Security incidents involving Model Context Protocol servers and tooling: supply-chain campaigns, credential disclosure, path traversal, and SSRF. Each entry links to primary sources and the disclosed CVE where one exists.
Showing 1 - 10 of 10
A malicious MCP server distributed via GitHub pull requests behaves benignly for three tool calls, then rewrites its metadata into instructions that hunt SSH keys and cloud credentials once the client trusts it.
A settings tool returned the high-availability cluster token in cleartext, turning MCP access into full server compromise via token impersonation. CVSS 7.7, fixed in 26.7.3.
The confluence_upload_attachment tool failed to validate file paths, letting any authenticated MCP client read arbitrary files accessible to the server process. CVSS 7.7, fixed in v0.22.0.
Server-side request forgery in the fetch_pagination_url function let authenticated users drive requests from the server's network position. CVSS 5.3.
Help Net Security reported active exploitation of a CVSS 9.9 cross-tenant IDOR in Langflow, the AI-orchestration platform that sits behind most MCP deployments.
Sysdig disclosed JadePuffer, an LLM agent running an entire ransomware operation without a human in the loop: initial access through a Langflow RCE (CVE-2025-3248) and a Nacos auth bypass, then autonomous recon, credential theft, and database extortion.
A worm campaign planted adversarial MCP configuration files across 73 GitHub repositories (including Microsoft's azure/durabletask), executing credential-harvesting payloads against developers who opened an affected repo in a vulnerable IDE.
Command injection in the open-source gemini-mcp-tool MCP server, disclosed as a zero-day. CVSS 9.8.
Remote code execution in Mobile MCP through arbitrary Android intent execution from unvalidated URLs.
The nginx-ui MCP message endpoint performed no authentication on command-execution requests. An unauthenticated caller reaching the endpoint ran commands on the host. CVSS 9.8.