a running record of publicly disclosed security incidents in the Model
Context Protocol ecosystem. because what could possibly go wrong when
you let language models autonomously talk to everything?
84
incidents tracked
27
critical severity
38
high severity
112
CVEs assigned
numbers update as new incidents are disclosed.
filter:
2026 · august · 28
[high]CVE-2026-82021
Nous Research's Hermes Agent Tracked Its MCP Catalog by Branch Name #
VulnCheck published CVE-2026-82021 on August 28, 2026, crediting Zubair Ashraf of Helmet Security. Hermes Agent's bundled MCP catalog referenced a third-party upstream repository through a mutable branch rather than a pinned commit, so whoever controlled that branch controlled what every installing host fetched and ran. The fix commit rewrites the n8n catalog manifest from ref: main to ref: 7a9ae00795593aa1fdb4e61ecd640e8bfd0c3841 and states the reasoning outright: branches and tags can be moved by the upstream owner, SHAs cannot. Affected in 0.18.2 up to 0.19.0, and in the 2026.7.7.2 line up to 2026.7.20. CVSS 8.3 at NVD and 9.0 at VulnCheck, CWE-494.
commentary
The catalog is the list of things the agent is permitted to launch, which makes it the trust boundary rather than a convenience. Pinning a pyproject dependency and pinning the MCP server that dependency starts are the same problem, and only one of them had a written policy.
impact
An attacker who takes over the referenced upstream repository executes code on every host that installs that catalog entry.
SiYuan's Fourth MCP Advisory in a Month Is Another Tool That Skips the Workspace Check #
VulnCheck published CVE-2026-82233 on August 28, 2026, crediting joysinleung, against SiYuan before v3.8.1. The asset.upload MCP tool accepts arbitrary absolute file paths with no workspace boundary validation. An agent talked into calling it copies files from outside the workspace into the notebook's asset store. CVSS 6.9 under CVSS 4.0, with the vector requiring low privileges and user interaction. This is the fourth SiYuan MCP advisory in under four weeks, after the three from August 3 and August 8.
commentary
Four advisories, four tools, one boundary that keeps not being checked. SiYuan's MCP layer is discovering the workspace root one tool at a time, and asset.upload is a tool whose entire purpose is writing files into that root, so it is the one place the check was least optional.
impact
Any file the SiYuan kernel process can read, including SSH keys and credential files, gets copied into the workspace and served as a notebook asset.
ToolUniverse and Telnyx Serve MCP on Every Interface and Ask for No Credential #
VulnCheck published two MCP advisories on August 27, 2026, both crediting Avishai Gonen of Pluto Security, and both are the same bug wearing a different logo. ToolUniverse, the agentic tool platform out of Harvard's MIMS lab, ran caller-supplied Python behind a denylist of attribute names and calls, on a server that asked for no credential at all (CVE-2026-81096). The Telnyx MCP server served MCP at the root path from a listener bound to every interface, and parsed the caller's authentication headers in a mode that did not fail when they were absent (CVE-2026-81098). VulnCheck scores both 9.3. NVD scores them 10.0 and 9.1.
EX.Atwo mcp servers on every interface, auth middleware optional
commentary
Neither project switched a protection off. Binding to loopback and requiring a credential were both parameters, and a parameter's default is what actually ships. ToolUniverse went to the trouble of denylisting attribute names inside the sandbox while leaving the front door unlocked, which is a lot of care spent one layer too deep.
impact
Any client that can reach the port executes Python on the ToolUniverse host or drives the Telnyx tool surface. Neither requires a credential.
Five DNS Rebinding Findings in One Day, Four of Them an SDK Option Nobody Set #
The same August 27 batch carries five host-header findings credited to Avishai Gonen of Pluto Security. mcp-go served any request arriving over a loopback connection regardless of the host it named, in both StreamableHTTPServer.ServeHTTP and SSEServer.ServeHTTP, and its SSE transport's cross-origin handling had the same gap (CVE-2026-81092). Validation landed in v0.56.0, tagged July 8, 2026. The other four are servers that called their SDK's HTTP factory and never set the DNS-rebinding-protection option it offers: Timescale's pg-aiguide (CVE-2026-81095) and tiger-slack (CVE-2026-81099), tiger-gh-mcp-server (CVE-2026-81100), and Dropbox's Dash MCP server (CVE-2026-81102), which restricted its listener to loopback and then accepted whatever host a request named.
EX.Athe sdk offers dns-rebinding protection and four callers left it unset
commentary
Filed Medium against VulnCheck's 7.6, because the attacker needs the victim to load a page first. The more interesting number is the spread: VulnCheck scored Dropbox's omission 2.3 and Timescale's 7.6, and it is the same omission. The score is grading the tool surface behind the door, not the door, and the door is identical in all four.
impact
A page in the victim's browser resolves its own hostname to 127.0.0.1 and talks to the locally bound MCP server through them, reaching a tool surface that treated the loopback bind as the access control.
Apify's SSRF Fix Shipped in March and the CVE Turned Up in August #
Two SSRF advisories from the August 27 batch credit Yotam Perkal of Pluto Security. The get-html-skeleton tool in Apify's Actors MCP server validated its url argument with isValidHttpUrl, which confirmed the string began with an http or https scheme and parsed as a URL, then fetched it without inspecting the hostname or the address it resolved to (CVE-2026-81093, CVSS 8.7). Private ranges and cloud metadata endpoints were in reach. The fix is in @apify/actors-mcp-server 0.9.12, published to npm on March 20, 2026, five months before the advisory named it. The mcp-use inspector's proxy middleware read its destination from an X-Target-URL header or an __mcp_target parameter and proxied there without inspecting the host (CVE-2026-81091, CVSS 8.7); that one was fixed in 2.3.3, published one day before the advisory.
EX.Askeleton on a bench: the apify ssrf fix, waiting since march for its cve
commentary
One fix shipped five months before its CVE and the other one day before. Same batch, same researcher, same 8.7. The gap says nothing about the bugs and everything about when somebody got around to writing them down.
impact
A tool argument or a proxy header reaches loopback, private ranges, and cloud metadata endpoints, and the response comes back into the model's context.
mcp-fetch Asks Node Whether `[::1]` Is an IP Address and Believes the Answer #
VulnCheck published CVE-2026-80347 on August 26, 2026, crediting George Chen, against mcp-fetch through 1.6.3. isSafeUrl reads hostname off the parsed URL, which for a literal such as http://[::1]/ hands back the string with its brackets still attached, and passes that to net.isIP. net.isIP returns 0 for a bracketed literal, so the guard concludes the target is not an IP address at all and skips the private-range checks it exists to run. The HTTP client then strips the brackets and connects to loopback. CVSS 8.7 at VulnCheck, 7.5 at NVD.
EX.Afry squinting: not sure if ip address or just a string with brackets
commentary
Two parsers, one string, two answers about what it is. net.isIP is doing exactly what it documents. The guard asked it a question about a URL hostname and read the reply as a question about an address.
impact
A fetch target supplied through a tool argument reaches loopback and private addresses, and the response is returned into the model's context.
Coroot's MCP OAuth Endpoint Registers Any Redirect URI a Stranger Sends It #
VulnCheck published CVE-2026-79786 on August 25, 2026, crediting George Chen, against Coroot 1.20.2 through 1.24.5. The MCP OAuth dynamic client registration endpoint is unauthenticated and accepts any syntactically valid redirect URI without validating where it points, so an attacker registers a client aimed at a host they control. Send the resulting authorization URL to a signed-in user, and their authorization code lands on the attacker's host. CWE-601, CVSS 7.0.
commentary
Dynamic client registration exists so an MCP client nobody pre-registered can still connect, which means the endpoint is designed to be reachable by strangers. Coroot implemented that part faithfully. Deciding which redirect targets a stranger may name is the half that has to survive contact with one.
impact
An attacker who gets a signed-in Coroot user to open one link captures their authorization code and takes over the session.
Neo.mjs Checks That the Path Is Inside the Project, Then Hands the Whole String to a Shell #
novice-22 disclosed CVE-2026-18482 on August 20, 2026, a command injection in the file-system MCP server that ships inside Neo.mjs at ai/mcp/server/file-system. The checkSyntax() and runPlaywrightTest() tools build command strings by interpolating a caller-supplied absolutePath into node --check ... and npx playwright test ..., then run them through child_process.exec(), which spawns a shell. The sandbox check, ensureSandboxed(), resolves the path and confirms it sits under the project root. That answers where the path points and says nothing about what follows it, so /home/user/neo/README.md; touch /tmp/MARKER passes validation and the shell runs both halves. Versions through 13.1.0 are affected. The fix swaps exec() for execFile(), passing arguments as an array so there is no shell to parse them.
EX.Athe sandbox check passed, so the rest of the string must be fine too
commentary
The validator was asked whether the path is inside the project. It said yes, correctly, about the part of the string before the semicolon. execFile was available the whole time and makes the bug unrepresentable rather than filtered.
impact
An agent steered into calling check_syntax or run_playwright_test on an attacker-chosen path executes arbitrary OS commands with the developer’s privileges.
Spring AI’s MCP Streamable HTTP Transport Keeps Every Session It Has Ever Handed Out #
Spring published CVE-2026-59279 on August 20, 2026 against Spring AI 2.0.0. The MCP Streamable HTTP server transport, in both the WebFlux and WebMvc variants, places no limit on the number of sessions it retains, and by default does not require clients to authenticate. A remote attacker sends initialization requests in a loop, the server keeps every session it creates, memory climbs, and the process eventually stops serving anyone. CVSS 7.5. Fixed in 2.0.1 for open source and 2.0.0.1 for enterprise support.
commentary
Filed Medium against a CVSS of 7.5, because availability is the entire prize and a crash buys the attacker nothing else. The detail worth pausing on is that "does not require clients to be authenticated" appears in the advisory as a contributing condition rather than as its own finding.
impact
An unauthenticated remote attacker exhausts the memory of a Spring AI MCP server and takes it down for every legitimate client.
Splunk’s MCP Server App Deserializes Whatever Is Sitting in the Credential Store #
Splunk published SVD-2026-0808 on August 19, 2026, covering CVE-2026-76404 in the Splunk MCP Server app below 1.2.1. The app’s credential management component deserializes stored data without checking whether the content is of the expected type, which Splunk classifies as CWE-502. A user holding the admin Splunk role can place a crafted object in that store and obtain arbitrary command execution on the underlying operating system. CVSS 9.1. Fixed in 1.2.1. The same bulletin carries a second deserialization bug, CVE-2026-76395 in the Splunk AI Toolkit, where a model codec unpickles sparse matrix data.
commentary
Splunk graded this 9.1 even though it needs the admin role, and that is the right call. A Splunk role is an application role. It was never supposed to be a shell account, and the credential store was never supposed to be an executable format.
impact
An admin-role Splunk user escapes the application entirely and runs commands on the host operating system.
PyCharm Shipped Unauthenticated Jupyter MCP Code Execution, and the Public Description Is One Sentence #
CVE-2026-75060 was published on August 17, 2026 against JetBrains PyCharm before 2026.2.1. The entire public description reads: "In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP tools." NVD scores it 8.4. JetBrains lists the issue on its shared fixed-issues page rather than in a dedicated advisory, so there is no write-up of the attack path, no statement of what "unauthenticated" reaches, and no proof of concept. The Jupyter MCP tools ship with the IDE, which puts the exposed surface on developer workstations.
EX.Ajetbrains, on documenting an 8.4 in its own ide
commentary
An 8.4 in a widely deployed IDE gets one line on a page that lists everything JetBrains fixed. Nobody downstream can tell whether "unauthenticated" means a local process, another host on the network, or a web page you happened to open, and those are three very different Tuesdays.
impact
Code execution on a machine running an affected PyCharm, reached through the bundled Jupyter MCP tools without authenticating to them.
The Official MCP PHP SDK Lets a Hostile Server Eat the Client’s Memory #
tonghuaroot reported CVE-2026-53965 in modelcontextprotocol/php-sdk, the official PHP SDK, published as GHSA-7m52-jw36-44r3 on August 14, 2026. The HTTP client transport reads Server-Sent Events incrementally and appends every chunk to $this->sseBuffer, which is only drained when the "\n\n" event delimiter arrives. A server that never sends the delimiter grows that buffer without bound. The advisory ships a proof of concept: 1,000 well-formed events hold the client at 2.0 MB, while 400 MB of delimiter-free data kills a client running the default 256 MB memory_limit. Affects 0.5.0 through 0.7.0, fixed in 0.7.1.
commentary
Almost every MCP bug on this site runs client to server. This one runs backwards, and there is no approval dialog for "the server you already trusted is now sending you 400 MB of nothing." Medium against a CVSS of 8.7, because a dead PHP process is the whole payout.
impact
Any MCP server a PHP client connects to can crash that client on demand, with no authentication and no earlier signal the client could act on.
argocd-mcp Lends the Operator's Argo CD Token to Whoever Connects First #
leoluz published GHSA-rp45-5x3v-48mr on August 11, 2026, crediting shmulc8, against argocd-mcp 0.8.0 and earlier. Three gaps compose. The HTTP transport starts with app.listen(port), so it binds every interface. It accepts MCP sessions without any caller credential whenever ARGOCD_API_TOKEN is configured, because the token is for talking outbound to Argo CD and nothing checks inbound. And it never applies the MCP SDK's Host validation. CVSS 10.0, fixed in 0.9.0. NVD ingested it as CVE-2026-82456 eighteen days later.
