Security incidents involving Model Context Protocol servers and tooling: supply-chain campaigns, credential disclosure, path traversal, and SSRF. Each entry links to primary sources and the disclosed CVE where one exists.
Showing 1 - 10 of 13
Loom for AWS exposed a fixed super-admin identity when no Amazon Cognito user pool or external identity provider was configured. A network client could then read, create, modify, or delete platform resources without credentials.
A malicious HTTP MCP server can force a fallback OAuth discovery path, then receive a client's authorization code, client secret, and PKCE verifier after the user signs in at the legitimate provider.
Bifrost's management API started an attacker-supplied command as soon as an MCP stdio client was registered, before any MCP handshake. Management authentication is off by default, so a reachable endpoint meant unauthenticated command execution. CVSS 9.8, fixed in HTTP transport 2.1.0.
A malicious MCP server distributed via GitHub pull requests behaves benignly for three tool calls, then rewrites its metadata into instructions that hunt SSH keys and cloud credentials once the client trusts it.
A settings tool returned the high-availability cluster token in cleartext, turning MCP access into full server compromise via token impersonation. CVSS 7.7, fixed in 26.7.3.
The confluence_upload_attachment tool failed to validate file paths, letting any authenticated MCP client read arbitrary files accessible to the server process. CVSS 7.7, fixed in v0.22.0.
Server-side request forgery in the fetch_pagination_url function let authenticated users drive requests from the server's network position. CVSS 5.3.
Help Net Security reported active exploitation of CVE-2026-55255, a CVSS 9.9 cross-tenant IDOR in Langflow, an AI-orchestration platform often deployed alongside MCP servers and agents.
Sysdig disclosed JadePuffer, an LLM agent running an entire ransomware operation without a human in the loop: initial access through a Langflow RCE (CVE-2025-3248) and a Nacos auth bypass, then autonomous recon, credential theft, and database extortion.
A worm planted adversarial MCP configuration files (mcp.json) across 73 GitHub repositories, including Microsoft's azure/durabletask. Opening an affected repo in an AI coding agent auto-executed a credential-harvesting payload.