Skip to content

58 results for “MCP”

ListGrid
What you seeeverything
RecentOldestAddedA–Z
All types505Repos149Articles109Threads63Advisories58Write-ups48Papers38
Tools25Other6Courses5Talks4
🚨 Advisories“MCP”Clear all
modelcontextprotocol.ioadvisory🧠 AI

MCP spec 2026-07-28 changelog (stateless protocol, MRTR, Sampling/Roots deprecated)

Official changelog for the Model Context Protocol 2026-07-28 specification. Major changes: protocol-level sessions and the initialize handshake are removed to make MCP stateless, with version and capabilities carried in _meta on every request, plus a new server/discover RPC and subscriptions/listen replacing the GET stream and resource subscribe calls. It introduces Multi Round-Trip Requests (InputRequiredResult) in place of server-initiated sampling, roots and elicitation requests, moves tasks into an extension, and deprecates Roots, Sampling, Logging, HTTP+SSE and Dynamic Client Registration. Minor changes add cache hints (ttlMs/cacheScope), new Mcp-Method/Mcp-Name headers, OpenTelemetry trace context, RFC 9207 iss validation and an error-code allocation policy.

Model Context ProtocolOAuthOpenTelemetry+4
SEP-2567SEP-2575SEP-2322+13

mcp· Added 10 Oct 2026

github.comadvisory🧠 AI

MCP specification 2026-07-28 stable release

GitHub release announcing the stable 2026-07-28 revision of the Model Context Protocol specification, published from the modelcontextprotocol/modelcontextprotocol repository. The release page itself only points to the official MCP website for the spec and to a changelog for the detailed changes. It matters as the canonical version marker that MCP client, server and SDK implementers track for protocol changes.

Model Context ProtocolGitHub

mcp· Added 9 Oct 2026

github.comadvisory🧠 AI

MCP TypeScript SDK v2.2.0

Release notes for v2.2.0 of the official Model Context Protocol TypeScript SDK. Upgrade notes: machine-to-machine OAuth providers (ClientCredentialsProvider, PrivateKeyJwtProvider, StaticPrivateKeyJwtProvider, CrossAppAccessProvider) should now be given expectedIssuer, and fetchToken() throws AuthorizationServerMismatchError when client information is bound to a different authorization server. listTools/listPrompts/listResources/listResourceTemplates now follow nextCursor automatically, capped by listMaxPages. Fixes include CommonJS type-checking of the DPoP jose types, unhandled rejections in Client.listen(), createMcpHandler stack overflow and subscriptions/listen handling, .localhost loopback for OAuth token endpoints, and v1-to-v2 codemod comment preservation.

Model Context ProtocolTypeScriptOAuth+1

mcp· Added 1 Oct 2026

github.comadvisory🛡️ Security

Kong Konnect MCP server: stored prompt injection via analytics data leads to credential/data exfiltration (CVE-2026-13341)

GitHub Security Advisory (CVE-2026-13341) for Kong's mcp-konnect MCP server describes a stored prompt injection vulnerability where a remote attacker crafts malicious request metadata (e.g. User-Agent) that gets stored in Konnect analytics and later returned unsanitized to an AI assistant via MCP tools, potentially causing the agent to exfiltrate sensitive data (plugin configs, secrets, internal hostnames) to an attacker-controlled URL if the client can make outbound fetches. A related path manipulation flaw in control plane/group identifiers allowed requesting unintended Konnect API endpoints with the user's token. The v1.0.0 patch neutralizes untrusted analytics fields, validates identifiers as UUIDs, encodes path segments, and disables raw plugin config output by default.

Model Context Protocol
CVE-2026-13341GHSA-7767-3m3w-2p44path traversal+2

AI Security· Added 26 Sep 2026

vuldb.comadvisory🛡️ Security

CVE-2026-90617 in PentestAgent

VulDB entry for CVE-2026-90617, a remote OS command injection (CWE-78) in GH05TCREW PentestAgent. The flaw is in run_task in interface/main.py of the MCP HTTP Server, affects everything up to commit cf882dab, and has a public exploit. The product uses rolling releases, so no version ranges exist, and the fix is an unmerged pull request. The analysis suggests compensating controls: restrict network access to the MCP server, run with least privilege, and validate input upstream.

