model context problems

Concurrent users of a shared-instance HTTP MCP server receive each other's tool results, progress notifications and sampling requests. No attacker positioning is required, only ordinary concurrent traffic.

An unauthenticated caller who can reach a Streamable HTTP server sends one oversized body, or one deeply nested tool argument under the size limit, and the process dies with a heap out-of-memory error. Stdio deployments are unaffected.

Any MCP client, or any injected prompt that reaches one, runs arbitrary commands as the server user, with none of the approval prompts the whitelist exists to trigger.

The hook sold as the guardrail between an injected agent and the filesystem passes web shells and scripts through, as long as an innocuous field comes first in the call.

Three of the eight need no credentials at all: a token minted out of Unla's OAuth2 server, NullHub's management API, which configures agent instances, provider credentials, cron jobs and MCP servers, and the memory exhaustion in mcp-go. The other five are ordinary users reading or revoking things that belong to other tenants.

Prompt-injected agents bypass read-only gates, delete Argo CD repositories, read `.env` files off disk and reach cloud metadata endpoints, and an on-path attacker collects mcp-remote's OAuth client secret along with its access and refresh tokens.

Any authenticated JeecgBoot user collects the MCP endpoints the platform talks to and the tokens it authenticates to them with.

118 of the 273 open-source MCP servers tested carry at least one tool that does not enforce the input contract it advertises, and 343 individual tools do not. The paper is a preprint and has not been peer reviewed.

The configured destination receives a live Splunk platform token belonging to whoever invoked the tool, and can use it for that user's data and actions.

An authenticated client reaches tools the operator removed from the allow-list and methods the webhook would deny, at whatever rate it likes, and the audit log shows nothing useful afterwards.

Six listed MCP servers can be taken over by anyone willing to pay a domain registration fee, and agents still configured against them will keep connecting and sending whatever they were going to send.

One opened link gives an attacker a persistent API key carrying the victim's access to the Obot API, the LLM gateway and every MCP server behind it. If the victim is an admin, so is the attacker.

Anyone able to reach the prompt reads arbitrary files as the user running the server, SSH private keys and cloud credential files included.

A third origin the client is redirected to receives the custom headers of whichever request was redirected, and on a 307 or 308 that request's body too. On a transport request that means an API key and the session header; on an OAuth token request it means a refresh token or client secret. Separately, a server whose own token verifier does not check the `aud` claim accepts tokens issued for any other service behind the same authorization server.

On IATO MCP and WDS MCP Content Manager, low-privileged WordPress users reach MCP plugin functions their role does not grant, and on WDS there is nothing to upgrade to. Mindio Magic MCP is a Subscriber-level data exposure, which is as specific as its record gets.

Any file the server process can write gets overwritten, and any file it can read gets pulled into a presentation. The attacker needs no credentials of their own, only content the agent will act on.

A developer who opens the wrong page while running the dev server hands that page's operator their project file paths, route list and fragments of its source.

Anyone who can reach the endpoint grows the server's memory until it dies, either with one oversized body or with a stream of ordinary short requests that each leave a session behind. Only a restart clears the second one.

On a site running the ByteCoreStack connector, anyone who can register as a subscriber takes the site. The other three turn the lowest roles that can log in into file deletion or access to data they were never granted.

An OpenClaw operator issued a read-only token invokes state-changing MCP tools, which is the entire distinction the two scopes exist to draw.

An attacker who gets a ToolHive user to open one link receives an authorization code minted against that user's upstream identity, and trades it for the victim's access to the MCP servers behind the proxy.

An attacker on the same network reaches an unauthenticated REPL that executes arbitrary JavaScript as the Penpot server process. The original disclosure demonstrated reading /etc/passwd, spawning shell commands, and dumping environment variables holding database credentials and API keys. Through the WebSocket bridge the same caller impersonates the browser plugin, reads plugin task payloads including code and file contents, and returns forged responses.

An attacker who gets a logged-in administrator to load a crafted page creates a new administrator account. Separately, any Contributor rewrites or deletes site-wide workflow configuration including workflows an administrator built, and reads the title and publication status of every private, draft, pending and scheduled post, page and custom post type on the site.

An authenticated administrator reads .log, .jsonl and .json files from outside the configured log directory.

An MCP-scoped token reaches actions it was never granted. Under the race, one user's MCP search returns results resolved in another user's context.

