30+ MCP CVEs in Two Months: What the Early-2026 Vulnerability Wave Means for Your MCP Supply Chain

What it is

CVE-2025-6514 — a CVSS 9.6 remote-code-execution flaw in mcp-remote, the bridge proxy that lets local-only MCP clients (Claude Desktop, Cursor, Windsurf) reach remote MCP servers over HTTP. Disclosed by JFrog in July 2025, it is the worst of the early-2026 wave and, JFrog says, the first documented full RCE against an MCP client in the wild.

How it works

During connection setup mcp-remote performs OAuth discovery and reads the authorization_endpoint URL from the remote server's metadata — a value fully attacker-controlled when connecting to a malicious or compromised server. It passed that URL into the open package, which shells out to launch a browser. Shell metacharacters ($(...), backticks, PowerShell subexpressions) in the URL executed as OS commands on the connecting machine. Full command control was demonstrated on Windows via PowerShell subexpression injection; narrower but still dangerous on macOS/Linux. No tool was poisoned and no prompt injected — the flaw was a trust decision (auto-open whatever URL the remote hands you) baked into connection setup.

Preconditions / Affected

Versions 0.0.5 through 0.1.15 are vulnerable. The fix, 0.1.16 (June 17, 2025), stopped shelling out to attacker-influenced strings. At disclosure the package had ~437,000 downloads, each one untrusted-server connection away from compromise. Exploitation requires the client to connect to an attacker-controlled or compromised MCP server.

What to do

• Pin/verify the mcp-remote (or equivalent gateway) version — treat "which gateway version fronts the deploy tools" as a line in your bill of materials. Upgrade past 0.1.15.
• Apply the NSA CSI recommendations (U/OO/6030316-26, May 20 2026): zone components so a compromised server can't reach everything; vet servers with scanner tooling before deploy; log every invocation with cryptographic hashes of results; route traffic through filtering egress proxies.
• Verify registry auth before trusting discovery — as of Feb 2026, 41% of official-registry servers (518 scanned) had zero authentication; an Astrix survey of ~20,000 servers found only 8.5% using OAuth, 53% on static API keys; Trend Micro found 492 servers exposed on the internet with no auth.

Scope of the wave (supporting numbers)

The distribution did not improve with maturity. An April 2026 rescan of 1,808 servers found 66% still had ≥1 finding on the same 43/20/13/10 vector split; a scan of 2,614 implementations found 82% vulnerable to path traversal and 67% exposing code-injection-open APIs. A May 2026 systemic advisory on MCP's stdio transport counted 7,000 vulnerable servers on public IPs across 150M+ package downloads, with same-day disclosures against Apache Doris, Alibaba RDS, and Apache Pinot MCPs (SQL execution, metadata exfil, instance takeover). The Atlassian server CVEs carry CVSS 9.1 (CVE-2026-27825) and 8.2 (CVE-2026-27826), chainable to unauthenticated RCE on local networks.

Caveats

The NSA's own framing is the limit: MCP's security is "highly dependent on implementation discipline rather than protocol guarantees" — authorization is optional, there is no protocol-defined RBAC, and audit logging exists only where implementations produce it. Roadmap items (structured audit events, standard discovery, richer auth) do not retroactively secure a proxy already deployed. The closing pitch for Bex.co (self-hosting) is vendor content, not a finding.