PentestAgentModel Context Protocol
CVE-2026-90617CWE-78GH05TCREW

AppSec, AI Security· Added 26 Sep 2026

vuldb.comadvisory🛡️ Security

CVE-2026-85787 in postgres-mcp-server

CVE-2026-85787 affects awslabs postgres-mcp-server before 1.1.7. The SQL validation component uses an incomplete list of disallowed inputs. Crafted SQL placed in content submitted while an authenticated user interacts with the MCP server can bypass the read-only restriction and modify data in PostgreSQL. The fix is to upgrade to 1.1.7 or later. VulDB's added analysis is generic: it points to SQL injection (CWE-89) and recommends least-privilege database accounts and parameterized queries.

postgres-mcp-serverModel Context ProtocolPostgreSQL+1
CVE-2026-85787CWE-89T1059

AppSec, AI Security· Added 26 Sep 2026

vuldb.comadvisory🛡️ Security

CVE-2026-85661 in excel-mcp-server

CVE-2026-85661 affects excel-mcp-server 0.1.8. In stdio mode with EXCEL_FILES_PATH unset, the server does not confine file paths, so a client can pass relative or absolute paths to the read and write tools. That gives arbitrary file read and write with the privileges of the server process. The page classifies it as CWE-22 (ATT&CK T1083) and recommends canonical path checks against a base directory, making EXCEL_FILES_PATH mandatory, and running with least privilege.

excel-mcp-serverModel Context Protocol
CVE-2026-85661CWE-22T1083+1

AppSec, AI Security· Added 26 Sep 2026

osv.devadvisory🛡️ Security

Vulnerability Database - OSV

CVE-2026-91931 is a critical remote code execution vulnerability in Flowise versions before 3.1.4, triggered through the platform's Custom MCP feature which invokes npx to run Model Context Protocol servers. A fix is available in 3.1.4; the flaw scores 9.0 (Critical) on CVSS, indicating an attacker can achieve arbitrary code execution likely via unsanitized input to the npx invocation path.

FlowiseModel Context Protocolnpm
CVE-2026-91931

AI Security, AppSec· Added 26 Sep 2026

nvd.nist.govadvisory🛡️ Security

CVE-2026-75130: Context7 through 2

CVE-2026-75130 describes a prompt injection flaw in Context7 (through v2.1.2), an MCP server that serves library documentation to AI coding agents. The vulnerability lies in the Custom AI Instructions feature, which fails to sanitize content before injecting it into agent context; attackers can poison these instructions so that a routine documentation lookup triggers the agent to exfiltrate credentials from environment files and delete files on the victim's machine. Researchers at Noma Security and VulnCheck published independent technical breakdowns of the attack chain.

Model Context ProtocolContext7
CVE-2026-75130

AI Security· Added 26 Sep 2026

nvd.nist.govadvisory🛡️ Security

CVE-2026-65695: Office-Word-MCP-Server through 1

CVE-2026-65695 is a path traversal vulnerability (CWE-22, CVSS 4.0 7.6 HIGH) in Office-Word-MCP-Server through version 1.1.11, an MCP server that exposes Word document manipulation tools to LLM agents. Attackers who can influence the filename argument can supply absolute paths or ../ sequences to document open/save operations, bypassing the check_file_writeable and ensure_docx_extension helpers (which do no base-directory confinement or realpath validation) to read or overwrite arbitrary .docx files outside the intended working directory.

Model Context ProtocolNVDCVSS
CVE-2026-65695CWE-22path traversal+3

AI Security, AppSec· Added 26 Sep 2026

nvd.nist.govadvisory🛡️ Security

CVE-2026-65056: mcp-webresearch 0

CVE-2026-65056 describes a server-side request forgery in the mcp-webresearch MCP server (npm package @mzxrai/mcp-webresearch, v0.1.7), scoring CVSS 4.0 8.3 HIGH. The visit_page tool only validates URL protocol and does not filter private, loopback, link-local, or cloud metadata IP ranges, so an attacker who controls the LLM-supplied URL argument (e.g. via prompt injection) can steer the server's Playwright browser to internal endpoints like cloud instance metadata services and exfiltrate sensitive internal content, including credentials, back into the model context.