A user holding the lowest publishing role on the site reaches plugin functionality or data the plugin meant to restrict. Patchstack does not say which.

Anyone who registers a MetaMCP account runs commands inside the application container. An unauthenticated caller reads active session IDs and then drives another tenant's private MCP tools using that tenant's own forwarded credentials. Only VoiceMode had a fixed release on the day, in 8.10.2.

An authenticated ToolHive user who learns another user's MCP session ID reads that session's responses, writes into it and kills it. Several of the authorization policies an operator configures are reachable around rather than through.

An unauthenticated attacker plants content in the knowledge base a payments agent reads, and IBM states the result can be unauthorized payment actions or exfiltration of payment data.

A semi-trusted client or a prompt-injected agent writes to GitLab projects the operator believed were read-only, and to projects outside the configured allow-list, using the server's own token. Separately, anyone can hold the server's session pool closed for an hour with tokens they invented.

Any authenticated user holding only the Basic role connects to MCP servers they were never granted, calling their tools and reading their data through the composite gateway route.

One application's credentials enumerate every organization's user records, including email addresses and password salts, and can create, modify, or delete administrator accounts in any organization on the instance.

A single unauthenticated HTTP request executes arbitrary commands on the gateway host. JFrog's guidance is to treat any instance that ran with authentication disabled as compromised and to rotate virtual keys and provider credentials.

A URL arriving through prompt-injected content reaches internal HTTP services and returns their responses as markdown. On a host behind a DNS64/NAT64 gateway, which is the normal arrangement in IPv6-only AWS subnets, that includes 169.254.169.254 and whatever IMDSv1 answers without a token.

An application that passes a user-supplied session ID into `resume` hands the caller command execution on the host running the agent, with the SDK's approval prompts skipped entirely.

A channel participant who was never the owner installs plugin code and gets a host process of their choosing executed with the agent's privileges. On the permission-prompt finding, they answer the consent dialog that exists to stop exactly that.

Whoever registers the predictable bucket name first receives the private source archive of each scanned workspace, including credentials and infrastructure state contained in it.

An unauthenticated request points an autonomous coding agent at any path on the host, and the agent's ordinary tools then read SSH keys, AWS credentials and .env files or write to shell profiles and cron for persistence. Four of the six advisories list no patched version.

Crafted SQL reaching the server in its default read-only mode executes operating-system commands on a self-managed PostgreSQL host at the privilege level of the database process.

An unauthenticated attacker who can reach the gateway takes administrative control of it, and through it the registered MCP servers and the credentials the gateway holds on their behalf.

Every recognised tool call sends a raw wallet private key in a header to a third-party endpoint. Anyone who configured the package should treat that key as spent.

An operator who configured OIDC and created workloads through the API was serving those MCP servers to anyone who could reach the proxy, with no token validation at all.

An unauthenticated caller who reaches a shared MCP project endpoint gets code execution and access to other users' sessions. Any authenticated user can reach a shell through the MCP Tools component regardless of the two settings that exist to prevent it.

An authenticated Rowboat user maps the internal network from the server side and reaches cloud metadata endpoints through the custom MCP server and webhook fields.

A page the user happens to visit drives the browser automation tools the bridge exposes, which covers executing scripts, reading page content and taking screenshots.

A caller who is only supposed to be able to SELECT writes to the database on one server, and reads arbitrary files off the database host on the other.

Before 1.0.0, an MCP client talking to a secure-mode mcp-shell reads arbitrary files and executes arbitrary binaries through whichever allowlisted program the current bypass runs through.

An unauthenticated caller makes an OGX server request any internal address, including `http://169.254.169.254/`, and has it forward attacker-supplied headers and authorization tokens to whatever answers.

One unauthenticated POST with chunked encoding crashes the JVM hosting an MCP server. A hostile server crashes any client that connects to it. Neither bug yields code execution or data.

Attackers reaching an unpatched LiteLLM proxy list and invoke every configured MCP tool and the services behind them with no valid credential. Wiz recorded post-exploitation tuned to AI infrastructure, including reading the LiteLLM master key out of process memory because it is never written to disk.

An authenticated low-privilege ContextForge user reaches internal network targets through two separate SSRF paths, and a developer-privileged one reads the gateway's environment variables and mints admin tokens from the signing key it finds there.