EX.Aoprah gesturing: the operator's argo cd token, for every caller who connects
commentary
The token is there so the server can reach Argo CD. Nothing was there to establish who was reaching the server. Argo CD's entire job is turning a manifest reference into running workloads, so an unauthenticated caller holding that token isn't reading a cluster. They're deploying to one.
impact
Anyone who can reach the port drives the full Argo CD tool surface with the operator's stored token: create applications, point them at attacker-controlled manifests, and sync them into the destination Kubernetes cluster.
Grafana's MCP Server Lets the Caller Choose the Destination, Which Is What the Last Fix Was For #
Grafana published CVE-2026-19516 on August 11, 2026. The grafana_api_request tool in mcp-grafana lets the caller choose the HTTP method, path, and body. A caller-supplied X-Grafana-URL request header then controls the destination, which is not restricted to the configured Grafana instance. Requests can be aimed at internal, loopback, and link-local services, including metadata endpoints, and the responses come back to the caller. CVSS 9.1. This is an incomplete fix for CVE-2026-15583, which stopped the tool from sending Grafana tokens to arbitrary hosts but left the destination itself unconstrained. Fixed in 1.1.0.
EX.Aan ssrf fix that constrained the token and not the destination
commentary
The first fix stopped the credential from travelling. It did not stop the request. X-Grafana-URL is still, by name and by function, the field where the caller says where to go.
impact
An authenticated MCP caller reaches anything the Grafana host can reach and reads the response, with full control of method, path, and body.
Next AI Draw.io Interpolates Its mcp Query Parameter Into Both a Script Block and the HTML #
Hồ Việt Khánh reported CVE-2026-73037 on August 11, 2026 against @next-ai-drawio/mcp-server 0.2.1 and earlier, bundled in next-ai-draw-io 0.2.1 through 0.4.16. The MCP HTTP server takes the mcp query parameter and interpolates it without escaping into two contexts: a JavaScript string literal and the surrounding HTML. A payload of ";alert(1);// breaks out of the script context, and an <img src=x onerror=...> renders straight into the page. Both execute in the localhost origin. CVSS 6.1. The report was still unpatched when it was filed.
commentary
Reflected XSS reads as a 2010 finding until you notice where it lands. The localhost origin is where the agent's tooling keeps its session.
impact
A crafted link opened in the victim's browser runs JavaScript on the localhost origin that serves the MCP endpoint, reaching diagram sessions and API data held there.
Microsoft's UFO Agent Framework Ships Two Unauthenticated MCP Servers That Drive an Android Phone #
GHSA-24fq-m9rr-g3mm, published August 10, 2026, covers create_mobile_data_collection_server and create_mobile_action_server in ufo/client/mcp/http_servers/mobile_mcp_server.py. Both expose Streamable HTTP MCP services, on TCP 8020 and 8021, with no authentication. Port 8020 serves capture_screenshot, get_ui_tree, and get_device_info. Port 8021 serves tap, swipe, type_text, launch_app, press_key, and click_control. When UFO is configured for remote deployment and binds 0.0.0.0, any client that can reach the ports initializes an MCP session and calls the tools without presenting an API key. The tools reach the connected Android device through ADB subprocesses. CVSS 9.4, affecting v3.0.7 and earlier, fixed in v3.0.8.
EX.Await, both mcp ports are unauthenticated? always have been
commentary
The framework's threat model stops at the model. Two HTTP servers underneath it hand out screenshots and touch events to whoever asks, and that path never involves a prompt at all.
impact
Anyone who can reach the ports reads the phone's screen and UI tree, then taps, types, and launches apps on it. No credentials, no user approval, and no cooperation from the model.
GhostSplice Splits One Exfiltration Request Across Three MCP Channels and Compliance Doubles #
ASSET Research Group published GhostSplice on August 10, 2026. Researchers Murali Ediga and Sudipta Chattopadhyay call the technique cross-channel trust fragmentation. A malicious MCP server splits a credential-theft request into fragments that each read as routine and delivers them through channels the agent already trusts. The tool description advertises an integrity_checker with bland field names. A first tool result returns an ordinary project file scan. A second result supplies the mapping, telling the model which files fill which fields for a server-side hash check. No single channel carries the whole request. Across eleven API-tested models, splitting a request into two halves raised average compliance from 42 percent to 82 percent, and GPT-4o, Gemini, and Llama went from refusing to 100 percent. VS Code adds a third channel through server-initiated sampling. The tests ran in isolated projects seeded with fake credentials, and the group says CVE identifiers will follow coordinated disclosure.
EX.Atool description, tool result, and sampling, none of them the bad one
commentary
The refusal training works on the whole request. It was never shown the whole request. Filling in a form is the one task no model has been trained to decline.
impact
SSH keys, environment variables, proprietary source, and customer data leave through a tool call the model reads as a form. Results depend on the client: GPT-5.4 runs the attack 90 percent of the time under Cursor and 0 percent behind Claude Code.
VulDB Files Twelve MCP Server CVEs in Four Days and Most Maintainers Never Answered #
Between August 6 and August 9, 2026, VulDB published twelve CVEs against small MCP servers, nearly all of them single-maintainer GitHub projects. The shape repeats: a tool parameter reaches a shell. codex_mcp passes the model argument (CVE-2026-19329), MCP4EDA passes design_name and vcd_file (CVE-2026-19332), mcp-pdf-vision passes pdfPath and sessionId (CVE-2026-19279), MCPGateway passes a since date (CVE-2026-19268), and mcp-bridge-api takes command and args from its servers endpoint (CVE-2026-19263). Path traversal covers mcp-ui-probe (CVE-2026-19270) and MCPyATS (CVE-2026-19338). SSRF covers mcp-google-search (CVE-2026-19337) and MissionSquad's mcp-api (CVE-2026-19040), which also shipped a command injection in its npm package installer (CVE-2026-19041). HKUDS nanobot registered MCP resource and prompt wrappers outside the declared enabledTools scope (CVE-2026-19244). The ssh-mcp-server entry (CVE-2026-19039) is disputed by its maintainer, whose stated threat model is that the server is a local trusted tool for running SSH commands, so callers already hold execution.
EX.Atwelve mcp maintainers opening the issues tab this week
commentary
The ssh-mcp-server maintainer asks the question the rest of the batch avoids. If a tool exists to run commands over SSH, the line between command injection and the product is not obvious. Twelve filings in four days suggests nobody has agreed where that line sits.
impact
Each finding is small on its own. The batch is a census of the long tail: several projects never responded to the report, several ship rolling releases with no version anyone can pin, and some fixes exist only as unversioned commits.
AWS Labs Patches Two MCP Servers in Three Days, One Sending Broker Credentials Wherever the Model Points #
Two AWS security bulletins in the same week. Bulletin 2026-070, published August 3, 2026, covers CVE-2026-18655 in awslabs.amazon-mq-mcp-server before 2.0.24: the RabbitMQ broker connection tools do not restrict which endpoint they will connect to, so a broker hostname introduced into the MCP client context by prompt injection redirects Amazon MQ broker credentials or OAuth access tokens to a host the attacker controls. CVSS 6.5. Bulletin 2026-076, published August 5, covers CVE-2026-18954 in the DocumentDB MCP Server before 1.0.12: the write-capable aggregation pipeline stages $out and $merge slip past the read-only mode enforcement, so an authenticated MCP client writes to a database the server was configured to treat as read-only. CVSS 5.5.
commentary
AWS's interim advice for the first one is to turn off auto-approve on the RabbitMQ initialization tools, which concedes that the destination hostname was the model's to pick. The second is a reminder that read-only enforced in the server is a preference, and read-only enforced by database credentials is a control.
impact
Broker credentials and OAuth tokens go to whatever hostname reaches the model's context. DocumentDB deployments running in read-only mode accept writes through the aggregation pipeline.
SiYuan Ships Three MCP Advisories in Six Days, Each One a Caller the Previous Fix Skipped #
SiYuan published GHSA-43jx-gxq4-jpjc on August 3, 2026 and two more on August 8. The first, CVE-2026-74798, is a path traversal in the database_clean MCP tool: RemoveUnusedAttributeView() checks only that id is non-empty before joining it into a filesystem path, so an authenticated MCP client can copy any file the kernel can read into the history directory and delete the original. An earlier fix, GHSA-7hm9-v7vf-7g4w, had hardened the HTTP API caller of that same function and left the MCP one alone. The August 8 pair repeats the shape. CVE-2026-59809 resolves {{secrets.*}} placeholders inside the destination URL of the http_request tool, so a crafted URL mails stored secrets to any public host, and GET requests skip the confirmation prompt. CVE-2026-60083 is an MCP file tool blocklist covering one of the four paths the HTTP file API blocks, which leaves data/.siyuan/publishAccess.json readable. Fixed in v3.7.4 and v3.8.0.
EX.Athe http api was hardened. the mcp tool calls the same function
commentary
Three advisories, three tools, and in each case the HTTP surface already had the guard. Bolting an MCP tool layer onto an existing app builds a second front door, and the lock keeps getting fitted to the first one.
impact
An authenticated SiYuan MCP client reads and deletes arbitrary files the kernel process can reach, exfiltrates stored API secrets through unprompted GET requests, and reads publish-mode passwords in cleartext.
AI Engine for WordPress Hands Out Admin Accounts to Anyone Who Gets an Admin to Click a Link #
The AI Engine plugin bundles a chatbot, an AI framework, and an MCP server for WordPress, and every version through 3.6.5 is vulnerable. The reauth_for_authorize function in the MCP OAuth path is missing nonce validation, which makes it cross-site request forgery. An unauthenticated attacker who gets a logged-in administrator to click a link can create a brand new administrator account with credentials the attacker chose. WordPress's ?_method=POST override turns that top-level GET navigation into an authenticated POST against the REST users endpoint, so the attacker needs no account of their own. CVSS 8.8.
commentary
The missing nonce is in the MCP OAuth code specifically. Bolt an agent protocol onto a WordPress plugin and the plugin's auth mistakes graduate into agent-protocol mistakes.
impact
One click from a logged-in admin creates a second admin under attacker control. That is full site takeover from a link, with no prior access.
IBM's Second Langflow Bulletin in Three Weeks Carries Five More MCP Findings #
IBM published bulletin 7282147 on July 31, 2026, seventeen days after the one covering the SHELLOPTS blocklist gap. Seven CVEs, five of them in MCP handling, all fixed in Langflow OSS 1.11.0. CVE-2026-17623 (CVSS 8.8) is improper validation of the command field in MCP server configurations, giving a remote authenticated attacker arbitrary command execution. CVE-2026-17626 (8.8) is incomplete filtering of Docker volume-mount and device-mapping arguments for Docker-based MCP servers, exposing host files for read or modification. CVE-2026-9077 (8.5) lets a remote authenticated attacker bypass localhost-only restrictions and write arbitrary MCP server configurations into IDE config files on the host. CVE-2026-8446 (7.5) is an authentication bypass in the MCP composer endpoint, which ships enabled by default. CVE-2026-7646 (6.5) is a URL-encoded path traversal in resources/read that returns the JWT signing secret, the SQLite database, other users' uploads, and process environment variables.
EX.Aa langflow bulletin with remote code execution in an mcp path
commentary
Five of the seven findings in this bulletin sit in MCP paths, and the previous bulletin was MCP too. The protocol surface is where this codebase keeps failing, which is what tends to happen when it arrives after the architecture.
impact
Command execution and host file access for any authenticated user, plus an auth bypass on an endpoint that is on by default. The IDE config write is the one that travels: a Langflow host ends up registering attacker-chosen MCP servers in a developer's editor.