Model Context ProtocolPlaywrightnpm
CVE-2026-65056CWE-918SSRF

AI Security, AppSec· Added 26 Sep 2026

nvd.nist.govadvisory🛡️ Security

CVE-2026-57860: ForgeCode (tailcallhq/forgecode), an AI pair-programming CLI, automatically loads and executes the MCP servers defined i

CVE-2026-57860 describes an arbitrary code execution flaw in ForgeCode (tailcallhq/forgecode), an AI pair-programming CLI that automatically loads and executes MCP servers defined in a repository's .mcp.json on startup without user confirmation. A malicious repo can define mcpServers entries with arbitrary command/args (e.g. bash -c) that spawn under the invoking user's privileges the moment forge is run inside the cloned repo, giving attackers a reliable initial-access and persistence primitive against developers evaluating untrusted code. CVSS 4.0 8.4 HIGH, CWE-829 (inclusion of functionality from untrusted control sphere); a fix commit and VulnCheck advisory are linked.

Model Context Protocol
CVE-2026-57860CWE-829

AI Security· Added 26 Sep 2026

nvd.nist.govadvisory🛡️ Security

CVE-2026-55544: NextCRM is open-source customer relationship management (CRM) software

CVE-2026-55544 describes an authorization bypass (IDOR/BOLA) in NextCRM CRM version 0.12.1, where MCP campaign tool handlers accept user-generated Bearer API tokens but query and mutate campaigns purely by object ID, ignoring the authenticated user's ownership scope. A low-privileged user with a valid MCP token can enumerate, read, modify, delete, or trigger/pause campaigns belonging to other users. Fixed in NextCRM 0.12.2.

Model Context ProtocolNextCRM
CVE-2026-55544CWE-284CWE-639+3

AppSec· Added 26 Sep 2026

nvd.nist.govadvisory🛡️ Security

CVE-2026-52869: The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP)

CVE-2026-52869 describes a session-hijacking flaw in the MCP Python SDK (PyPI package mcp) prior to version 1.27.2: the SSE and stateful Streamable HTTP transports (mcp.server.sse.SseServerTransport and mcp.server.streamable_http_manager.StreamableHTTPSessionManager) route requests to existing sessions using only the session_id query parameter or Mcp-Session-Id header, without checking that the requesting principal matches the session's original authenticated bearer-token client. This lets a different authenticated client that learns or guesses a valid session ID inject JSON-RPC messages into another user's MCP session. CVSS 3.1 base score 7.1 (High); fixed in mcp 1.27.2.

Model Context ProtocolPython
CVE-2026-52869

AppSec· Added 26 Sep 2026

nvd.nist.govadvisory🛡️ Security

CVE-2026-49291: mcp-memory-service is a semantic memory layer for AI applications

CVE-2026-49291 affects mcp-memory-service prior to version 10.65.3: its HTTP MCP JSON-RPC endpoint at /mcp only enforced OAuth 'read' scope before dispatching tools/call requests, so a client holding only read access could invoke mutating tools like store_memory and delete_memory even though the equivalent REST endpoints correctly required 'write' scope. The flaw is a classic missing-authorization bug (CWE-862) surfacing specifically in an MCP tool-dispatch layer, scored CVSS 3.1 8.1 (High) with confidentiality unaffected but integrity and availability impacted. Fixed in 10.65.3.

Model Context ProtocolOAuth
CVE-2026-49291CWE-862

AppSec, Identity & Access· Added 26 Sep 2026

nvd.nist.govadvisory🛡️ Security

CVE-2026-42271: LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format

CVE-2026-42271 describes an unauthenticated-privilege RCE in LiteLLM (versions 1.74.2 to before 1.83.7): the MCP server preview endpoints POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list accept a full stdio MCP server config (command, args, env) and spawn it as a subprocess on the proxy host, gated only by a valid API key with no role check. Any authenticated user, including low-privilege internal-user keys, could run arbitrary commands on the LiteLLM proxy host. Patched in v1.83.7; also tracked as GHSA-v4p8-mg3p-g94g and affects Red Hat OpenShift AI.