Any authenticated non-admin reads other users' tool calls including the secrets inside them, streams and wipes the system logs that would show it happening, and makes the hub issue blind requests to internal addresses.

An authenticated runZero user who knows or guesses another organization's UUID reads that organization's Findings summaries. Nothing can be modified.

A page the developer visits issues cross-site requests to their local ash_ai MCP server and gets them accepted, with whatever tools that server exposes.

An attacker who takes over the referenced upstream repository executes code on every host that installs that catalog entry.

Any client that can reach the port executes Python on the ToolUniverse host or drives the Telnyx tool surface. Neither requires a credential.

A page in the victim's browser resolves its own hostname to 127.0.0.1 and talks to the locally bound MCP server through them, reaching a tool surface that treated the loopback bind as the access control.

A tool argument or a proxy header reaches loopback, private ranges, and cloud metadata endpoints, and the response comes back into the model's context.

A fetch target supplied through a tool argument reaches loopback and private addresses, and the response is returned into the model's context.

An attacker who gets a signed-in Coroot user to open one link captures their authorization code and takes over the session.

An unauthenticated caller who can reach the sandbox server executes arbitrary commands with the privileges of the process that was supposed to be containing them.

Anyone who can reach the port drives a debugger that is already attached to processes on the host, which is arbitrary code execution with a user interface.

An MCP caller with read access discloses SiYuan's publish-access configuration and metadata, which the advisory says should be treated as sensitive.

An agent steered into calling check_syntax or run_playwright_test on an attacker-chosen path executes arbitrary OS commands with the developer’s privileges.

An unauthenticated remote attacker exhausts the memory of a Spring AI MCP server and takes it down for every legitimate client.

An unauthenticated client kills a Java MCP server with one chunked body. A hostile MCP server kills its clients by never finishing an event, at almost no cost to itself.

An admin-role Splunk user escapes the application entirely and runs commands on the host operating system.

An authenticated non-admin gets remote code execution as the MCPHub process owner, which in the documented deployments is root, and short of that reads and executes across every other tenant's connected servers.

Code execution on a machine running an affected PyCharm, reached through the bundled Jupyter MCP tools without authenticating to them.

Any MCP server a PHP client connects to can crash that client on demand, with no authentication and no earlier signal the client could act on.

Any file the SiYuan kernel process can read, including SSH keys and credential files, gets copied into the workspace and served as a notebook asset.

An operator who approved the server after reading its tool definitions gets a different tool set on the fourth call, aimed at whatever credentials the agent's host can reach.

Anyone who can reach the port drives the full Argo CD tool surface with the operator's stored token: create applications, point them at attacker-controlled manifests, and sync them into the destination Kubernetes cluster.

An authenticated MCP caller reaches anything the Grafana host can reach and reads the response, with full control of method, path, and body.

A crafted link opened in the victim's browser runs JavaScript on the localhost origin that serves the MCP endpoint, reaching diagram sessions and API data held there.

Anyone who can reach the ports reads the phone's screen and UI tree, then taps, types, and launches apps on it. No credentials, no user approval, and no cooperation from the model.

SSH keys, environment variables, proprietary source, and customer data leave through a tool call the model reads as a form. Results depend on the client: GPT-5.4 runs the attack 90 percent of the time under Cursor and 0 percent behind Claude Code.

Each finding is small on its own. The batch is a census of the long tail: several projects never responded to the report, several ship rolling releases with no version anyone can pin, and some fixes exist only as unversioned commits.

Broker credentials and OAuth tokens go to whatever hostname reaches the model's context. DocumentDB deployments running in read-only mode accept writes through the aggregation pipeline.

An authenticated SiYuan MCP client reads and deletes arbitrary files the kernel process can reach, exfiltrates stored API secrets through unprompted GET requests, and reads publish-mode passwords in cleartext.

One click from a logged-in admin creates a second admin under attacker control. That is full site takeover from a link, with no prior access.

Not a single vulnerability but a population measurement. OAuth is absent from 91.8% of the servers audited, and 687 tool instances expose shell execution with no access control at all, across a set of servers that turns over every few days.

Command execution and host file access for any authenticated user, plus an auth bypass on an endpoint that is on by default. The IDE config write is the one that travels: a Langflow host ends up registering attacker-chosen MCP servers in a developer's editor.