Google's mcp-toolbox Patches Five, Including an OAuth Path That Accepts Any Google Token #
Google shipped fixes for five mcp-toolbox CVEs on July 31, 2026. CVE-2026-14541 is the loudest: a Google authService initialized with mcpEnabled: true but no explicit audience or clientId skips audience validation for opaque tokens entirely, so the toolbox accepts any valid Google OAuth access token, including ones minted for unrelated applications. CVE-2026-14537 lets an unauthenticated caller invoke tools protected by scopeRequired through legacy HTTP endpoints when --enable-api is on. CVE-2026-14540 is SSRF: the generic HTTP client is built with no CheckRedirect policy and no target IP validation, so a crafted path parameter walks it into internal endpoints. CVE-2026-14538 has bigquery-execute-sql trusting the BigQuery dry-run API to enforce allowedDatasets, then failing open when that API returns an empty array. CVE-2026-14539 rounds it off with io.ReadAll on the /mcp handler and no size cap.
commentary
Two of the five fail open. The dataset check trusts an empty array, and the audience check skips itself when nobody configured an audience. A missing config value should narrow what you accept, not widen it.
impact
Unauthenticated tool invocation, cross-application token reuse, SSRF into internal networks, dataset allowlists that quietly stop applying, and a single oversized request that ends the process.
Flowise Blocked npx --yes, So the Custom MCP Node Reads npm_config_yes Instead #
Two Flowise advisories published on July 29, 2026, both fixed in 3.1.3. CVE-2026-69263 is a bypass of the CVE-2025-8943 patch. That patch blocked the -y and --yes flags on npx, and packages/components/nodes/tools/MCP/core.ts denied environment variables by exact name: PATH, LD_LIBRARY_PATH, DYLD_LIBRARY_PATH, and NODE_OPTIONS. npm also reads its own configuration from npm_config_* variables, so setting npm_config_yes=true reproduces --yes without touching a blocked flag, and launching a Custom MCP server then auto-installs and executes the named package. CVSS 8.7. CVE-2026-69257 landed the same day: httpSecurity.ts did not normalize IPv4-mapped IPv6 addresses before testing them, so ::ffff:169.254.169.254 was classified as IPv6 and skipped every IPv4 CIDR rule in isDeniedIP(), the check used for MCP server URL validation. CVSS 7.6.
EX.Athe denylist, learning that npm also reads npm_config_yes
commentary
A denylist of four variable names is a bet that npm has exactly one way to say yes. It has two, and the second one is documented.
impact
On a default unauthenticated Flowise deployment, a Custom MCP server definition installs and runs an attacker's npm package. Separately, the SSRF guard covering MCP server URLs can be pointed at cloud metadata and internal services.
Flowise's Custom MCP Node Takes a Second RCE in the Same Release, This Time Through PYTHONWARNINGS #
GHSA-g98q-rm45-q9h8, reported by igor-magun-wd and published July 29, 2026, is the third Flowise advisory fixed in 3.1.3 and the second in the Custom MCP node. With CUSTOM_MCP_PROTOCOL set to stdio, which is the default, the node's environment-variable denylist still leaves an authenticated user two routes to code execution. Against a python3 server, PYTHONWARNINGS set to module::antigravity. alongside a chosen BROWSER value runs a command during interpreter startup. Against node, the spawned process has / as its working directory, which defeats the absolute-path validation, and a HOME carrying JavaScript is picked up through require(). Refreshing the available actions on the node triggers either one. CVSS 9.0, affecting flowise and flowise-components 3.1.2 and earlier.
EX.APYTHONWARNINGS, BROWSER, and HOME, none of them on the denylist
commentary
Three advisories, one release, and two of them in the same node. The earlier fixes blocked flag names and variable names. This one arrives through the interpreter's own startup hooks, which are documented, numerous, and not on anybody's list.
impact
An authenticated Flowise user runs arbitrary commands on the host and takes over the application.
Ruflo MCP Bridge Binds 233 Unauthenticated Tools to 0.0.0.0 by Default (RufRoot, CVSS 10.0) #
Noma Labs publicly disclosed CVE-2026-59726 on July 29, 2026, codenamed RufRoot, against Ruflo, an open-source AI-agent platform with 67,000+ GitHub stars that sits at #2 on MCPMarket. Ruflo's MCP Bridge is an Express.js server that exposes 233 internal tools over MCP: shell command execution, database operations, agent management, and memory storage. The shipped docker-compose.yml binds port 3001 to 0.0.0.0, and the bridge's tool-invocation endpoints require no authentication. A single unauthenticated HTTP POST from anywhere on the network reaches terminal_execute and any of the other 232 tools. Noma reported the finding to maintainer Reuven Cohen on June 30, 2026 with a working proof-of-concept against a default deployment; a fix shipped in Ruflo 3.16.3 within 24 hours, binding the bridge to loopback, gating terminal_execute behind server-side executeTool controls, and turning on MongoDB authentication. CVSS 10.0.
EX.Atrying to understand why terminal_execute shipped without auth
commentary
Two hundred and thirty-three tools. One of them is terminal_execute. Zero authentication. The docker-compose file that binds 0.0.0.0 and the tool registry that includes shell exec are in the same repo, shipped by the same maintainer, and neither one is hidden. It took Noma an afternoon to write the PoC and the maintainer 24 hours to fix it, which is the whole timeline you need to know.
impact
Anyone who can reach port 3001 on a default Ruflo install executes arbitrary shell commands, reads and rewrites the platform's persistent AI memory, exfiltrates the LLM API keys the platform brokers, and takes over every agent it manages. The docker-compose default meant that reach was `0.0.0.0`, not `127.0.0.1`.
HashiCorp Ships Terraform and Consul MCP Server Advisories on Consecutive Days, Both Session-State in Stateless Mode #
HashiCorp posted HCSEC-2026-23 on July 28, 2026 for terraform-mcp-server and HCSEC-2026-24 on July 29, 2026 for consul-mcp-server. Both bulletins document session-state failures in each server's streamable-HTTP stateless transport. In Terraform MCP Server, CVE-2026-14869 (CVSS 8.6, High) lets an unauthenticated client override the outbound Terraform API destination so the server sends its own authorization bearer token to an attacker-controlled endpoint, and CVE-2026-16496 lets a caller who obtains another user's MCP session ID run tool calls under that user's Terraform credentials. In Consul MCP Server, CVE-2026-16326 (CVSS 10.0, Critical) lets one client reuse another client's Consul authentication token across requests, and a companion issue lets clients override the Consul backend address to redirect API traffic to an attacker-controlled endpoint. Fix versions are terraform-mcp-server 1.1.0 and consul-mcp-server 0.1.4. Both defective ranges are 0.2.1 through 1.0.0 for Terraform and 0.1.0 through 0.1.3 for Consul.
EX.Ahcsec-2026-23 · hcsec-2026-24, on consecutive-day disclosure
commentary
HashiCorp put out two MCP server advisories in two calendar days and both were stateless mode is stateful, actually in a different key. The 2026-07-28 MCP spec ships the same week and its headline feature is stateless request/response. Every SDK vendor is going to spend the next six months learning what web-framework authors learned when PHP sessions were new.
impact
Two of HashiCorp's flagship MCP servers, in the same 24-hour window, hand their configured backend addresses or their session-bound credentials to whichever HTTP request asks. The Consul session-mixup is the same defect people spent 2003 fixing in web frameworks; the CVSS is 10.0 because the mixed-up thing is a Consul ACL token in an enterprise deployment.
Model Context Protocol 2026-07-28 Spec Rips Out the Stateful Handshake, Deprecates Sampling and Roots and Legacy HTTP+SSE #
The MCP maintainers published the 2026-07-28 specification on July 28, 2026, the largest revision since launch. The bidirectional stateful protocol becomes a stateless request/response protocol. The Mcp-Session-Id header is gone; every request carries its own protocol version, client identity, and capabilities. Server-initiated sampling and elicitation streams are replaced by Multi Round-Trip Requests (resultType: input_required) so the client re-issues the call with the required inputs. New Mcp-Method and Mcp-Name HTTP headers let gateways route without parsing JSON bodies. Authorization moves to RFC 9207 issuer validation, credentials are bound to the issuing server, and Dynamic Client Registration is being deprecated in favor of Client ID Metadata Documents. Roots, Sampling, Logging, and the legacy HTTP+SSE transport are all on a 12-month sunset. Tier 1 SDKs (TypeScript, Python, Go, C#) ship day-one support; Rust ships in beta.
commentary
The spec that got this site started is being deprecated. The maintainers heard the disclosures, agreed with a surprising number of them, and shipped the rewrite. It is genuinely the correct move. It is also going to generate a new run of CVEs, because Mcp-Method and Mcp-Name are HTTP headers, and HTTP headers have a track record.
impact
The specific attack surfaces that produced Asana's cross-tenant leak, the mcp-remote command injection, and the string of session-hijack advisories catalogued elsewhere on this site are, per the release notes, no longer part of the spec. What arrives in their place is a stateless HTTP protocol with two custom routing headers, which is a category of design that has produced request-smuggling and header-desync bugs in every previous incarnation.
GitHub's Own MCP Server Panics on a Completion Request With No Ref, Before It Checks Your Token #
CVE-2026-47427 covers GitHub's official MCP Server prior to 1.1.0. The CompletionsHandler function in pkg/github/server.go reads params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field dereferences nil and takes the Go runtime down with a panic. The crash happens before any authentication or token validation runs, so any unauthenticated client that can send JSON-RPC messages can do it. Fixed in 1.1.0.
commentary
CVSS put this at 7.5. It is availability only, so it sits at Medium here. The part worth keeping is the ordering: the panic beats the token check, which is what makes unauthenticated load-bearing in that sentence.
impact
One malformed JSON-RPC message from an unauthenticated client crashes GitHub's official MCP server. Every agent connected to it loses its tooling until the process comes back.
FrontMCP's Sandbox Returns the Raw Host Object Because a Proxy Is Not Allowed to Lie #
FrontMCP is a TypeScript framework for MCP. Its codecall:execute tool runs caller-supplied scripts behind a Proxy-based security membrane, and getTool() exposes live Zod schema instances to those scripts. Zod v4 defines _zod as a non-configurable, non-writable own property, and ECMAScript requires a Proxy to report the true value for exactly that kind of property. The membrane is therefore obliged to hand back the unwrapped host object. From there, _zod.constr.constructor is the host Function constructor. Assembling those property names at runtime also slips past the lexical denylist, which inspects the AST. Affects @frontmcp/plugin-codecall through 1.5.6, fixed in 1.5.7. CVSS 9.3, and the framework default of auth: { mode: 'public' } means no credentials are needed.
commentary
Nothing here is a coding mistake. The membrane followed the Proxy invariants exactly, and following them is what surrendered the Function constructor. A sandbox built on Proxies inherits every guarantee the language makes, including the guarantee that it cannot misreport a frozen property.
impact
Arbitrary code execution in the MCP server process, reachable over the network without authentication on a default configuration.
AWS API MCP Server Logs a Warning When Its Policy Engine Fails to Load, Then Serves Every Request Unchecked #
CVE-2026-16584, published July 23, 2026, covers awslabs.aws-api-mcp-server 0.2.13 through 1.3.46. The server loads a read-only operations index at startup and uses it to apply the operator's deny and gate rules to AWS CLI commands. If that load throws, whether from a transient network failure, a file permission problem, or anything else, the server writes a warning to the log and keeps running. The per-request policy check is then skipped for the entire lifetime of the process, and so are the consent prompts. Classified CWE-455, non-exit on failed initialization. Version 1.3.47 refuses to start when the index will not initialize and blocks command execution if it goes missing at runtime. CVSS 7.3.
EX.Athe operations index failed to load. the server logged it and kept serving
commentary
The degraded state and the healthy state look identical from outside the process. One WARNING line in a log is the entire difference between a configured policy engine and no policy engine at all.
impact
Every configured deny and gate rule stops applying, silently, until someone restarts the process. Indirect prompt injection can then drive the mutating AWS CLI commands the operator explicitly blocked, with IAM on the credentials as the only control left standing.
n8n's MCP Client Node Sends Its Requests Around the Platform's SSRF Protection #
GHSA-vhf8-cg2h-cg3p, published July 22, 2026, covers two n8n maintenance lines: the 2.31 line below 2.31.5, and the 2.32 line below 2.32.1. The MCP Client node sends requests to user-supplied endpoints without routing them through the configured SSRF protections, and it does not pin resolved addresses, so a hostname that resolves acceptably during a check can resolve elsewhere on the request itself. CVSS 6.4, and NVD later assigned CVE-2026-72768. Fixed in 2.31.5 and 2.32.1. For operators who cannot upgrade, n8n suggests restricting access to trusted users, disabling the node through NODES_EXCLUDE, or applying network-level egress rules.
commentary
The SSRF protection is configured once, at the platform level, and one node declines to use it. A platform-wide guarantee lasts exactly until a single node opts out of it.
impact
A user who can create or edit a workflow points the server at internal or blocked hosts and reads the responses back out through the workflow.
