MCP Incidents
A live database of security incidents affecting Model Context Protocol servers, clients, SDKs and transports. Each entry names the policy controls that would have prevented or contained it.
Amazon Q Developer MCP Auto-Execution and Cloud Credential Theft (CVE-2026-12957 / CVE-2026-12958)
Opening a malicious repository in VS Code was enough to steal a developer's AWS credentials. Amazon Q Developer silently read a repository's <code>.amazonq/mcp.json</code> file, spawned the MCP servers it defined, and th...
ShareLock: Multi-Tool Threshold Poisoning Attack Against MCP
Existing MCP tool poisoning embeds the entire malicious payload in a single tool description, which is detectable by both manual review and automated scanners. ShareLock, published in an academic paper on arXiv on 25 Jun...
Agentjacking: Sentry MCP Injection Hijacks AI Coding Agents
A Sentry Data Source Name is public by design, embedded in every web application's frontend JavaScript. Tenet Security found that posting a crafted error event to Sentry's ingest endpoint, using only that public credenti...
mcp-server-kubernetes Tool Access Control Bypass (CVE-2026-46519)
mcp-server-kubernetes ships three operator-facing controls for limiting which Kubernetes tools an agent can use: ALLOW_ONLY_READONLY_TOOLS, ALLOW_ONLY_NON_DESTRUCTIVE_TOOLS, and a custom ALLOWED_TOOLS allowlist. CVE-2026...
LiteLLM MCP Test Endpoint Command Injection to Unauthenticated RCE (CVE-2026-42271)
LiteLLM's MCP preview endpoints accepted full stdio server configurations, including arbitrary command paths and arguments, and spawned them as subprocesses on the proxy host with no allowlist and no administrative gate....
Database MCP Backend Vulnerabilities: Apache Doris SQLi, Pinot Auth Bypass, Alibaba RDS Metadata Exposure (CVE-2025-66335)
Three popular database MCP servers shipped with the same class of failure: no validation between the MCP endpoint and the back end. Akamai researcher Tomer Peled found SQL injection in Apache Doris MCP (CVE-2025-66335), ...
n8n-MCP Path Traversal, Redirect SSRF, and Telemetry Token Leakage (GHSA-8g7g-hmwm-6rv2)
Three independently-reported vulnerabilities in n8n-MCP before version 2.50.1 gave authenticated callers more access than they were supposed to have. A crafted workflow ID with directory traversal sequences routes outbou...
Kubectl MCP Server Drive-By RCE and Archon OS SSRF Chain (CVE-2025-65719 / CVE-2025-69443)
Visit one malicious webpage while kubectl-mcp-server is running and an attacker owns your Kubernetes cluster. OX Security published a three-target disclosure in May 2026 covering a drive-by RCE in the widely adopted kube...
FastGPT Stored MCP Tool URL SSRF (CVE-2026-44284)
FastGPT's MCP tool URL validation ran at request time but not at persistence time, creating a two-phase bypass. An authenticated user with tool-management permissions could store an internal network URL as a configured M...
MCP Registry OIDC Token Replay Across Deployments (CVE-2026-44428)
The official Model Context Protocol registry used a shared OIDC audience across all registry deployments. Any attacker-controlled or compromised registry instance could take a GitHub OIDC token minted for itself and repl...
Cursor Sandbox Escape via Git Hooks (CVE-2026-26268)
Cursor's AI agent can be told to write files. Nothing in versions before 2.5 prevented it from writing to <code>.git/hooks/</code>. An attacker who can inject a prompt into the agent's context, via a malicious repository...
Gemini CLI RCE via Workspace Trust and Tool Allowlist Bypass (GHSA-wpqr-6v78-jr5g)
Gemini CLI running in CI/CD headless mode automatically trusted workspace folders and executed configuration from them without verification. A second bypass in Yolo execution mode ignored fine-grained tool allowlists ent...
Anthropic MCP STDIO RCE (OX Security disclosure)
OX Security found that Anthropic's official MCP SDKs hand configuration values directly to OS command execution over the STDIO transport. Any path that lets an attacker influence MCP server configuration (a malicious pac...
Windsurf Zero-Click Prompt Injection to RCE (CVE-2026-30615)
Open a file, get owned. Windsurf 1.9544.26 was the only AI IDE in the OX Security disclosure chain where exploitation required zero user interaction. Attacker-controlled HTML content, when rendered by the IDE, injected i...
Flowise and Upsonic MCP Hardening Bypass (CVE-2026-30625 / GHSA-c9gw-hvqq-f33r)
Both Flowise and Upsonic knew MCP STDIO was dangerous and built defences: command allowlists that restricted execution to trusted binaries like <code>npm</code>, <code>npx</code>, and <code>python</code>. OX Security byp...
Splunk MCP Server Clear-Text Token Exposure (CVE-2026-20205)
The Splunk MCP Server app wrote session and authorisation tokens to the Splunk _internal index in clear text. Any user with the mcp_tool_admin capability or access to that index could read active credentials for other se...
Azure MCP Server Missing Authentication and Information Disclosure (CVE-2026-32211)
Microsoft's Azure MCP Server shipped a critical function without an authentication check, giving any network-accessible attacker direct access to sensitive data. The flaw, scored CVSS 9.1, requires no privileges and no u...
Azure MCP Server RCE and Cloud Takeover (CVE-2026-26118 / MCPwned)
The official Azure MCP Server shipped the SSE transport without authentication and exposed azmcp-extension-az, a tool that passes user-controlled arguments directly to the Azure CLI process. Researcher Ariel Simon of Tok...
MCPwn (CVE-2026-33032)
Two HTTP requests, full nginx server takeover. nginx-ui shipped its MCP server with AuthRequired() middleware on /mcp but not on its sibling /mcp_message. Anyone on the network could grab a session ID from the protected ...
Claude Code MCP Config-Based RCE and API Key Exfiltration (CVE-2025-59536 / CVE-2026-21852)
Check Point Research disclosed two vulnerabilities in Anthropic's Claude Code on February 25, 2026. CVE-2025-59536 (CVSS 8.7) allowed hooks defined in a repository's .claude/settings.json to execute arbitrary shell comma...
MCP TypeScript SDK Cross-Client Data Leak (CVE-2026-25536)
When a single McpServer instance with a StreamableHTTPServerTransport is reused across multiple client connections, response data leaks across client boundaries. One client receives tool output intended for another. This...
Anthropic mcp-server-git RCE Chain via Prompt Injection (CVE-2025-68143 / CVE-2025-68144 / CVE-2025-68145)
Cyata Security disclosed three vulnerabilities in mcp-server-git, Anthropic's official reference implementation for Git operations over MCP, on January 20, 2026. Individually each flaw is a medium-severity path or argume...
Microsoft MarkItDown MCP Server SSRF to AWS IAM Credential Theft (MCP fURI)
BlueRock Security disclosed a server-side request forgery (SSRF) vulnerability in Microsoft's MarkItDown MCP server on January 20, 2026. The server's convert_to_markdown tool accepts an arbitrary URI with no validation, ...
GitHub MCP Prompt Injection: Cross-Repo Data Heist
A planted issue in a public repo can convince a developer's AI agent to copy private repo contents into that public repo. The official GitHub MCP server hands the agent the user's full GitHub credentials, so private and ...