Top MCP security resources — October 2026

What it is

This roundup carries specific technical details beyond the existing summary for several items: the fixed versions for the MCP Python SDK OAuth flaw, specific CVE/exploitation chains for LiteLLM, concrete attack success rates for A2M, and a detection methodology for indirect prompt injection in MCP servers.

How it works

• MCP Python SDK OAuth fallback (Cycode): A malicious server returns a 404 to the discovery request, forcing the client into a legacy OAuth fallback that skips issuer validation, leaking client secrets, authorization codes, and PKCE verifiers to attacker endpoints. Fixed in 1.30.0 and 2.2.0.
• LiteLLM chain: CVE-2026-59822 (invalid bearer token accepted) combines with CVE-2026-59821 (custom code guardrails allow admin code execution) and pass-through endpoints reaching cloud metadata. The page adds that 9.6% of exposed proxies still accept the default sk-1234 master key, turning this into a pre-auth-to-cloud-compromise chain.
• Obot gateway bypass: the deny list blocks /mcp-connect/ (trailing slash) but not /mcp-connect-composite/, letting any authenticated basic user reach restricted MCP servers. Advisory recommends switching to an allowlist.
• A2M agent hijacking: two-stage black-box attack — optimize tool metadata so agents pick the malicious tool (93.6% invocation rate), then refine adversarial tool returns from execution traces to drive exfiltration or reasoning derailment (74.4% success). Transfers across models.
• No-box prompt injection detector: using only registration-time tool metadata (no code access), an analyzer recovered 94 of 95 verified vulnerable tools across 20 deployed MCP servers, vs. 84.2% recall for an LLM baseline.
• Fragmented injection: splitting one injection across tool descriptions, tool results, and sampling messages exfiltrates credentials at up to 100% from models that resist single-channel injection; missed by seven MCP security tools tested, and VS Code's MCP sampling allows a system prompt override.

Preconditions / Affected

• MCP Python SDK consumers on versions before 1.30.0/2.2.0.
• LiteLLM deployed as MCP/model gateway, especially with default master key still set.
• Obot gateway deployments relying on the deny-list fix for GHSA-vw82.
• Any MCP client accepting sampling messages or tool results as trusted input (fragmented injection).

What to do

• Update MCP Python SDK to 1.30.0 or 2.2.0.
• Patch LiteLLM and change the default sk-1234 master key.
• Replace Obot's prefix-based deny list with an allowlist.
• Add reauthorization inside each tool (not just at the gateway) so a single bypass doesn't cascade.
• Treat MCP config files as credential stores: move secrets out of them (82,000-config scan found 12% of credential slots hardcoded, 55% of those in a shape that evades gitleaks/GitHub scanning).

Caveats

A2M and the fragmented-injection results are reported success/evasion rates from the source research, not independently verified by Adversa AI. The no-box detector's 94/95 figure applies to its own 20-server test set, not a general guarantee.