Microsoft Azure DevOps MCP Server Returns Invisible PR Comments Verbatim, Prompt Injection Turns Reviewer Agent Into a Cross-Project Exfiltrator #
Manifold Security published When Your AI Reviewer Works for the Attacker on July 22, 2026, describing a confused-deputy flaw in Microsoft's official azure-devops-mcp server. Azure DevOps PR descriptions accept Markdown, and the PR-description tool the server exposes to the agent returns the raw body from the API without stripping HTML comments. An attacker with contributor access to any project the victim's Azure DevOps account can see opens a PR whose description is an ordinary human sentence in the rendered UI and a paragraph of instructions inside an <!-- ... --> block underneath. When the victim tells their agent to review the PR, the agent ingests the invisible block as tool output and follows the instructions, which typically direct it to read work-item contents or files from a private project the attacker has no direct access to and stitch them into the review comment the attacker will get to see. Microsoft ships a prompt-injection guardrail called spotlighting on some tools in the same server, but not the pull-request-description tool the bug lives on. MSRC has acknowledged the report; no CVE and no fix as of publication.
EX.Athe review-agent trust model when the pull-request-body tool returns raw markdown
commentary
Microsoft already knows this attack. The company shipped spotlighting as an antidote to indirect prompt injection and applied it to some of the tools this server exposes. The PR-description tool, the one whose whole job is to hand attacker-controlled Markdown to a language model, is not one of them.
impact
A contributor to any single project in an Azure DevOps organization writes hidden text into a PR description and steers a victim's AI reviewer into reading and returning data from projects the contributor was never authorized to see. The exfil channel is whatever comment or artifact the agent posts back on the poisoned PR.
AWS Kiro Fetches a Poisoned Web Page, Follows the Hidden Instructions to Rewrite Its Own mcp.json, and Auto-Loads the Attacker's Server #
Intezer Research, with Kodem Security, published When the AI Edits Its Own Trust Boundary on July 21, 2026 against AWS Kiro, Amazon's agentic IDE. The agent has unattended write access to ~/.kiro/settings/mcp.json and Kiro auto-reloads that file the instant it changes. A page hosted anywhere on the public web can carry an invisible block of prompt-injection payload; a developer asking Kiro to summarize the URL sends the whole page through the model, and the payload instructs the agent to add an attacker-controlled MCP server entry to the settings file. The reload fires, the attacker's server process starts under the developer's account, and the tool description it advertises to the agent becomes the next prompt-injection surface. Amazon assigned CVE-2026-10591 on July 22, 2026 and shipped the fix in Kiro 0.11.130. Kiro now marks mcp.json, .vscode/tasks.json, .git, and other paths as protected so the agent has to obtain explicit developer approval before writing them.
EX.Aletting the model write `mcp.json` was the entire security boundary
commentary
The IDE's answer to the question who is allowed to configure this IDE's tools was whoever the agent decides to trust, and the agent's answer to who is allowed to write my prompt was whoever wrote the last web page you asked me to read. Kiro's fix is a hardcoded list of files the model is not allowed to edit without a click, which is the correct fix and also a small monument to the design that got here.
impact
A URL a developer thought they were asking their IDE to summarize gets code execution on the developer's machine with the developer's own privileges. Anything reachable from that shell is reachable to the attacker, including cloud credentials, source trees, and the local git and npm identities the developer signs commits and releases with.
Island Security Publishes AgentBaiting: 800+ Fake MCP Servers Inside a 7,600-Repo FakeGit Campaign Deliver SmartLoader When AI Agents Recommend Them #
Island Security published AgentBaiting: How Fake AI Skills Deliver Malware at Scale on July 21, 2026, and Bleeping Computer and Help Net Security wrote it up the same week. The wider FakeGit operation, ~7,600 GitHub repositories across ~6,600 accounts, seeds convincing lookalikes of common developer tooling; roughly 800 of those repositories pose as MCP servers or awesome-ai-skills-style catalogs. The AI-skill wave built through March and peaked in April 2026 and the repositories have appeared more than 600 times in public AI registries and catalogs. Island's testing found Claude Code, Google Gemini, and ChatGPT surfacing the fake repositories unprompted when asked for an MCP server for a given task and then handing the README's install instructions to the developer. The install ZIP drops SmartLoader, which pulls in the StealC infostealer. About 200 of the FakeGit repositories account for the 14 million measured downloads across GitHub Release assets to date.
commentary
The MCP registry story for the last year has been the agent will find you the right tool. The AgentBaiting result is that the agent does, in fact, find a tool; the tool is a payload; and the developer's role in the exchange is to say yes.
impact
An AI coding agent asked to find an MCP server or Skill returns an attacker's repository as a legitimate option and walks the developer through installing it. On install, SmartLoader lands and pulls StealC, which harvests credentials, tokens, cookies, and session material from browsers and developer tooling. The exposure scales with the agent, not the developer, because the agent is the discovery layer.
Onyx Copies Every User’s MCP OAuth Token Into One Shared Admin Row #
Onyx published GHSA-q62f-rv3h-f822 on July 20, 2026. In backend/onyx/server/features/mcp/api.py, OnyxTokenStorage.set_tokens and set_client_info wrote per-user OAuth tokens into a shared admin MCPConnectionConfig row, and _db_mcp_server_to_api_mcp_server returned that row through auth_template.headers. GET /api/mcp/servers and GET /api/mcp/servers/persona/{persona_id} therefore returned another user’s Authorization header to any BASIC_ACCESS user. CVSS 9.6 with scope changed. The code fix landed in PR #11238 on May 20, the advisory followed two months later, and NVD assigned CVE-2026-71424 on August 17. Fixed in 3.1.10, 3.2.14, and 4.0.0.
Per-user tokens, stored in a row called admin. The endpoint that hands them out is the one that lists your MCP servers, so it is the endpoint everybody calls. The credentials are for third-party services that will never learn any of this happened.
impact
Any authenticated Onyx user with basic access reads other users’ OAuth Authorization headers for their connected MCP servers and impersonates them against those upstream services.
ArcadeDB's MCP Transport Never Binds the Authenticated User, So Every Permission Check Passes #
Two advisories landed against ArcadeDB before 26.7.3 on July 17, 2026. CVE-2026-68578 is the structural one: the MCP HTTP transport fails to bind the authenticated principal, so every engine permission check silently passes as a no-op. Any non-root user allowed to reach MCP can perform arbitrary database writes, DDL, and schema mutations, and can execute arbitrary JavaScript through the query tool. CVE-2026-67357 sits next to it: the get_server_settings MCP tool returns arcadedb.ha.clusterToken in cleartext, and that token combined with the X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User headers is enough to impersonate root. Both rated CVSS 7.5.
EX.Athe engine permission checks, silently returning true since the mcp transport shipped
commentary
The permission checks were running the entire time. They just had nobody to check them against, and passing was the default. Chain the token leak on top and a low-privilege user owns the server.
impact
Read the cluster token out of one tool call and come back as root. Skip that entirely and an ordinary MCP-allowed user still has arbitrary JavaScript execution, because the permission checks are decorative.
Adversa AI published DeepJack on July 15, 2026, an attack class against the cursor:// protocol handler that Cursor registers with the operating system at install time. A deeplink pointing at Cursor's mcp/install endpoint pops the MCP server install dialog, and that dialog is the only consent step between a clicked link and an attacker-controlled command running with the developer's privileges. The researchers pad the command with whitespace so trailing arguments sit off the right edge of the dialog's single-line box, and they nest a double-URL-encoded mcp/install URI inside a pr-review parameter that Cursor never recursively decodes, so a link that presents as a pull-request review carries an install instruction. Cursor's triage closed both reports as duplicates of an issue filed internally on April 27, 2026. Build 3.9.8, shipped after the disclosure, still reproduces it. No CVE was assigned.
EX.Adeeplink handler, install dialog, url decoder: each assuming another checked
commentary
Cursor knew about the dialog on April 27 and shipped 3.9.8 almost three months later with the primitive intact. The install dialog is the entire security model for cursor://, and it renders the command in a single-line box that scrolls. Whitespace is the exploit.
impact
One click and one Approve on a link that looks like a code review installs the attacker's MCP server and runs its command unsandboxed. That reaches SSH keys, cloud credentials, live session tokens, browser cookies, source code, and anything else the developer's account can touch, plus a path straight into CI.
IBM Langflow's MCP stdio Launcher Blocklist Forgot SHELLOPTS, BASHOPTS, and PS4 #
IBM published CVE-2026-12940 on July 14, 2026 against Langflow OSS 1.0.0 through 1.10.1: unauthenticated remote code execution through environment variable injection in the MCP stdio launcher. src/lfx/src/lfx/base/mcp/util.py keeps a DANGEROUS_ENV_VARS blocklist of variables it refuses to pass into a spawned MCP server process. Three names were missing from it, and they happen to be the three that let you talk a shell into running a command at startup: SHELLOPTS, BASHOPTS, and PS4. Turning on shell tracing and pointing the trace prompt at a command substitution has been a documented bash execution trick for years. CVSS 9.8.
EX.Acan't have env var injection if you remember every dangerous variable
commentary
A blocklist is a bet that you already thought of everything. This one covered the obvious names and missed the trio that every shell-injection cheatsheet lists.
impact
An unauthenticated attacker reaches code execution on the Langflow host through the MCP stdio launcher. Every 1.x release up to 1.10.1 is affected.
AWS HealthLake MCP Server Doesn't Validate Its Own Pagination URLs, Ships Temp Credentials to Whoever Sends a next_token #
AWS Security Bulletin 2026-054-AWS landed on July 14, 2026 for CVE-2026-15643, a server-side request forgery in awslabs.healthlake-mcp-server, the AWS-published MCP server that fronts AWS HealthLake FHIR datastores. The pagination handler accepts a caller-supplied next_token value and dereferences it without checking that the URL points back at HealthLake. A crafted next_token sends the server's outbound request, together with the temporary AWS credentials the MCP server uses to call HealthLake, to any endpoint the attacker names. CVSS 3.1 is 7.3, High. Authenticated remote attacker, no user interaction. The fix ships as version 0.0.14.
commentary
The pagination token is a URL the server produced last request and is now being asked to dereference. Zero code in the tool needed to accept a caller-supplied URL. It did anyway. HealthLake is the compliance-branded HIPAA offering, which is the funny part.
impact
A remote authenticated caller who reaches the HealthLake MCP tool gets the server to POST its own temporary AWS credentials to an attacker-controlled URL. Those credentials scope to whatever role the MCP server assumed when it started, which on a HealthLake deployment reaches every FHIR record the role can see.
mcp-atlassian Has a Path Validator, and confluence_upload_attachment Never Calls It #
GHSA-g5r6-gv6m-f5jv, published July 10, 2026, covers mcp-atlassian before 0.22.0. confluence_upload_attachment passes its client-supplied file_path straight to open(file_path, "rb") in src/mcp_atlassian/confluence/attachments.py, by way of _upload_attachment_direct(). The codebase already ships validate_safe_path and applies it elsewhere; this call site does not. CVSS 7.7. The fix is one validation call added ahead of the open, released in 0.22.0.
EX.Avalidate_safe_path, watching the upload tool call open() directly
commentary
The validator was written, shipped, and used. The one path it never reached is the one whose job is to open a file the caller names.
impact
An authenticated MCP client, or an agent acting on injected instructions, reads any file the server process can read and uploads it to Confluence. On Linux that includes `/proc/self/environ`, which carries the server's own credentials and API tokens.
