AI Threat AlertModel Context Protocol (MCP) Security
MCP is rapidly becoming the standard way LLM agents call tools and fetch resources. Its attack surface is wide — and largely undocumented. This page tracks every MCP-related CVE we have analyzed.
100
MCP CVEs tracked
35
Critical severity
65
High severity
What is MCP?
The Model Context Protocol (MCP) is an open standard introduced by Anthropic in late 2024. It lets LLM-powered agents discover and invoke tools (file system, shell, HTTP, databases, third-party APIs) through a uniform client/server interface. By mid-2026 MCP is supported by Claude Desktop, Cursor, LangFlow, n8n, OpenAI Codex CLI, Gemini CLI, LiteLLM, PraisonAI, and dozens of community implementations.
MCP solves real fragmentation problems — but it also massively expands the attack surface of the LLM layer. Every MCP server is, in effect, a piece of remote-callable infrastructure that an agent will trust to execute commands and return data. Most MCP servers in the wild are written quickly, lightly audited, and run with broad privileges.
Common MCP attack patterns (observed in real CVEs)
1. Path traversal via tool arguments
MCP tool inputs (file paths, resource URIs) flow directly into fs.readFile or similar primitives. Without canonicalization, an agent prompt can read or write arbitrary files. Real-world impact: full RCE when the file written is a configuration with code-execution semantics.
2. SSRF via HTTP tools
MCP fetch tools that don't restrict target URLs let attackers reach 169.254.169.254 (cloud metadata), private VPC ranges, or internal services. We see SSRF chained with API key exfiltration in tools like n8n-mcp.
3. Credential leakage via HTTP transport logging
Many MCP servers default to verbose request logging. OAuth tokens, API keys, and session cookies end up in logs that downstream agents can read. Multiple CVEs we track exploit this exact pattern.
4. Owner-context spoofing and authorization bypass
MCP doesn't dictate authorization between client and server. Naive implementations trust the client-asserted identity, which a malicious tool can spoof. Result: privilege escalation across tenants.
5. Prompt-injection driven tool invocation chains
An attacker who controls any content surface the agent reads (web page, email, RAG document) can plant instructions that cause the agent to invoke MCP tools with attacker-controlled arguments — chaining what would otherwise be benign tools into a working exploit.
MCP-related CVEs we are tracking
| CVE | Severity | Headline | Published |
|---|---|---|---|
| CVE-2026-62863 | CRITICAL | MoLing: unauthenticated SSE enables browser-based tool calls | Oct 30, 2026 |
| CVE-2026-114612 | CRITICAL | LiteLLM: forged admin token enables RCE via MCP stdio | Oct 22, 2026 |
| CVE-2026-96620 | CRITICAL | Claude Agent SDK: argument injection enables RCE | Oct 16, 2026 |
| CVE-2026-105740 | CRITICAL | Langflow: MCP Stdio command injection gives authenticated RCE | Oct 5, 2026 |
| CVE-2026-105697 | CRITICAL | Langflow: MCP stdio command injection allows host RCE | Oct 5, 2026 |
| CVE-2026-77254 | CRITICAL | MCP Atlassian: missing auth exposes Jira/Confluence | Sep 22, 2026 |
| CVE-2026-77244 | CRITICAL | MCP Atlassian: unauthenticated access to operator Jira/Confluence | Sep 22, 2026 |
| CVE-2026-57139 | CRITICAL | PraisonAI: unauthenticated MCP server exposes agent tools | Sep 15, 2026 |
| CVE-2026-57124 | CRITICAL | PraisonAI: unauth RCE via MCP connect endpoint | Sep 14, 2026 |
| CVE-2026-57123 | CRITICAL | PraisonAI: unauthenticated MCP tool server enables RCE | Sep 14, 2026 |
| CVE-2026-85025 | CRITICAL | Langflow: unauth RCE via public MCP endpoints | Sep 10, 2026 |
| CVE-2026-45018 | CRITICAL | Chainlit: unauth RCE via MCP stdio cmd injection | Aug 25, 2026 |
| CVE-2026-73601 | CRITICAL | Flowise: RCE via Custom MCP node env var injection | Aug 13, 2026 |
| CVE-2026-12940 | CRITICAL | Langflow: unauth RCE via MCP env var injection | Jul 30, 2026 |
| CVE-2026-67429 | CRITICAL | flyto-core: arbitrary file write via bypassed path guard | Jul 30, 2026 |
| CVE-2026-9135 | CRITICAL | Langflow: code injection bypasses ToolGuard, enables RCE | Jul 17, 2026 |