Unauthenticated tool invocation, cross-application token reuse, SSRF into internal networks, dataset allowlists that quietly stop applying, and a single oversized request that ends the process.

On a default unauthenticated Flowise deployment, a Custom MCP server definition installs and runs an attacker's npm package. Separately, the SSRF guard covering MCP server URLs can be pointed at cloud metadata and internal services.

An authenticated Flowise user runs arbitrary commands on the host and takes over the application.

Anyone who can reach port 3001 on a default Ruflo install executes arbitrary shell commands, reads and rewrites the platform's persistent AI memory, exfiltrates the LLM API keys the platform brokers, and takes over every agent it manages. The docker-compose default meant that reach was `0.0.0.0`, not `127.0.0.1`.

Two of HashiCorp's flagship MCP servers, in the same 24-hour window, hand their configured backend addresses or their session-bound credentials to whichever HTTP request asks. The Consul session-mixup is the same defect people spent 2003 fixing in web frameworks; the CVSS is 10.0 because the mixed-up thing is a Consul ACL token in an enterprise deployment.

The specific attack surfaces that produced Asana's cross-tenant leak, the mcp-remote command injection, and the string of session-hijack advisories catalogued elsewhere on this site are, per the release notes, no longer part of the spec. What arrives in their place is a stateless HTTP protocol with two custom routing headers, which is a category of design that has produced request-smuggling and header-desync bugs in every previous incarnation.

One malformed JSON-RPC message from an unauthenticated client crashes GitHub's official MCP server. Every agent connected to it loses its tooling until the process comes back.

Arbitrary code execution in the MCP server process, reachable over the network without authentication on a default configuration.

Every configured deny and gate rule stops applying, silently, until someone restarts the process. Indirect prompt injection can then drive the mutating AWS CLI commands the operator explicitly blocked, with IAM on the credentials as the only control left standing.

A user who can create or edit a workflow points the server at internal or blocked hosts and reads the responses back out through the workflow.

A contributor to any single project in an Azure DevOps organization writes hidden text into a PR description and steers a victim's AI reviewer into reading and returning data from projects the contributor was never authorized to see. The exfil channel is whatever comment or artifact the agent posts back on the poisoned PR.

A URL a developer thought they were asking their IDE to summarize gets code execution on the developer's machine with the developer's own privileges. Anything reachable from that shell is reachable to the attacker, including cloud credentials, source trees, and the local git and npm identities the developer signs commits and releases with.

An AI coding agent asked to find an MCP server or Skill returns an attacker's repository as a legitimate option and walks the developer through installing it. On install, SmartLoader lands and pulls StealC, which harvests credentials, tokens, cookies, and session material from browsers and developer tooling. The exposure scales with the agent, not the developer, because the agent is the discovery layer.

Any authenticated Onyx user with basic access reads other users’ OAuth Authorization headers for their connected MCP servers and impersonates them against those upstream services.

An authenticated user loads an njs module or sets `user root` through the MCP tools, which is code execution as root on the official image, and does it without the OTP step-up the web interface demands for the same change.

Read the cluster token out of one tool call and come back as root. Skip that entirely and an ordinary MCP-allowed user still has arbitrary JavaScript execution, because the permission checks are decorative.

One click and one Approve on a link that looks like a code review installs the attacker's MCP server and runs its command unsandboxed. That reaches SSH keys, cloud credentials, live session tokens, browser cookies, source code, and anything else the developer's account can touch, plus a path straight into CI.

An unauthenticated attacker reaches code execution on the Langflow host through the MCP stdio launcher. Every 1.x release up to 1.10.1 is affected.

A remote authenticated caller who reaches the HealthLake MCP tool gets the server to POST its own temporary AWS credentials to an attacker-controlled URL. Those credentials scope to whatever role the MCP server assumed when it started, which on a HealthLake deployment reaches every FHIR record the role can see.

An authenticated MCP client, or an agent acting on injected instructions, reads any file the server process can read and uploads it to Confluence. On Linux that includes `/proc/self/environ`, which carries the server's own credentials and API tokens.

An attacker primes the shared cache so another user's query returns a response prepared for a different one, points the quality tools at a lookalike host, and reads upstream content, internal hostnames, and database errors out of the error text.