CKAN MCP Server Patches Three: A Prefix-Only Regex, a Cache Key That Collides, and Errors That Repeat Everything #
Three advisories for @aborruso/ckan-mcp-server, all published July 9, 2026. isValidMqaServer validates the server_url parameter against /^https?:\/\/(www\.)?dati\.gov\.it/i, which has no end anchor and no host boundary, so https://dati.gov.it.attacker.com/x and https://dati.gov.it@attacker.com/x both pass and the MQA quality tools return an attacker's response (CVE-2026-73845, CVSS 5.3, fixed in 0.4.111). canonicalizeParams in src/utils/cache.ts joins sorted key-value pairs with unescaped &, =, and | delimiters, so { q: "budget", rows: 10 } and { q: "budget&rows=10" } build the same key and share one entry in a cache that is enabled by default (CVE-2026-73846, CVSS 6.5, fixed in 0.4.111). Error paths return raw upstream response bodies and internal exception messages verbatim rather than a generic message (CVE-2026-73844, CVSS 3.7, fixed in 0.4.112).
commentary
The error-disclosure bug scores 3.7 alone and is the least interesting of the three by itself. Sitting behind the host-validation bug, it is the channel that hands back whatever that one fetched.
impact
An attacker primes the shared cache so another user's query returns a response prepared for a different one, points the quality tools at a lookalike host, and reads upstream content, internal hostnames, and database errors out of the error text.
tumf mcp-text-editor Path Traversal in _validate_file_path, Maintainer Closes the Report #
CVE-2026-15138 landed on July 9, 2026 against tumf's mcp-text-editor, an MCP server that gives an AI assistant read and write access to files on the developer's machine. The _validate_file_path function in mcp_text_editor/text_editor.py accepts a caller-supplied file_path argument and does not normalize it before deciding whether the target sits inside the allowed directory, so a ../-laden path walks past the intended sandbox and back to any file the server process can reach. Versions 1.0.0, 1.0.1, and 1.0.2 are affected. The disclosure is a 5.3 Medium under CVSS 4.0 and requires that the operator invoke the vulnerable tool with attacker-influenced input, which for an MCP server is what the whole product does. The reporter filed an issue on the project's GitHub before publication; the maintainer closed it without a comment, a patch, or a release.
commentary
The function is literally named _validate_file_path. It is the one place in the codebase whose entire purpose is to answer the question the CVE is about. The maintainer's response to the report was to close the issue, which is a defensible position for a hobby project and an alarming one for something the MCP registry lists as an available tool.
impact
Any prompt or tool response that reaches the agent and coaxes it to open `../../etc/passwd`, `~/.ssh/id_ed25519`, or any other file readable by the server process gets that file's contents, past whatever directory scoping the operator thought they had configured. The write path has the same missing check, so a poisoned prompt can also overwrite files outside the intended workspace.
SPELLSMITH Study Puts Numbers on Taint-Style Bugs Being the Median MCP Server Vulnerability #
A team from Tongji University posted Mitigating Taint-Style Vulnerabilities in MCP Servers via Security-Aware Tool Descriptions on arXiv on July 8, 2026 (2607.07461). The paper catalogs the vulnerability landscape of published MCP servers, finds that taint-style flaws (SSRF, path traversal, SQL injection, command injection, and their cousins) account for a substantial fraction of reported issues, and reports that these bugs require significant code changes to remediate and are met with slow or absent community responses. The authors propose SPELLSMITH, a defense that packages security guidance for the model into the tool description itself so the agent is nudged away from feeding tainted input into the tool in the first place. The paper is one of a small cluster of academic papers this quarter that back the informal observation that MCP servers keep shipping the same bug classes into the CVE database.
commentary
Every week the CVE database picks up another MCP server with an unnormalized path in its file API or an unvalidated URL in its HTTP fetcher, and every week the SPELLSMITH numbers get more defensible. Naming a mitigation SPELLSMITH and shipping it as a prompt for the agent is a very 2026 answer to the question of who is responsible for input sanitization in a protocol whose entire pitch was that the LLM does the plumbing.
impact
The paper does not disclose a new vulnerability. It puts numbers on a claim that has been anecdotal for the last six months: the median public MCP server ships with at least one taint-style bug, and the median maintainer has not shipped a fix.
MCP Ruby SDK Ships Five Advisories in One Day, Including Session Poisoning the Spec Warned About #
The modelcontextprotocol/ruby-sdk repo published five advisories against the mcp gem on July 8, 2026, one day after 0.23.0 shipped the fixes. Every one of them affects 0.22.0 and earlier. CVE-2026-67431 is session poisoning: the Streamable and SSE HTTP transports never verify session ownership, so anyone holding a stolen session ID can POST tool calls to /messages/{session-id}, and the server executes them and streams the results back down the victim's SSE connection where they read as the victim's own. CVE-2026-67432 reads the full HTTP body into memory with no upper bound, and does it before session validation; the reporter's 512 MB request took RSS from 44 MB to 1.66 GB. CVE-2026-63118 skips Host and Origin validation, so any page a developer visits can reach a loopback MCP server by DNS rebinding and call its tools. CVE-2026-63119 and CVE-2026-67430 finish the set with unbounded IO#gets on the stdio transports and sessions that never expire, 50,000 of which fit in 27 seconds.
EX.Apublishing advisory four of five against your own sdk in a single afternoon
commentary
The session poisoning advisory says the quiet part itself: the MCP spec recommends binding session IDs to user identity, and the C# and Go SDKs already do it. Ruby shipped 22 minor versions without it, then fixed five things in one afternoon.
impact
An attacker with a session ID runs tools as the victim, and the victim reads the output as legitimate. Separately, one unauthenticated POST takes down a Ruby MCP server, and any web page can drive a developer's localhost server through their browser.
AWS mcp-gateway-registry Metrics Service Interpolates table_name Straight Into SQL #
AWS Security Bulletin 2026-052-AWS landed on July 6, 2026 for CVE-2026-14471, an authenticated SQL injection in mcp-gateway-registry, the open-source gateway and registry that agentic-community publishes for centralizing MCP servers behind OAuth. The metrics-service retention policy management component takes a caller-supplied table_name value and interpolates it into SQL statements in identifier position with no neutralization. An authenticated remote user submits a crafted table_name and executes arbitrary SQL against the metrics database, which the bulletin notes stores API key material alongside the metrics themselves. CVSS 3.1 comes in at 8.1 and CVSS 4.0 at 8.6, both High. The fix ships as version 1.0.13; there is no workaround.
EX.Ait looks like you're trying to interpolate `table_name` into a SQL identifier. want me to skip the escaping?
commentary
The registry is the piece of the stack the vendor asked customers to trust so they would not have to trust the individual MCP servers behind it. The metrics service inside that registry took a table_name string from a request and concatenated it into a SQL identifier. psycopg2.sql.Identifier has existed since 2017. So has the practice of not doing this.
impact
An authenticated caller with reach to the metrics-service endpoint reads every row the metrics database holds, including the stored API keys the registry uses to broker calls to downstream MCP servers, then deletes or alters records at will. The registry's whole reason to exist is being the trusted broker in front of a fleet of MCP servers; the SQL injection turns that broker into a credential dump.
AIAnytime Awesome-MCP-Server wiki-summary Hands the URL Argument to requests, SSRF to Anywhere #
CVE-2026-14748 published on July 5, 2026 against AIAnytime/Awesome-MCP-Server, whose mcp-wiki subproject ships an MCP tool that summarizes wiki pages for the connected agent. The wiki-summary handler in mcp-wiki/src/mcp_wiki/server.py takes a caller-supplied url argument and passes it into the outbound HTTP client with no scheme allow-list, no host allow-list, and no block for link-local ranges. A prompt-injected wiki summary request to http://169.254.169.254/latest/meta-data/iam/security-credentials/ returns the instance profile credentials for whichever cloud account the agent happens to be running in. The disclosure is Medium at CVSS 6.3 and the exploit has been published. The reporter filed the issue with the project ahead of publication and, per the CVE record, the project has not responded.
commentary
This is the sixth or seventh time in 2026 that an MCP tool with url in its argument list has turned out to have neither scheme nor host filtering. Every wiki-summary MCP server on the planet reads the same tutorial before it ships, and the tutorial does not have the 169.254.169.254 line in it.
impact
An MCP server whose only intended reach was the public Wikipedia HTTP endpoint becomes an unauthenticated outbound fetcher for any URL an attacker can convince the agent to pass in. On a cloud host that is enough to reach the instance metadata service, cluster DNS, and internal admin endpoints the agent's network position happens to include.
fast-mcp-telegram Uses Bearer Tokens as Session-File Paths; Path Traversal Grabs the Default Account #
CVE-2026-52830 (CVSS 9.4) landed in the NVD on July 2, 2026 against fast-mcp-telegram, an MCP server that bridges HTTP requests to Telegram's MTProto API and supports multi-user Bearer-token authentication. The server authenticates incoming HTTP clients by joining the raw Bearer-token string into a session-file path and checking whether that file exists on disk. The verifier explicitly rejects the reserved literal telegram so HTTP callers cannot select the stdio/legacy default session, but it does not reject .. and does not normalize the path before the existence check. A remote HTTP client that sends Authorization: Bearer ../fast-mcp-telegram/telegram walks the traversal back to the documented default session file at ~/.config/fast-mcp-telegram/telegram.session, and the server hands the caller that session. With account-prefixed MCP tools enabled, the prefix middleware still exposes tools for the default account, so the intended isolation between the HTTP transport and the legacy default account collapses. Every version prior to 0.19.1 is vulnerable.
EX.Athe reviewer who approved `session_path = join(dir, bearer_token)` as the entire auth layer
commentary
os.path.join(sessions_dir, bearer_token) is written down somewhere in this repository as an authentication decision. The reserved-name check knew telegram was the string to worry about. The path traversal reached the string telegram anyway, because the string was also a filename. The bug is not the missing normalization; the bug is that the token was a path.
impact
An unauthenticated remote HTTP client with network reach to a `fast-mcp-telegram` HTTP endpoint impersonates the default Telegram account any time that account's session file lives at the documented default path. From there the caller drives every account-prefixed MCP tool as the default user, which for a Telegram bridge covers reading and sending messages, listing chats, and shipping attachments.
Microsoft's Detection and Response Team, the incident-response arm inside Microsoft Security, published guidance on June 30, 2026 flagging tool-description poisoning as an active attack path against enterprise agents built on Microsoft 365 Copilot, Copilot Studio, and Azure AI Foundry. Every MCP tool ships a plain-text description that tells the agent what the tool does and when to invoke it, and the guidance notes that the description lives in the agent's working memory next to its real orders. Third-party MCP servers can change that description at runtime and, in default enterprise configurations, the poisoned version becomes active without a new consent prompt. Microsoft's worked scenario has a finance team wiring a vendor-enrichment MCP server into a Copilot Studio invoice agent. The tool's visible name and summary stay unchanged, while the description grows a formatting-note-shaped instruction to attach the last thirty unpaid invoices to the next call. The next routine supplier lookup ships those invoices to whatever endpoint the tool's HTTP client points at. Microsoft's mitigation stack is a tenant-level MCP publisher allowlist (disabling Allow all), Prompt Shields inspection of tool metadata and responses, Purview DLP on tool parameters, human approval on high-impact actions, Entra Agent ID plus Conditional Access on agent identities, and Sentinel correlation between agent behavior and MCP telemetry.
commentary
Invariant Labs coined tool poisoning in April 2025. Fifteen months later Microsoft Incident Response is walking Copilot Studio customers through a worked example of it, with a mitigation checklist that reads assume MCP publishers are hostile. The protocol still ships the same trust boundary the coining paper described, which is to say it does not really ship one.
impact
An approved third-party MCP tool can be turned into an exfiltration channel by rewriting its description, and every enterprise Copilot tenant that leaves the default `Allow all` MCP configuration on picks up the poisoned version without any re-approval. The advisory applies to Microsoft 365 Copilot, Copilot Studio, and Azure AI Foundry agents that can send email, create files, change calendars, query business systems, or run multi-step workflows.
Djinn Stealer Adds ~/.claude/mcp.json to Its Loot List After SimpleHelp Auth Bypass #
Blackpoint Cyber's Adversary Pursuit Group published an intrusion investigation on June 29, 2026 that started with CVE-2026-48558, a critical (CVSS 10.0) authentication bypass in SimpleHelp RMM's OpenID Connect flow originally disclosed by Horizon3.ai on June 12. The server accepted OIDC identity tokens without verifying their cryptographic signature, so an unauthenticated attacker submitted a forged token with arbitrary claims and got a fully authenticated technician session on an internet-facing SimpleHelp install. From that foothold the operator dropped TaskWeaver, a heavily obfuscated Node.js loader that runs as jquery.js under node.exe, then used TaskWeaver's encrypted channel to deliver a second previously undocumented family, Djinn Stealer. Djinn ships collection rules for Windows, macOS, and Linux and, alongside the standard AWS/Azure/GCP/Oracle/Okta/Cloudflare/Vault/Terraform/browser/crypto-wallet sweep, has a dedicated section for AI-assisted development tools. It reads configuration, session, and auth material from Anthropic Claude, Google Gemini, and OpenAI Codex, plus open-source coding agents Cline, OpenCode, and Kilo, and it explicitly walks paths like ~/.claude/mcp.json where MCP server URLs and tokens live. CISA added CVE-2026-48558 to the Known Exploited Vulnerabilities catalog the same day Blackpoint published, with a BOD 26-04 remediation deadline of July 7 for federal civilian agencies.