LiteLLMModel Context Protocol
CVE-2026-42271CWE-77CWE-78+1

AppSec, AI Security· Added 26 Sep 2026

nvd.nist.govadvisory🛡️ Security

CVE-2026-19984: A flaw has been found in jkawamoto mcp-florence2 up to 0

CVE-2026-19984 describes a server-side request forgery flaw in jkawamoto mcp-florence2 (up to 0.3.13), an MCP server wrapping Microsoft Florence-2 image model. The vulnerable get_images function in src/mcp_florence2/__init__.py passes an attacker-controlled src argument into an HTTP fetch without validation, letting a remote caller force the server to request arbitrary internal or external URLs. The maintainer recommended fix is deploying an SSRF-safe egress proxy rather than patching the source, and a public exploit is available.

Model Context ProtocolPython
CVE-2026-19984CWE-918mcp-florence2

AppSec· Added 26 Sep 2026

nvd.nist.govadvisory🛡️ Security

CVE-2026-19978: A flaw has been found in jiantao88 android-mcp-server up to cfb872b2446794193b58edd63f4dbf6af48a6292

CVE-2026-19978 describes an OS command injection (CWE-77/78) in jiantao88's android-mcp-server, where the child_process.exec call in build/index.js fails to sanitize the deviceId, packageName, permission, and extras[].key/value arguments used to control Android devices. The flaw allows local command execution and has a published exploit; it was fixed in commit 14e2bf27c88ba137e35cbb0c2a75f72b595bb98a. CVSS 4.0 base score is 1.9 (local attack vector only), and the project uses rolling releases so no fixed version numbers are assigned.

Model Context ProtocolAndroidNode.js
CVE-2026-19978CWE-77CWE-78

AppSec, Mobile Security· Added 26 Sep 2026

nvd.nist.govadvisory🛡️ Security

CVE-2026-18655: Improper restriction of intended endpoints in the RabbitMQ broker connection tools of the Amazon MQ MCP Server (awslabs

CVE-2026-18655 describes an improper endpoint restriction flaw (CWE-923) in the RabbitMQ broker connection tools of awslabs.amazon-mq-mcp-server versions before 2.0.24. A remote unauthenticated attacker can use prompt injection introduced into the MCP client context to redirect the broker hostname to an attacker-controlled endpoint, causing Amazon MQ for RabbitMQ credentials or OAuth access tokens to be sent there; CVSS 4.0 base score 7.1 (High). Fixed in version 2.0.24, referenced via an AWS security bulletin and a GitHub security advisory (GHSA-xwj6-8x5h-hjp6).

Model Context ProtocolAWSAWS Bedrock+1
CVE-2026-18655CWE-923GHSA-xwj6-8x5h-hjp6

AI Security, Cloud & Infra· Added 26 Sep 2026

nvd.nist.govadvisory🛡️ Security

CVE-2026-16584: Improper handling of an initialization failure in AWS API MCP Server from 0

CVE-2026-16584 affects AWS API MCP Server (awslabs.aws-api-mcp-server) versions 0.2.13 through 1.3.46: if the security policy enforcement data fails to initialize at server startup, the tool silently skips policy checks for the rest of the process's life, letting an agent execute AWS API operations the admin configured the policy to deny or gate. Underlying IAM permissions still apply and are unaffected, but the intended allow/deny gating layer is bypassed (CWE-455, improper handling of initialization failure). Fixed in 1.3.47.

Model Context ProtocolAWSAWS IAM+1
CVE-2026-16584GHSA-29w2-fq35-v728CWE-455

AI Security, Cloud & Infra· Added 26 Sep 2026

nvd.nist.govadvisory🛡️ Security

CVE-2026-16498: The terraform-mcp-server before version 1

CVE-2026-16498 is a critical (CVSS 3.1: 10.0) exposure-of-sensitive-information flaw (CWE-488) in HashiCorp's terraform-mcp-server prior to version 1.1.0. In stateless streamable-HTTP transport mode, one user's Terraform API token could be reused to execute tool calls on behalf of a different, subsequent user, breaking tenant isolation in shared MCP server deployments. Fixed in terraform-mcp-server 1.1.0; further detail is tracked in HashiCorp's HCSEC-2026-23 advisory.

