Top MCP Security Resources — September 2026 (Adversa.ai)

What it is

Adversa.ai's September 2026 roundup, eight items, anchored by Deadbugz — an active MCP supply-chain campaign — plus three August MCP-server CVEs, a large-scale exposure audit, and three defense writeups. The summary names all of these; what follows is the version boundaries, mechanisms, and detection procedures it omits.

The three CVEs (with fix versions)

• CVE-2026-73498 — Atlassian MCP path traversal. The confluence_upload_attachment tool passes a client-supplied path straight into open(file_path, 'rb') with no validation, giving any authenticated client an arbitrary file read across everything the server process can reach; the advisory names credentials and environment variables explicitly. CVSS 7.7, changed scope. Fixed in v0.22.0.
• CVE-2026-67357 — ArcadeDB MCP cleartext cluster token. A settings tool returns the HA cluster token in cleartext; that token impersonates root via specific headers, so MCP access converts directly to full server compromise. CVSS 7.7. Fixed in 26.7.3.
• CVE-2026-19956 — facebook-ads-mcp-server SSRF. fetch_pagination_url lets an authenticated remote user drive requests from the server's network position. CVSS 5.3, fixed in a single commit.

All three are classic web flaw classes with no model involvement — MCP servers picking up ordinary network-service bugs.

Audit numbers worth acting on

The "Exposed by design" assessment ran 34 test modules across ten MCP vulnerability classes. Beyond the headline (68 vulns across 414 audited of 640 confirmed servers, 91.8% with no authentication): 687 tool instances exposed shell execution with no access control, and 41.6% of servers vanished within three days between runs — the population is ephemeral, so point-in-time scans miss most of it. The tooling has been released.

What to do

The page's central operational argument: one-time review is structurally insufficient against Deadbugz-style servers that behave for exactly three tool calls, then rewrite returned metadata into instructions hunting SSH keys, AWS credentials, shell history, and Kubernetes config.

• Monitor tool metadata for drift after approval. If your MCP client caches tool definitions, compare them on every reconnect and alert on any change — auditing once at approval time will not catch payloads that only turn hostile at runtime.
• Fingerprint MCP traffic without decrypting it. MCP rides inside ordinary encrypted traffic but announces itself with a protocol-version header; a network layer can detect it without terminating the session, turning shadow MCP visible and letting policy block connections that skip an approved portal.
• Put an authorization layer in front of servers. The Oracle ORDS + Keycloak walkthrough is a working template: validate issuer, audience, JWKS signature, and a mandatory scope, then bind a realm role to a specific database pool so the role decides which backends the agent reaches at all. A compromised agent then inherits a narrow surface.
• Deadbugz IOCs are published: the endpoint, the local artifact path, and the repository.

Caveats

• The Keycloak walkthrough notes that relaxing the IdP's client-registration policy to permit MCP dynamic client registration is a demo-only move, not production guidance.
• WriteGuard (four risk tiers, deny-by-default allow list, agent/session attribution) is a private beta — treat its numbers with caution; the tier taxonomy and attribution requirement are the transferable parts.
• The page is explicit that whether an authorization layer holds against a genuinely hostile server is unresolved — MCP red teaming is how you'd answer it.