The moment a commodity infostealer's collection ruleset lists ~/.claude/mcp.json next to .env files and browser cookies is the moment MCP configuration is officially loot. Djinn also enumerates Cline, OpenCode, Kilo, Gemini, and Codex, so the operators did the market research. The .claude directory is now a threat model of its own.
impact
Any organization exposing an unpatched SimpleHelp RMM to the internet could have its technician session hijacked with a forged OIDC token, then have a developer machine's MCP configuration harvested along with the usual cloud, source-control, and wallet material. Because MCP configs carry the tokens the developer's own agent uses, the stolen material grants the attacker the same downstream reach the agent already had into repos, databases, cloud accounts, and internal APIs.
Amazon Q for VS Code Auto-Loads .amazonq/mcp.json From Any Cloned Repo #
Wiz Research's Maor Dokhanian disclosed that the Amazon Q Developer extension for Visual Studio Code reads .amazonq/mcp.json from any opened workspace and spawns the MCP servers it defines without checking workspace trust, surfacing a prompt, or even logging the action. The spawned processes inherit the developer's full environment, so anything the shell carries, including AWS access keys, cloud CLI tokens, SSH agent sockets, and API secrets, is handed directly to whatever command the config pointed at. Wiz reported the issue to AWS on April 20, 2026; AWS deployed an initial fix on May 12 and publicly disclosed on June 26 under Security Bulletin 2026-047-AWS as CVE-2026-12957 (CVSS 8.5). The same bulletin tracks a second flaw, CVE-2026-12958, a missing symlink check in Language Servers for AWS that lets a maliciously crafted symlink inside an opened workspace point at a target outside the workspace trust boundary, enabling arbitrary file writes. Both are remediated in Language Servers for AWS 1.65.0; AWS asks customers to upgrade to 1.69.0 for the broader rollup.
EX.Agit clone, open in VS Code, lose AWS creds. apparently that's the design
commentary
Workspace trust exists in VS Code specifically so that git clone && code . is not also chmod +x ./*.sh && ./run-all. Amazon Q's MCP loader read past that signal because the config file lived under .amazonq/ and was therefore, by assumption, friendly. The same assumption produced the symlink bug. The fix list is the assumption list.
impact
Anyone who clones a repository, opens it in VS Code with Amazon Q installed, and is connected to their cloud session executes whatever the repo's `.amazonq/mcp.json` told MCP to run, attached to their live AWS credentials, with no further interaction. The chained symlink bug bumps the same workspace-open into arbitrary file writes outside the trust boundary.
Three MCP Servers Fetch Whatever URL You Name, Reported in June and Given CVEs in August #
TianYu-0829 opened public GitHub issues on June 25, 2026 against three MCP servers, all the same shape. The parse-csv tool in mcp-dominican-layer validates csvUrl with z.string().url() and passes it to axios.get() (CVE-2026-19751). Its parse-pdf tool does the same with pdfUrl (CVE-2026-19752). The explore_url tool in mcp-rdf-explorer hands url to requests.get() in server.py (CVE-2026-19753). None of the three restrict scheme, hostname, resolved IP range, port, redirects, or timeouts. Each proof of concept drives the server at a local HTTP listener through the MCP Inspector. VulDB filed the CVEs on August 13, seven weeks after the issues went public.
commentary
Zod confirmed the string was a URL. That is the entire check, and it is exactly the check that a URL-fetching SSRF is built to pass.
impact
A tool argument reaches an outbound HTTP client with no destination policy, so the server fetches internal services and cloud metadata endpoints on the caller's behalf and returns what it gets.
Red Hat Satellite foreman-mcp-server Treats Session IDs as Auth, Logs Them #
Red Hat published advisories for two issues in foreman-mcp-server, the Technology Preview MCP server bundled with Satellite 6.18. CVE-2026-12112 (CVSS 7.8, Important) is the session-management bug. The server caches authenticated client connections and trusts the session ID on subsequent requests without re-validating the underlying authentication tokens, so anyone holding a session ID inherits the active administrative session. CVE-2026-9073 (Moderate) is how that session ID gets obtained. The server writes every newly created session ID to standard logs at the informational level, and when debug logging is enabled, also persists HTTP authorization headers in cleartext. Both advisories landed on June 23, 2026, without a fixed-version pointer at publication. Red Hat's interim mitigation is to restrict access to foreman-mcp-server, scrub log forwarding, and watch for suspicious session activity.
commentary
A session ID treated as a bearer token is a design choice. A session ID treated as a bearer token and logged at INFO is the kind of thing that fails its first compliance audit. Both behaviors live in the same component, shipped under the Technology Preview label, which is the industry-standard phrasing for please discover the bugs for us.
impact
Anyone with read access to Satellite's container logs, or to any sink those logs were forwarded to, harvests session IDs that are themselves the bearer credential. Replaying them produces hijacked administrative sessions on a Satellite instance and, through it, infrastructure-wide code execution against the hosts it manages.
Ouroboros Rebuilds Its .env Denylist After the First One Left the MCP Config Root Reachable #
Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies. CVE-2026-47211 was closed by adding _UNTRUSTED_ENV_DENYLIST, which stops a .env in an untrusted project directory from redirecting execution. That list did not cover every key. Through 0.42.0, OUROBOROS_MCP_CONFIG still pointed the runtime at a YAML file whose server command and args are executed through the stdio client, while OUROBOROS_PLUGIN_LOCKFILE and OUROBOROS_PLUGIN_TRUST_ROOT redirected the installed-plugin roster and its trust root. A .env is auto-loaded at import with no review step, so cloning a hostile repo is the entire delivery mechanism. Version 0.42.1 denylisted those keys and separately stopped auto-loading ./.ouroboros/mcp_servers.yaml from the working directory, a path that reached the same place with no .env involved at all. CVSS 8.4.
EX.Acan't be redirected by a hostile .env if you denylist most of the variables
commentary
The first fix enumerated dangerous variables and missed the one named after the MCP config file. Underneath it sat a working-directory auto-load that made the .env optional anyway.
impact
Clone a malicious repository and the agent runtime launches the attacker's MCP servers running the attacker's commands. The approval gate does not intervene, because the config that defines the gate is the thing being replaced.
Mastra AI npm Scope Hijacked by Sapphire Sleet, 142 MCP Framework Packages Backdoored #
Between 01:12 and 02:39 UTC on June 17, 2026, a single compromised npm account named ehindero republished 142 packages across the @mastra scope, the TypeScript AI agent framework whose @mastra/core, @mastra/mcp, and @mastra/mcp-docs-server packages clear roughly a million weekly downloads between them. The compromised versions were byte-for-byte identical to the legitimate builds; the only change in each manifest was a single injected dependency, easy-day-js, a typosquat of dayjs published one hour earlier under the alias sergey2016. The dependency's postinstall hook disabled TLS certificate verification, fetched a second-stage payload from attacker infrastructure, executed it as a detached background process, and deleted itself to limit forensic traces. The cross-platform infostealer harvested browser data from Chrome, Edge, and Brave, extracted credentials from 166 cryptocurrency wallet extensions, and swept GitHub tokens, npm tokens, SSH keys, and .env files before exfiltrating to attacker C2. Microsoft Threat Intelligence attributed the activity to Sapphire Sleet (BlueNoroff), a North Korean state actor that has been running fake-recruiter LinkedIn campaigns against open-source maintainers; Mastra confirmed the compromised maintainer was a current employee whose machine was taken over after exactly that kind of contact. Socket flagged the malicious wave within six minutes of publication and Mastra force-published clean releases across all 142 packages.
EX.Aevery AI dev who installed @mastra/core this morning, reading the IOCs over coffee
commentary
One LinkedIn DM took over the entire @mastra npm scope. Time-to-publish-malware was eighty-eight minutes, faster than most incident-response oncall rotations resolve a page. The remediation checklist starts at "rotate every credential a developer machine has ever held" and the list gets longer from there.
impact
Anyone running `npm install` against an `@mastra/*` version in the 88-minute window received a credential harvester running inside their developer or CI/CD environment. The blast radius covered every consumer of the framework's MCP client and server packages; Mastra advised treating any affected install as fully compromised and rotating every credential the host had touched, including cryptocurrency wallet seeds.
Agentjacking Turns Fake Sentry Errors Into AI Coding Agent RCE via MCP #
Tenet Security disclosed agentjacking, an attack class that uses Sentry's open event-ingestion architecture to plant prompt-injection payloads inside fake bug reports, then waits for an AI coding agent connected to the Sentry MCP server to read them. A Sentry DSN is a write-only credential that every frontend ships in its JavaScript, so finding one is a GitHub search. The injected event's message field and context keys carry markdown that renders identically to Sentry's own system template: headings, code blocks, tables. When Claude Code, Cursor, or Codex retrieves the event over MCP as a triage prompt, the agent treats the embedded instructions as legitimate diagnostic steps and executes attacker-controlled commands with the developer's own privileges. Tenet reported an 85% success rate against the three agents across more than 100 organizations in controlled tests and identified at least 2,388 organizations with injectable DSNs in production. The Cloud Security Alliance AI Safety Initiative published the research as a CSA Research Note on June 12, 2026, with parallel coverage at The Hacker News the same day.
EX.Asentry on the root cause: "technically not defensible"
commentary
Sentry's response was that the issue is technically not defensible at the platform level, so they shipped a content filter for the exact payload string Tenet sent them. The architectural pathway, where any DSN can plant agent-executable commands inside a customer's triage workflow, is untouched. The acknowledgement and the non-fix arrived the same day.
impact
Anyone with a public Sentry DSN can plant a single error event that exfiltrates AWS keys, GitHub tokens, Sentry auth tokens, git credentials, and private repo URLs from the developer's machine through the Sentry MCP triage path. Every step in the chain is authorized, so EDR, WAF, IAM, VPN, and Cloudflare see nothing to block.
gemini-bridge Reads Any File You Name, Then Ships It to Google #
gemini-bridge is a small MCP server that hands AI agents a path to Google's Gemini through the official CLI. From 1.0.0 until 1.3.1, consult_gemini_with_files in inline mode read any path supplied in the files argument without confining it to the working directory, then forwarded the contents to the Gemini CLI. Because the caller also controls query, the contents come straight back through the Gemini round trip. Fixed in 1.3.1. CVSS 6.2.
commentary
The exfiltration channel is the product. A path traversal that ends in a file read is ordinary. This one reads the file, uploads it, and hands you the transcript.
impact
Arbitrary local file read for anything the server process can open, with the contents returned to the caller and a copy sent to Google along the way.
Socket's Threat Research team disclosed on June 9, 2026 that the active Mini Shai-Hulud / Miasma / Hades supply-chain campaign had added 23 fresh malicious PyPI artifacts the day prior, five of them aimed directly at developers building MCP integrations: langchain-core-mcp, openai-mcp, instructor-mcp, tiktoken-mcp, and ray-mcp-server. The wheels follow the Hades pattern earlier waves established on npm: a .pth startup hook fires during Python's site initialization, downloads the Bun JavaScript runtime as a living-off-the-land binary, then runs an obfuscated stealer staged through Bun with a fake prompt-injection header at the top of the payload. The langchain-core-mcp wheel ships only the .pth loader and no bundled _index.js, instead walking every entry in sys.path for the payload at runtime. The split-staging architecture decouples loader from payload so static scanners that audit the wheel they were handed see nothing executable. The June 8 PyPI wave brought the campaign's cross-ecosystem total to 471 artifacts spanning 411 npm packages and 60 PyPI wheels since June 1, with Socket tracking it pivoting delivery mechanisms every 48 to 72 hours.
EX.Aevery MCP integration tutorial that opened with pip install something-mcp
commentary
The package names are unsubtle on purpose. Anyone typing pip install langchain-core-mcp in the dark is the demographic. The split-staging .pth trick is also on purpose: most scanners look inside the wheel they're handed, not the rest of sys.path. Defense in depth, attacker-side.
impact
Developers searching PyPI for an MCP integration could land on a wheel that dropped a credential harvester at install time. Targeted material includes GitHub tokens, npm and PyPI publish keys, AWS, GCP, Azure, Kubernetes service-account material, SSH keys, Docker config, shell history, `.env` files, and AI developer tool configuration including `~/.claude.json`. PyPI removed the artifacts after Socket reported them, but any install that ran during the window should be treated as compromised.
Claude Code GitHub Action Prompt Injection Hijacks Any Downstream Repo #
GMO Flatt Security's RyotaK and Microsoft Threat Intelligence published parallel research disclosing prompt-injection bypasses in Anthropic's official claude-code-action GitHub Action. Flatt's writeup, posted June 2, traced the checkWritePermissions function unconditionally trusting any actor whose login ended in [bot], which let any GitHub App author crafted issues whose contents Claude then treated as authorized instructions. Microsoft's June 5 post documented a second path: the agent's Read tool sat outside the Bubblewrap sandbox that wrapped Bash, so /proc/self/environ was reachable from inside any triage run. Both chains exfiltrated the workflow's ANTHROPIC_API_KEY, OIDC token, and any other CI secrets via the GitHub MCP server's update_issue tool, WebFetch, or echoed log output. Anthropic rated the issues 7.8 under CVSS v4.0, shipped fixes across claude-code-action v1.0.94 and Claude Code 2.1.128, and paid a bounty. A variant of the same misconfiguration class was already exploited in February against Cline's triage workflow to steal an npm publish token and push an unauthorized cline@2.3.0.