Model Context ProtocolTerraform
CVE-2026-16498CWE-488

AI Security, AppSec, Identity & Access· Added 26 Sep 2026

nvd.nist.govadvisory🛡️ Security

CVE-2026-14748: A flaw has been found in AIAnytime Awesome-MCP-Server up to a884bb51bcd99e08e14fd712c749d55d9d9a13ab

CVE-2026-14748 is a low-severity (CVSS 4.0: 2.1) server-side request forgery flaw in AIAnytime's Awesome-MCP-Server, specifically in the mcp-wiki/wiki-summary component's server.py, where the url argument is not validated before the server fetches it. A remote, low-privilege attacker can abuse this to make the MCP server issue arbitrary outbound requests; the exploit has already been published via GitHub issues and the maintainer has not responded to the disclosure.

Model Context ProtocolPython
CVE-2026-14748CWE-918SSRF

AppSec, AI Security· Added 26 Sep 2026

nvd.nist.govadvisory🛡️ Security

CVE-2026-14541: An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google mc

CVE-2026-14541 describes an authentication bypass (CWE-287) in the Google OAuth provider of Google's mcp-toolbox for databases v1.4.0, an MCP server that lets LLM agents query databases. When the Google authService is configured with mcpEnabled: true but no explicit audience or clientId, the ValidateMCPAuth pipeline skips audience checks for opaque tokens, so any valid Google OAuth access token — even one issued for an unrelated app — is accepted, letting unauthorized clients reach protected tools and data backends.

Model Context ProtocolOAuthGoogle Cloud
CVE-2026-14541CWE-287

Identity & Access, AI Security· Added 26 Sep 2026

github.comadvisory🛡️ Security

Unauthenticated Administrator takeover exfiltrated via the MCP

GHSA advisory for SiYuan v3.7.1 (CVE-2026-66012) describing how the kernel's POST /mcp route registers 31 MCP tools — including a file tool with full read/write/delete/rename/copy over the workspace — gated only by CheckAuth with no admin or read-only check. When the Publish server runs in anonymous mode (a documented configuration for public docs sites), the Publish reverse proxy attaches an anonymous RoleReader JWT to every proxied request, letting an unauthenticated attacker reach /mcp, exfiltrate accessAuthCode/api.token/cookieKey from conf.json, escalate to Administrator, and plant a malicious Electron plugin (nodeIntegration:true, contextIsolation:false) for RCE on the desktop client. Includes a full working PoC and remediation (CheckAdminRole gate, proxy path allowlist, restricting the file tool).

Model Context ProtocolDockerElectron
CVE-2026-66012CWE-862GHSA-jqwg-75qf-vmf9+6

AppSec· Added 26 Sep 2026

github.comadvisory🛡️ Security

"Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector

n8n's AI Agents module did not enforce the "Allowed HTTP Request Domains" restriction on credentials. A member-level user with use-only access to a shared credential could point an MCP tool at an attacker-controlled URL and run the agent, so the credential secret was sent to an external server. It only affects instances with the agents module enabled via N8N_ENABLED_MODULES and a domain-restricted credential shared with a member. It is fixed in 2.28.1 and 2.27.4, and the advisory rates it High (CVSS v4 7.1).

n8nModel Context ProtocolCVSS
GHSA-h44j-f5r5-ph73credential exfiltrationauthorization bypass

AppSec, AI Security, Identity & Access· Added 26 Sep 2026

github.comadvisory🛡️ Security

Ruby SSE Session Poisoning

A GitHub Security Advisory (GHSA-5p9g-j988-pcwv) documents a session poisoning flaw in the Ruby MCP SDK's Streamable/SSE HTTP transport: the server never validates that a POST to /messages/{session_id} actually belongs to the caller, so an attacker who obtains a victim's session ID (e.g. via logs or network sniffing) can silently execute tool calls whose responses are delivered into the victim's own SSE stream. The advisory includes a working PoC (attacker/legitimate client scripts against the SDK's example streamable_http_server.rb), notes that csharp-sdk and go-sdk correctly bind sessions to user identity while ruby-sdk does not, and distinguishes the bug from the related "Stream Replacement" advisory (GHSA-qvqr-5cv7-wh35), which disconnects rather than poisons the victim's stream.

