tue, 17 Mar 2026 00:00:00 GMT

Proofpoint published CursorJack on March 17, 2026, a proof-of-concept from Rachel Rabin, Anna Akselevich, and Stanislav Silberberg showing that Cursor's `cursor://` MCP deeplinks work as a delivery mechanism. A deeplink carries a base64-encoded MCP server config; clicking it pops the install prompt, and accepting runs that config's command with the developer's privileges. Two paths work: the `command` parameter executes locally, and the `url` parameter points Cursor at an attacker-hosted remote MCP server. The deeplink can also claim any server name it likes, `Azure DevOps` for instance, and Cursor never verifies the link came from the vendor it names.

Perplexity Ditches MCP

Mon, 16 Mar 2026 00:00:00 GMT

At its core, the article argues that MCP is too token-hungry to be practical at production scale, with tool definitions consuming the majority of context before any user request is even processed. Several major companies are independently abandoning it in favor of lighter-weight alternatives like traditional APIs and CLIs.

ContextCrush Flaw in Context7 MCP Server

Thu, 05 Mar 2026 00:00:00 GMT

Noma Labs discovered the ContextCrush vulnerability in Context7, a registry that delivers coding documentation to AI assistants via an MCP server. Attackers manipulated the platform's Custom Rules feature to plant malicious instructions. When an AI coding assistant (like Cursor or Windsurf) queried the documentation, it ingested the poisoned rules via the trusted MCP channel and autonomously executed harmful actions, such as stealing .env files.

MCP TypeScript SDK Routes One Client's Tool Output to a Different Client

Wed, 04 Feb 2026 00:00:00 GMT

Advisory GHSA-345p-7cg4-v4c7 landed on February 4, 2026 against `@modelcontextprotocol/sdk` 1.10.0 through 1.25.3, and it is two bugs wearing one CVE. Sharing a single `StreamableHTTPServerTransport` across concurrent clients lets JSON-RPC message IDs collide, because every MCP client numbers its requests from zero and counts up, so the second client's request overwrites the first client's response mapping and the reply goes down the wrong HTTP connection. Sharing a single `McpServer` across multiple transports silently overwrites the Protocol object's internal `this._transport`, which misroutes server-to-client traffic including progress notifications and sampling requests. Both land hardest on stateless deployments that reuse instances across requests. Fixed in 1.26.0. CVSS 7.1.

Microsoft MarkItDown MCP Server SSRF

Wed, 21 Jan 2026 00:00:00 GMT

BlueRock researchers discovered a severe Server-Side Request Forgery (SSRF) flaw in the MCP server built for Microsoft's MarkItDown file converter. The server failed to validate URIs, allowing attackers to force the AI agent to query local cloud metadata endpoints (e.g., AWS 169.254.169.254). Subsequent scans revealed over 36% of public MCP servers contained similar SSRF vulnerabilities.

Anthropic Git MCP Server RCE

Tue, 20 Jan 2026 00:00:00 GMT

Cyata researchers disclosed a chain of critical vulnerabilities in Anthropic's official Git MCP server. The flaws included an unrestricted git_init function, a path-validation bypass, and an argument-injection vulnerability. Attackers could chain these to turn arbitrary directories into Git repositories, overwrite system files, and achieve RCE via malicious .git/config manipulation.

Anthropic Filesystem MCP Sandbox Escape

Tue, 15 Jul 2025 00:00:00 GMT

Cymulate disclosed two high-severity defects in Anthropic's official Filesystem MCP Server. Attackers exploiting these flaws could list, read, or write to directories outside the allowed scope. If the server was run as a privileged user, this could lead to full sandbox escape, manipulation of critical system files, and privilege escalation.

Anthropic MCP Inspector Local Network RCE

Thu, 10 Jul 2025 00:00:00 GMT

Oligo Security and Tenable discovered a critical flaw (CVSS 9.4) in the Anthropic MCP Inspector tool. Because the interactive web UI launched via localhost lacked out-of-the-box authentication, an attacker on the same local network could inject malicious commands (NeighborJacking) or use cross-site attacks to achieve RCE.

mcp-remote OS Command Injection

Wed, 09 Jul 2025 00:00:00 GMT

The JFrog Security Research team discovered a critical vulnerability (CVSS 9.6) in mcp-remote, a popular proxy tool (over 437,000 downloads) used to connect local LLM hosts to remote MCP servers. If a user connected to a malicious remote MCP server, the server could send a booby-trapped authorization_endpoint URL that achieved full arbitrary OS command execution on the user's local machine.

Asana MCP Server Cross-Tenant Data Leak

Wed, 18 Jun 2025 00:00:00 GMT

Work management platform Asana had to temporarily disable its experimental MCP feature after discovering a logic flaw in its implementation. The misconfiguration failed to isolate cross-tenant data, meaning AI agents could potentially access customer data, projects, and tasks belonging to entirely different organizations.

LangSmith AgentSmith Prompt Hub Flaw

Thu, 12 Jun 2025 00:00:00 GMT

A severe vulnerability (CVSS 8.8) dubbed AgentSmith was disclosed in LangSmith's Prompt Hub. The flaw exposed AI agents using MCP to data theft and manipulation, allowing malicious agents to hijack LLM responses and steal user API keys.

GitHub MCP Prompt Injection Data Heist

Mon, 26 May 2025 00:00:00 GMT

Security researchers at Invariant Labs discovered a critical vulnerability affecting the official GitHub MCP integration. Attackers could create maliciously crafted issues in public repositories. When a developer asked their AI assistant to check open issues, the AI would read the malicious payload, get prompt-injected, and autonomously use the developer's credentials to exfiltrate private repository data (such as source code and salary information) into public pull requests.