EX.AcheckWritePermissions · Read tool sandbox · GitHub MCP update_issue, lined up at exfil
commentary
An auth check that boils down to actor.endsWith('[bot]') is roughly the part of an auth system you'd hope --insecure-skip-tls-verify=true was, only less polite. The Bash tool got a Bubblewrap sandbox. The Read tool got a permission check. Whoever signed off on that delta hadn't yet met an LLM willing to ask Read for /proc/self/environ.
impact
Any repository running the action with a `[bot]`-authored triage workflow could be coaxed into leaking its `ANTHROPIC_API_KEY`, OIDC token, and other workflow secrets, then accepting attacker-authored commits. Because `anthropics/claude-code-action` itself ran the vulnerable workflow, a successful compromise of the action's own repo would have flowed to every downstream consumer.
better-auth's MCP Plugin Takes a javascript: Redirect URI and Advertises the none Algorithm #
Two better-auth advisories landed on May 31, 2026, and both reach MCP deployments through the mcp plugin that wraps the deprecated oidc-provider. In CVE-2026-67333, registered redirect_uris are never scheme-validated, so an attacker registers a client with a javascript: URI and the authorization server hands it back unchanged in the consent response. A consent page that assigns that value to window.location.href executes the attacker's script in the authorization server's own origin. Fixed in 1.6.13. CVE-2026-67336 covers the cryptographic defaults in the same two plugins: they advertise the none algorithm and accept plain PKCE, so an attacker can negotiate down to unsigned tokens or intercept authorization codes that S256 would have protected. Fixed in 1.6.11.
commentary
none has a decade of writeups behind it as the JWT footgun. Shipping it as an advertised default in 2026, in the plugin that fronts MCP auth, takes some doing.
impact
Script execution in the authorization server origin, which means the victim's session and account takeover. Separately, tokens with no signature accepted by a server whose job is checking signatures.
mcp-memory-service Guards /api/memories and Serves /api/documents to Anyone #
GHSA-84hp-mqvj-3p8h, published May 28, 2026, covers mcp-memory-service before 10.67.1. Every HTTP route under /api/documents/* is served with no authentication dependency, whether the server is configured with an MCP_API_KEY or with OAuth. The documents.py router is constructed without a dependencies= argument, and the file never imports Depends. Six endpoints are exposed this way: upload, batch upload, history, content search, and two deletion routes. The neighbouring /api/memories router applies Depends(require_write_access) correctly, so the guard exists in the codebase and was not wired into this file. CVSS 9.8.
EX.Athe MCP_API_KEY you configured, protecting one of the two routers
commentary
Setting MCP_API_KEY produces a server that looks authenticated, and is, on the router where somebody remembered to say so.
impact
An unauthenticated remote caller uploads content into the memory store, reads stored documents back out, and deletes them. The API key the operator configured has no effect on any of those routes.
Cortex Trusts CLAUDE_PROJECT_DIR, So Any Cloned Repo Can Claim to Be the Cortex Install #
GHSA-gvpp-v77h-5w8g, published May 27, 2026, covers neuro-cortex-memory 3.17.0 and earlier. Claude Code sets CLAUDE_PROJECT_DIR to whatever project the user has open, and Cortex's _find_dev_source() treats that path as a trusted developer checkout of Cortex itself. The check that decides, _is_cortex_root(), looks for an mcp_server/ subdirectory and a ui/unified-viz.html file. When open_visualization is invoked, the handler builds a bootstrap path under that directory and runs it with subprocess.run([sys.executable, str(bootstrap_path)]). A second path in http_launcher.py rsyncs the same untrusted source into the Cortex plugin cache. CVSS 7.8, fixed in 3.17.1.
commentary
One directory and one HTML file decide whether a path is your own source checkout. That is not a high bar for a repository whose entire purpose is to be cloned onto your machine.
impact
Opening a cloned repository in Claude Code and invoking the visualization tool executes that repository's Python with the developer's privileges.
auth-fetch-mcp Blocks ::ffff:127.0.0.1 and Node Hands It Back ::ffff:7f00:1 #
Two SSRF-guard bypasses published May 27, 2026. In auth-fetch-mcp 3.0.1 and earlier, assertSafeUrl() in src/security.ts blocks private and loopback addresses, and isPrivateV6() handles the IPv4-mapped form by stripping the ::ffff: prefix and calling net.isIPv4() on the remainder. Node's WHATWG URL parser hex-normalizes [::ffff:127.0.0.1] to [::ffff:7f00:1] before that check runs, so the remainder is 7f00:1, net.isIPv4() returns false, and the address is classified as public. The auth_fetch and download_media tools then reach 127.0.0.1 (CVE-2026-49857, CVSS 7.4, fixed in 3.0.2). The same day, @jshookmcp/jshook 0.3.1 and earlier shipped a central SSRF authorization policy that its HTTP, TCP, and TLS RTT tools enforce through resolveAuthorizedTransportTarget, and that network_icmp_probe and network_traceroute skip entirely, calling native probes straight after hostname resolution (CVE-2026-49856, CVSS 4.3, fixed in 0.3.2).
EX.Athe loopback check, meeting the second spelling of loopback
commentary
One guard was beaten by the URL parser running ahead of it. The other was simply not called by two of the tools it governs. Same lesson twice about where a check has to sit.
impact
auth-fetch-mcp returns responses from loopback services its guard was written to block. jshook maps internal addresses, reachability, latency, and routes from the server's network position even when private-network access is disabled globally.
mcp-server-kubernetes Ships Two Access Control Bypasses in Two Weeks #
Flux159's mcp-server-kubernetes shipped two access-control failures disclosed two weeks apart in late May and early June 2026. CVE-2026-46519 (CVSS 8.8), published May 21, found that the ALLOWED_TOOLS, ALLOW_ONLY_READONLY_TOOLS, and ALLOW_ONLY_NON_DESTRUCTIVE_TOOLS environment variables were enforced only inside the tools/list handler. The tools/call handler had none of those checks, so any client that already knew a tool name could invoke kubectl_delete, exec_in_pod, or kubectl_generic regardless of the configured restriction mode. v3.6.0 added matching enforcement at the execution layer. CVE-2026-47250 (CVSS 3.1), published June 5, showed that kubectl_generic still passed user-supplied flags straight to kubectl with no allowlist. A prompt injection planted in pod logs could nudge the agent to call kubectl_generic with --server=https://attacker.example/ and --insecure-skip-tls-verify=true, sending the operator's bearer token to the attacker. v3.7.0 added flag filtering. The researcher confirmed the full prompt-injection-to-token-exfiltration chain end to end against a live kind cluster with Claude Haiku as the agent.
commentary
Both bugs assume the same thing: the restrictions defined in config are the restrictions the code is checking. They aren't, and they weren't. Putting an AI agent between the operator and kubectl doesn't change the lesson, except that the agent will type --insecure-skip-tls-verify=true for you, on request, from a pod log.
impact
Pre-v3.6.0 deployments let any reachable client invoke arbitrary `kubectl` tools regardless of the configured restriction policy. Pre-v3.7.0 deployments let prompt-injected pod logs harvest the operator's kubeconfig bearer token, which then replays directly against the real cluster's API server.
Meta Ads MCP Server Skips the 401, Then Returns the Operator's Access Token in the Error Body #
pipeboard-co's meta-ads-mcp lets AI assistants run Meta Ads campaigns. Through 1.0.108, AuthInjectionMiddleware.dispatch() at http_auth_integration.py:272 handles an unauthenticated Streamable HTTP request by noting that no authentication tokens were found in the headers, then calling call_next(request) anyway. No 401 is ever issued. Tool handlers that find no per-request credential fall back to the META_ACCESS_TOKEN environment variable, so they run as the operator. When the downstream Meta Graph API call fails, api.py:263-269 serializes the raw httpx request URL into the JSON-RPC response body, and that URL carries the access token as a query parameter. Fixed in 1.0.109. CVSS 9.1.
EX.Await, the auth middleware just logs the missing token and continues?
commentary
The middleware detected the missing credentials, wrote that down, and continued. Then the error handler, whose job is to describe what went wrong, described it using the token.
impact
Any caller who can reach the server invokes Meta Ads tools with the operator's credentials. Provoke an API error and the response hands back the long-lived access token itself.
Claude Code SOCKS5 Sandbox Bypass Exfiltrates Credentials and MCP Configs #
Aonan Guan, who leads cloud and AI security at Wyze Labs, publicly disclosed his second Claude Code network sandbox bypass in five months. The latest issue is a SOCKS5 hostname null-byte injection. Claude Code's proxy enforces its egress allowlist by passing the raw DOMAINNAME bytes from a CONNECT request through a JavaScript endsWith() check against the user's wildcard policy. JavaScript treats \x00 as an ordinary UTF-16 code unit, so a crafted host like attacker-host.com\x00.google.com matches an allowlist entry for .google.com and is approved. When libc later resolves the hostname via getaddrinfo(), the C runtime truncates at the null byte and dials attacker-host.com instead. Every release from v2.0.24 (sandbox GA on Oct 20, 2025) through v2.1.89 was vulnerable. Anthropic shipped a fix in v2.1.90 on April 1, 2026, with no security note in the changelog, no advisory on the Claude Code page, and no CVE assigned. Exfiltration paths reachable from inside the sandbox include MCP server configs, ~/.claude.json, project source, and anything else the agent could read.
commentary
The sandbox failed open because endsWith and getaddrinfo disagree about whether \x00 is a character. That isn't an exotic bug. The Apache HTTP server fixed the SSL-certificate-null-byte version of it in 2009. Shipping a network policy that's robust against motivated attackers takes engineering. Shipping one quietly takes considerably less.
impact
Arbitrary data exfiltration past the network allowlist for roughly 5.5 months across about 130 published versions. Users who relied on a wildcard allowlist during that window received no advisory telling them to rotate credentials.
The NSA's Artificial Intelligence Security Center released a Cybersecurity Information Sheet titled "Model Context Protocol (MCP): Security Design Considerations for AI-Driven Automation." The document flags MCP's "rapid proliferation [that] has outpaced the development of its security model." It calls out the protocol's inversion of the typical client-server pattern (the server can prompt the client to take actions) and enumerates systemic concerns: trust boundary ambiguity, unverified task propagation, session-replay risk, and serialization issues. It urges "heightened scrutiny" for production deployments, especially in national-security and high-assurance environments.
commentary
When the NSA publishes a Cybersecurity Information Sheet saying your protocol "outpaced the development of its security model," "expected behavior" is probably not the response the rest of the industry wants on file.
impact
Formal government-level acknowledgment that MCP's security model is underdeveloped, naming concrete protocol-design gaps that operators are expected to compensate for.
Mini Shai-Hulud Worm Weaponizes Claude Code and MCP Configs for Persistence #
TeamPCP's Mini Shai-Hulud worm campaign ran through April and May 2026, hijacking npm maintainer accounts and publishing self-propagating malware across more than 600 packages on npm and PyPI. The May 19 wave compromised the atool and prop accounts and pushed 639 malicious versions across 323 packages in Alibaba's @antv data visualization ecosystem in a 22-minute automated burst. Earlier waves hit SAP CAP / mbt (April 29), TanStack (May 11), Mistral AI, Guardrails AI, UiPath, and OpenSearch. Each compromised release ships a preinstall hook that downloads the Bun JavaScript runtime as a living-off-the-land binary, then executes a credential harvester that sweeps cloud tokens, CI secrets, and password-manager vaults. The novel part: the payload reads ~/.claude.json and the host's MCP server configurations, then appends SessionStart hooks to .claude/settings.json so the next time Claude Code opens any project on the machine, the malware re-executes with full agent privileges. Researchers at Akamai, Snyk, Wiz, StepSecurity, and Phoenix Security all confirmed the AI-coding-agent persistence behavior independently.
EX.Afirst supply chain worm to use SessionStart hooks for persistence
commentary
The threat model that produced .claude/settings.json as a hook execution surface assumed nobody would write to it. The threat model that left MCP server config readable assumed nobody would read it. Both held up fine until somebody did both at once with a worm named after a Frank Herbert monster.
impact
Credential theft at scale across GitHub, npm, AWS, GCP, Azure, Vault, 1Password, and Bitwarden, plus self-propagation via stolen npm tokens and live AI-agent re-execution on every Claude Code session. Over 1,197 confirmed compromised repositories within hours of the @antv wave.