Any prompt or tool response that reaches the agent and coaxes it to open `../../etc/passwd`, `~/.ssh/id_ed25519`, or any other file readable by the server process gets that file's contents, past whatever directory scoping the operator thought they had configured. The write path has the same missing check, so a poisoned prompt can also overwrite files outside the intended workspace.

The paper does not disclose a new vulnerability. It puts numbers on a claim that has been anecdotal for the last six months: the median public MCP server ships with at least one taint-style bug, and the median maintainer has not shipped a fix.

An attacker with a session ID runs tools as the victim, and the victim reads the output as legitimate. Separately, one unauthenticated POST takes down a Ruby MCP server, and any web page can drive a developer's localhost server through their browser.

An authenticated caller with reach to the metrics-service endpoint reads every row the metrics database holds, including the stored API keys the registry uses to broker calls to downstream MCP servers, then deletes or alters records at will. The registry's whole reason to exist is being the trusted broker in front of a fleet of MCP servers; the SQL injection turns that broker into a credential dump.

An MCP server whose only intended reach was the public Wikipedia HTTP endpoint becomes an unauthenticated outbound fetcher for any URL an attacker can convince the agent to pass in. On a cloud host that is enough to reach the instance metadata service, cluster DNS, and internal admin endpoints the agent's network position happens to include.

One token reads and writes every vault the server is configured with. A page the user visits reaches the loopback transport. The default ACL allows every path, including the `.obsidian` directory where plugin secrets are stored.

An unauthenticated remote HTTP client with network reach to a `fast-mcp-telegram` HTTP endpoint impersonates the default Telegram account any time that account's session file lives at the documented default path. From there the caller drives every account-prefixed MCP tool as the default user, which for a Telegram bridge covers reading and sending messages, listing chats, and shipping attachments.

An approved third-party MCP tool can be turned into an exfiltration channel by rewriting its description, and every enterprise Copilot tenant that leaves the default `Allow all` MCP configuration on picks up the poisoned version without any re-approval. The advisory applies to Microsoft 365 Copilot, Copilot Studio, and Azure AI Foundry agents that can send email, create files, change calendars, query business systems, or run multi-step workflows.

A malicious MCP server collects access tokens issued for a different server and impersonates the user against it, or drives the client into fetching loopback and RFC 1918 addresses from inside its network. Separately, an unauthenticated caller exhausts a Streamable HTTP server's memory.

Any organization exposing an unpatched SimpleHelp RMM to the internet could have its technician session hijacked with a forged OIDC token, then have a developer machine's MCP configuration harvested along with the usual cloud, source-control, and wallet material. Because MCP configs carry the tokens the developer's own agent uses, the stolen material grants the attacker the same downstream reach the agent already had into repos, databases, cloud accounts, and internal APIs.

Anyone who clones a repository, opens it in VS Code with Amazon Q installed, and is connected to their cloud session executes whatever the repo's `.amazonq/mcp.json` told MCP to run, attached to their live AWS credentials, with no further interaction. The chained symlink bug bumps the same workspace-open into arbitrary file writes outside the trust boundary.

A tool argument reaches an outbound HTTP client with no destination policy, so the server fetches internal services and cloud metadata endpoints on the caller's behalf and returns what it gets.

Anyone with read access to Satellite's container logs, or to any sink those logs were forwarded to, harvests session IDs that are themselves the bearer credential. Replaying them produces hijacked administrative sessions on a Satellite instance and, through it, infrastructure-wide code execution against the hosts it manages.

Clone a malicious repository and the agent runtime launches the attacker's MCP servers running the attacker's commands. The approval gate does not intervene, because the config that defines the gate is the thing being replaced.

Anyone running `npm install` against an `@mastra/*` version in the 88-minute window received a credential harvester running inside their developer or CI/CD environment. The blast radius covered every consumer of the framework's MCP client and server packages; Mastra advised treating any affected install as fully compromised and rotating every credential the host had touched, including cryptocurrency wallet seeds.

Anyone with a public Sentry DSN can plant a single error event that exfiltrates AWS keys, GitHub tokens, Sentry auth tokens, git credentials, and private repo URLs from the developer's machine through the Sentry MCP triage path. Every step in the chain is authorized, so EDR, WAF, IAM, VPN, and Cloudflare see nothing to block.