Model Context ProtocolRuby
GHSA-qvqr-5cv7-wh35

AI Security, AppSec· Added 26 Sep 2026

github.comadvisory🛡️ Security

Missing authentication on MCP HTTP endpoint allows unauthenticated privileged tool calls

GHSA advisory for jovancoding/network-ai disclosing that its MCP HTTP transport (bin/mcp-server.ts, lib/mcp-transport-sse.ts) accepts JSON-RPC tools/call requests with zero authentication, session, or origin checks, and binds to 0.0.0.0 by default. The PoC shows an unauthenticated attacker can enumerate 22 registered tools and invoke privileged ones - config_get/config_set to read and mutate live orchestrator configuration, agent_list/agent_spawn/agent_stop, token_create/token_revoke, budget_set_ceiling, and blackboard_write/delete - with curl requests against a local Docker deployment. Remediation recommended enforcing bearer-token auth in _handlePost() before dispatch, defaulting to 127.0.0.1 binding, and gating state-mutating tools behind authorization checks.

Model Context ProtocolDockerTypeScript+1

AI Security, AppSec· Added 26 Sep 2026

github.comadvisory🛡️ Security

DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)

GHSA-9hgc-g3w5-67cm details a DNS TOCTOU race in IBM mcp-context-forge's /admin/gateways/test endpoint: validate_gateway_test_url() resolves and vets a hostname against private/cloud-metadata IP ranges, but the actual request is made with httpx (via ResilientHttpClient), which independently re-resolves DNS at connection time with no IP pinning. An attacker with gateways.read permission can exploit DNS rebinding (short-TTL record flipping from a public IP to 169.254.169.254) to bypass SSRF protections and reach cloud instance metadata, exfiltrating IAM credentials where IMDSv1 is enabled. The advisory notes the codebase already acknowledges the gap in two comments and a tracked TODO (ICACF-15), and recommends pinning the validated IP into the connection.

Model Context ProtocolPythoncURL
SSRFGHSA-9hgc-g3w5-67cmGHSA-m8rv-5m6m-32ff+3

AppSec· Added 26 Sep 2026

github.comadvisory🛡️ Security

Flowise MCP Security Bypass Enables RCE

GHSA advisory detailing three bypasses in Flowise's Custom MCP Server security controls (validateCommandFlags and validateArgsForLocalFileAccess in packages/components/nodes/tools/MCP/core.ts) that combine to achieve remote code execution: an unblocked `docker build` subcommand that pulls and runs a remote Dockerfile, a missing `--yes` long-flag alias on the npx blocklist (only `-y` was blocked) enabling arbitrary npm package execution, and a Unix absolute-path regex that fails to catch double-leading-slash paths (`//root/...`), allowing `node` to execute an uploaded local file. Any authenticated Flowise user (or an API key with chatflow view/update rights) can chain these to fully compromise the host via a prediction API call.

FlowiseDockerNode.js+2
validateCommandFlagsvalidateArgsForLocalFileAccess

AI Security, AppSec· Added 26 Sep 2026

github.comadvisory🛡️ Security

Insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default

GHSA advisory for better-auth (< 1.6.11) documenting that the deprecated oidcProvider() and mcp() plugins publish "none" as a supported ID-token signing algorithm in their OIDC discovery document and default allowPlainCodeChallengeMethod to true, silently rewriting missing code_challenge_method to "plain" — both violating OAuth 2.1/RFC 9700. The fix removes "none" from the metadata, defaults plain PKCE to disabled, and rejects requests missing code_challenge_method instead of downgrading them; @better-auth/oauth-provider was never affected.

better-authOIDCOAuth
PKCERFC 9700OAuth 2.1

Identity & Access· Added 26 Sep 2026

Showing 30 of 58

Show more