TrustFall Puts an MCP Server in a Cloned Repo, and Anthropic Says the Trust Dialog Covers It #
Adversa AI disclosed TrustFall on May 7, 2026. A cloned repository ships two files, .mcp.json and .claude/settings.json. Opening the folder and accepting the generic trust dialog applies those project settings, including enableAllProjectMcpServers and enabledMcpjsonServers, which start an attacker-controlled MCP server as an unsandboxed Node.js process holding the developer's privileges. Alex Polyakov and Sergey Malenkovich reported the same pattern across Claude Code, Gemini CLI, Cursor CLI, and Copilot CLI. Adversa counts it as the third flaw of this class in six months, following CVE-2025-59536.
EX.Ayou clicked trust, so that is the threat model
commentary
Anthropic's position is that consent was obtained, so this sits outside the threat model. The dialog asks whether you trust the files in the folder. It does not mention that accepting starts a program.
impact
Cloning a repository and clicking the trust prompt runs attacker code with full user privileges. The MCP server is not sandboxed, not confined to the project directory, and not restricted on the network.
Pluto Security disclosed a critical (CVSS 9.8) vulnerability in nginx-ui's Model Context Protocol implementation. The MCP integration split traffic across two HTTP endpoints. /mcp handles session establishment and was correctly gated by an IP whitelist and auth middleware. /mcp_message handles tool invocation, including configuration writes and server restart, and shipped with no authentication at all. The default IP whitelist is empty, so the unauthenticated endpoint accepted connections from any address. Shodan turned up over 2,600 publicly exposed nginx-ui instances on the default port 9000. Pluto disclosed in early March 2026, v2.3.4 fixed it, and Recorded Future later listed the CVE among 31 vulnerabilities actively exploited by threat actors in March 2026.
commentary
One MCP endpoint had IP allow-listing and authentication middleware. The other was the one that actually mattered, and it shipped without either. Same project, same PR, same review. The mental model under which /mcp_message doesn't need auth because /mcp already had it is the same one that puts a screen lock on the front camera only.
impact
Unauthenticated remote modification of NGINX configuration, server restart, traffic interception, and administrator credential harvesting. Confirmed exploitation in the wild.
Anthropic MCP SDK STDIO Command Injection (Declined to Patch) #
OX Security disclosed a systemic command-injection vulnerability in Anthropic's official MCP SDKs across Python, TypeScript, Java, and Rust. The STDIO transport invokes a configured command string through the OS shell unconditionally. If the intended MCP binary doesn't exist, the shell still executes whatever command was supplied. OX identified four distinct exploitation families all tracing back to the same root cause, affecting more than 7,000 publicly accessible servers and 150 million package downloads, with an estimated 200,000 vulnerable instances across the ecosystem. Anthropic acknowledged the behavior, declined to modify the protocol, and updated its security guidance to advise that STDIO adapters be "used with caution." The company characterized the existing design as a secure default with sanitization being the developer's responsibility. Downstream CVEs already cluster around the same root cause: CVE-2026-22252 (LibreChat), CVE-2026-22688 (WeKnora), CVE-2025-54994 (@akoskm/create-mcp-server-stdio).
EX.Acritical vulnerability disclosure | expected behavior, by design
commentary
"Sanitization is the developer's responsibility" is a fine policy for printf("%s"). It is a less fine policy for a protocol whose entire pitch is that you can wire up a command string from a config file and have a language model decide when to invoke it. The number of those 200,000 deployers who have read the updated security policy is fewer than 200,000.
impact
Arbitrary OS command execution on hosts running vulnerable MCP servers, with no protocol-level fix forthcoming. Every implementer is now responsible for sanitizing input that the SDK explicitly hands to a shell.
Apache SkyWalking’s MCP Server Lets the Caller Set the Backend URL, and NVD Got There in August #
Qiuxia Fan announced CVE-2026-34884 on the oss-security list on April 13, 2026, crediting Andrea Cosentino. Apache SkyWalking MCP 0.1.0 carries two issues: the set_skywalking_url tool accepts a caller-supplied URL and turns it into server-side requests, and the MCP server passes GraphQL expressions through without adequate sanitization. Users were told to upgrade to 0.2.0. NVD scored the pair 9.8 and published its record on August 18, four months and five days after Apache announced it.
EX.Askeleton waiting on a bench: the nvd record for a 9.8, four months on
commentary
A 9.8 in an Apache top-level project sat on oss-security for four months before the CVE databases caught up. Anyone tracking MCP exposure by watching NVD had an April-shaped hole in their inventory until last week, which is a decent argument for reading mailing lists.
impact
An attacker who can reach the MCP server redirects its backend requests to arbitrary destinations and injects expressions into the GraphQL queries it issues.
Proofpoint's CursorJack: Cursor MCP Deeplinks Let Any Link Claim Any Vendor's Name #
Proofpoint published CursorJack on March 17, 2026, a proof-of-concept from Rachel Rabin, Anna Akselevich, and Stanislav Silberberg showing that Cursor's cursor:// MCP deeplinks work as a delivery mechanism. A deeplink carries a base64-encoded MCP server config; clicking it pops the install prompt, and accepting runs that config's command with the developer's privileges. Two paths work: the command parameter executes locally, and the url parameter points Cursor at an attacker-hosted remote MCP server. The deeplink can also claim any server name it likes, Azure DevOps for instance, and Cursor never verifies the link came from the vendor it names.
commentary
Cursor shipped 1.3 to fix CVE-2025-54133, where the install dialog didn't show command arguments at all. CursorJack landed in March arguing the flow itself was the problem, not how the dialog renders it. Four months later DeepJack hid the arguments again with whitespace padding, which suggests Proofpoint had a point.
impact
One click plus one Approve runs an attacker's command with the developer's privileges. Reverse shells, credential harvesting, lateral movement. MCP-capable IDEs live on workstations holding SSH keys, API tokens, cloud credentials, source code, and production access, which is exactly why they are worth aiming at.
At its core, the article argues that MCP is too token-hungry to be practical at production scale, with tool definitions consuming the majority of context before any user request is even processed. Several major companies are independently abandoning it in favor of lighter-weight alternatives like traditional APIs and CLIs.
EX.Aeveryone who said MCP would be the universal protocol
commentary
"Universal AI protocol" was always going to mean "burn 72% of your context window on tool definitions you'll never use," but I appreciate that we collectively had to spend a year discovering it.
impact
MCP's "universal AI protocol" vision is effectively dead for production use cases, surviving only as a niche tool for desktop/IDE integrations.
Noma Labs discovered the ContextCrush vulnerability in Context7, a registry that delivers coding documentation to AI assistants via an MCP server. Attackers manipulated the platform's Custom Rules feature to plant malicious instructions. When an AI coding assistant (like Cursor or Windsurf) queried the documentation, it ingested the poisoned rules via the trusted MCP channel and autonomously executed harmful actions, such as stealing .env files.
EX.Athe documentation registry's threat model
commentary
Imagine trusting an unauthenticated third-party documentation registry to autonomously execute commands in your dev environment. Couldn't be me. Was probably you.
impact
Widespread credential theft and data exfiltration via third-party documentation poisoning.
MCP TypeScript SDK Routes One Client's Tool Output to a Different Client #
Advisory GHSA-345p-7cg4-v4c7 landed on February 4, 2026 against @modelcontextprotocol/sdk 1.10.0 through 1.25.3, and it is two bugs wearing one CVE. Sharing a single StreamableHTTPServerTransport across concurrent clients lets JSON-RPC message IDs collide, because every MCP client numbers its requests from zero and counts up, so the second client's request overwrites the first client's response mapping and the reply goes down the wrong HTTP connection. Sharing a single McpServer across multiple transports silently overwrites the Protocol object's internal this._transport, which misroutes server-to-client traffic including progress notifications and sampling requests. Both land hardest on stateless deployments that reuse instances across requests. Fixed in 1.26.0. CVSS 7.1.
EX.Ait looks like you're trying to read another client's tool output. need help with that?
commentary
The isolation boundary between two tenants was a counter that both of them start at zero. Sixteen minor releases shipped before anyone noticed.
impact
One user's tool results, progress notifications, and sampling requests arrive on a different user's connection. No attacker positioning required; ordinary concurrent traffic is enough to leak.
BlueRock researchers discovered a severe Server-Side Request Forgery (SSRF) flaw in the MCP server built for Microsoft's MarkItDown file converter. The server failed to validate URIs, allowing attackers to force the AI agent to query local cloud metadata endpoints (e.g., AWS 169.254.169.254). Subsequent scans revealed over 36% of public MCP servers contained similar SSRF vulnerabilities.
EX.Ait looks like you're trying to leak AWS metadata. need help with that?
commentary
36% of public MCP servers shipped with the same vulnerability class. The author of that statistic is being polite. The actionable number is: don't run anything you didn't read yourself.
impact
Exposure of AWS instance metadata, leading to the extraction of access keys, secret keys, and session tokens.
Cyata researchers disclosed a chain of critical vulnerabilities in Anthropic's official Git MCP server. The flaws included an unrestricted git_init function, a path-validation bypass, and an argument-injection vulnerability. Attackers could chain these to turn arbitrary directories into Git repositories, overwrite system files, and achieve RCE via malicious .git/config manipulation.
EX.Agit_init · path validator · arg parser, on disclosure day
commentary
CVSS 8.1 in the official server. Not a dodgy third-party one. The shipped-by-the-company-named-after-the-protocol one.
impact
High-severity (CVSS 8.1) arbitrary file deletion, file overwriting, and RCE.
Cymulate disclosed two high-severity defects in Anthropic's official Filesystem MCP Server. Attackers exploiting these flaws could list, read, or write to directories outside the allowed scope. If the server was run as a privileged user, this could lead to full sandbox escape, manipulation of critical system files, and privilege escalation.
commentary
"Allowed scope" was never going to survive contact with a model that's also been instructed to be helpful, accommodating, and never refuse a tool call.
impact
Unauthorized host filesystem manipulation and sandbox escape.
Oligo Security and Tenable discovered a critical flaw (CVSS 9.4) in the Anthropic MCP Inspector tool. Because the interactive web UI launched via localhost lacked out-of-the-box authentication, an attacker on the same local network could inject malicious commands (NeighborJacking) or use cross-site attacks to achieve RCE.
EX.Ame reading "localhost doesn't need auth" in 2025
commentary
The default debugging tool from the maintainers of the protocol shipped without authentication. The threat model, quoted: "it's localhost." Localhost has been a hostile network since the invention of coffee shop Wi-Fi.
impact
Arbitrary code execution via local network hijacking.
The JFrog Security Research team discovered a critical vulnerability (CVSS 9.6) in mcp-remote, a popular proxy tool (over 437,000 downloads) used to connect local LLM hosts to remote MCP servers. If a user connected to a malicious remote MCP server, the server could send a booby-trapped authorization_endpoint URL that achieved full arbitrary OS command execution on the user's local machine.
commentary
437,000 downloads. A booby-trapped authorization_endpoint URL. Full RCE on the client. The MCP supply chain isn't a chain so much as a single rusted carabiner.
Work management platform Asana had to temporarily disable its experimental MCP feature after discovering a logic flaw in its implementation. The misconfiguration failed to isolate cross-tenant data, meaning AI agents could potentially access customer data, projects, and tasks belonging to entirely different organizations.
impact
Unauthorized exposure of customer data to other organizations.
A severe vulnerability (CVSS 8.8) dubbed AgentSmith was disclosed in LangSmith's Prompt Hub. The flaw exposed AI agents using MCP to data theft and manipulation, allowing malicious agents to hijack LLM responses and steal user API keys.
commentary
Naming your vulnerability after the bad guy from The Matrix doesn't make it cooler than "forgot to scope an API key." But points for effort.
Security researchers at Invariant Labs discovered a critical vulnerability affecting the official GitHub MCP integration. Attackers could create maliciously crafted issues in public repositories. When a developer asked their AI assistant to check open issues, the AI would read the malicious payload, get prompt-injected, and autonomously use the developer's credentials to exfiltrate private repository data (such as source code and salary information) into public pull requests.
EX.Aevery dev reading this and quietly revoking their AI assistant's repo scope
commentary
The AI was helpfully reading the issue. The issue was helpfully telling it to leak code. There's no patch for "documentation can be lies." That's the entire reading-the-internet problem condensed into one CVE.
impact
Exfiltration of private repository data including source code and sensitive information.
pyprojectdependency and pinning the MCP server that dependency starts are the same problem, and only one of them had a written policy.