Arbitrary local file read for anything the server process can open, with the contents returned to the caller and a copy sent to Google along the way.

Developers searching PyPI for an MCP integration could land on a wheel that dropped a credential harvester at install time. Targeted material includes GitHub tokens, npm and PyPI publish keys, AWS, GCP, Azure, Kubernetes service-account material, SSH keys, Docker config, shell history, `.env` files, and AI developer tool configuration including `~/.claude.json`. PyPI removed the artifacts after Socket reported them, but any install that ran during the window should be treated as compromised.

Any LiteLLM caller holding an ordinary API key, down to a low-privilege internal-user key, runs arbitrary commands on the proxy host. Observed in the wild delivering cryptominers through configurations crafted so the connection test still looked successful.

Any repository running the action with a `[bot]`-authored triage workflow could be coaxed into leaking its `ANTHROPIC_API_KEY`, OIDC token, and other workflow secrets, then accepting attacker-authored commits. Because `anthropics/claude-code-action` itself ran the vulnerable workflow, a successful compromise of the action's own repo would have flowed to every downstream consumer.

Script execution in the authorization server origin, which means the victim's session and account takeover. Separately, tokens with no signature accepted by a server whose job is checking signatures.

An unauthenticated remote caller uploads content into the memory store, reads stored documents back out, and deletes them. The API key the operator configured has no effect on any of those routes.

Opening a cloned repository in Claude Code and invoking the visualization tool executes that repository's Python with the developer's privileges.

auth-fetch-mcp returns responses from loopback services its guard was written to block. jshook maps internal addresses, reachability, latency, and routes from the server's network position even when private-network access is disabled globally.

Pre-v3.6.0 deployments let any reachable client invoke arbitrary `kubectl` tools regardless of the configured restriction policy. Pre-v3.7.0 deployments let prompt-injected pod logs harvest the operator's kubeconfig bearer token, which then replays directly against the real cluster's API server.

Any caller who can reach the server invokes Meta Ads tools with the operator's credentials. Provoke an API error and the response hands back the long-lived access token itself.

Arbitrary data exfiltration past the network allowlist for roughly 5.5 months across about 130 published versions. Users who relied on a wildcard allowlist during that window received no advisory telling them to rotate credentials.

Formal government-level acknowledgment that MCP's security model is underdeveloped, naming concrete protocol-design gaps that operators are expected to compensate for.

Credential theft at scale across GitHub, npm, AWS, GCP, Azure, Vault, 1Password, and Bitwarden, plus self-propagation via stolen npm tokens and live AI-agent re-execution on every Claude Code session. Over 1,197 confirmed compromised repositories within hours of the @antv wave.

Cloning a repository and clicking the trust prompt runs attacker code with full user privileges. The MCP server is not sandboxed, not confined to the project directory, and not restricted on the network.

Unauthenticated remote modification of NGINX configuration, server restart, traffic interception, and administrator credential harvesting. Confirmed exploitation in the wild.

Arbitrary OS command execution on hosts running vulnerable MCP servers, with no protocol-level fix forthcoming. Every implementer is now responsible for sanitizing input that the SDK explicitly hands to a shell.

An attacker who can reach the MCP server redirects its backend requests to arbitrary destinations and injects expressions into the GraphQL queries it issues.

One click plus one Approve runs an attacker's command with the developer's privileges. Reverse shells, credential harvesting, lateral movement. MCP-capable IDEs live on workstations holding SSH keys, API tokens, cloud credentials, source code, and production access, which is exactly why they are worth aiming at.

MCP's "universal AI protocol" vision is effectively dead for production use cases, surviving only as a niche tool for desktop/IDE integrations.

Widespread credential theft and data exfiltration via third-party documentation poisoning.

One user's tool results, progress notifications, and sampling requests arrive on a different user's connection. No attacker positioning required; ordinary concurrent traffic is enough to leak.

Exposure of AWS instance metadata, leading to the extraction of access keys, secret keys, and session tokens.

High-severity (CVSS 8.1) arbitrary file deletion, file overwriting, and RCE.

Unauthorized host filesystem manipulation and sandbox escape.

Arbitrary code execution via local network hijacking.

Full system compromise and RCE on the client OS.

Unauthorized exposure of customer data to other organizations.

Credential theft and LLM manipulation.

Exfiltration of private repository data including source code and sensitive information.