| CVE-2026-30623 | CRITICAL | LiteLLM: RCE via unsanitized MCP server config | Jul 15, 2026 |
| CVE-2026-54052 | CRITICAL | n8n-mcp: broken tenant isolation leaks workflow credentials | Jul 14, 2026 |
| CVE-2026-61459 | CRITICAL | mcp-server-kubernetes: arg injection exfils bearer token | Jul 10, 2026 |
| CVE-2026-50027 | CRITICAL | mcp-memory-service: auth bypass on document API | Jul 2, 2026 |
| CVE-2026-7663 | CRITICAL | Langflow: auth bypass in MCP transport exposes projects | Jun 30, 2026 |
| CVE-2025-71336 | CRITICAL | Flowise: unauthenticated RCE via Custom MCP endpoint | Jun 25, 2026 |
| CVE-2026-56274 | CRITICAL | Flowise: RCE via MCP server command validation bypass | Jun 23, 2026 |
| CVE-2026-7664 | CRITICAL | Langflow: auth bypass in MCP endpoint, CVSS 9.8 | Jun 22, 2026 |
| GHSA-j4f3-55x4-r6q2 | CRITICAL | praisonai: MCP HTTP server unauthenticated tool invocation | Jun 18, 2026 |
| GHSA-vmmj-pfw7-fjwp | CRITICAL | praisonai: sandbox escape gives RCE via codeMode tool | Jun 18, 2026 |
| GHSA-p75f-6fp4-p57w | CRITICAL | PraisonAI: unauthenticated RCE via MCP connect endpoint | Jun 18, 2026 |
| GHSA-x227-pf99-vffg | CRITICAL | praisonaiagents: unauthenticated MCP SSE server enables RCE | Jun 18, 2026 |
| CVE-2026-46339 | CRITICAL | 9router: unauthenticated RCE exposes LLM API keys | May 19, 2026 |
| CVE-2026-44336 | CRITICAL | PraisonAI: MCP path traversal escalates to full RCE | May 11, 2026 |
| GHSA-9qhq-v63v-fv3j | CRITICAL | PraisonAI: RCE via MCP command injection | Apr 17, 2026 |
| CVE-2026-40933 | CRITICAL | Flowise: RCE via MCP stdio command injection | Apr 16, 2026 |
| CVE-2025-61260 | CRITICAL | OpenAI Codex CLI: RCE via malicious MCP config files | Apr 14, 2026 |
| CVE-2026-27825 | CRITICAL | mcp-atlassian: Path Traversal enables file access | Mar 10, 2026 |
| CVE-2025-59528 | CRITICAL | Flowise: Unauthenticated RCE via MCP config injection | Sep 22, 2025 |
| CVE-2026-123811 | HIGH | Dynatrace MCP Server: unauthenticated HTTP tool calls expose Grail data | Nov 9, 2026 |
| CVE-2026-77604 | HIGH | code-graph-rag: MCP read_file path traversal exposes files | Nov 9, 2026 |
| CVE-2026-87008 | HIGH | Code Graph RAG: symlink path traversal enables file read/write | Nov 5, 2026 |
| CVE-2026-117560 | HIGH | ATXP Gemini CLI ext: command injection via MCP tools | Oct 27, 2026 |
| CVE-2026-115477 | HIGH | obsidian-tc: HITL approval bypass runs destructive tools | Oct 23, 2026 |
| CVE-2026-84317 | HIGH | Nginx UI: MCP config_add bypasses directive validation | Oct 12, 2026 |
| CVE-2026-109557 | HIGH | EdgeEver: stored XSS via MCP names steals bridge token | Oct 12, 2026 |
| CVE-2026-105741 | HIGH | Langflow: X-Forwarded-For spoof lets users write MCP config | Oct 5, 2026 |
| CVE-2026-105699 | HIGH | Langflow: cross-tenant file read via MCP resources/read | Oct 5, 2026 |
| GHSA-x8gv-g2g3-65fj | HIGH | SiYuan: DNS-rebinding SSRF bypass in AI agent tools | Oct 2, 2026 |
| CVE-2026-100596 | HIGH | OpenClaw: missing authz in /mcp set enables persistent RCE | Sep 26, 2026 |
| CVE-2026-100587 | HIGH | OpenClaw: missing owner check allows plugin install and MCP execution | Sep 26, 2026 |
| CVE-2026-100585 | HIGH | OpenClaw: owner-only approval bypass in MCP bridge | Sep 26, 2026 |
| CVE-2026-61788 | HIGH | DBHub: readonly mode bypass enables writes and RCE | Sep 24, 2026 |
| CVE-2026-77247 | HIGH | mcp-atlassian: arbitrary server file upload via path | Sep 22, 2026 |
| CVE-2026-77262 | HIGH | mcp-atlassian: path traversal enables arbitrary file read | Sep 22, 2026 |
| CVE-2026-77259 | HIGH | mcp-atlassian: arbitrary file read via attachment upload | Sep 22, 2026 |
| CVE-2026-77257 | HIGH | mcp-atlassian: arbitrary local file upload via path | Sep 22, 2026 |
| CVE-2026-77255 | HIGH | mcp-atlassian: arbitrary file read/exfil via attachments | Sep 22, 2026 |
| CVE-2026-77253 | HIGH | mcp-atlassian: path traversal enables arbitrary file exfiltration | Sep 22, 2026 |
| CVE-2026-77246 | HIGH | mcp-atlassian: unvalidated upload path leaks server files | Sep 22, 2026 |
| CVE-2026-77248 | HIGH | mcp-atlassian: unauth file read via upload_attachment | Sep 22, 2026 |
| CVE-2026-77256 | HIGH | MCP Atlassian: world-readable OAuth token file exposure | Sep 22, 2026 |
| CVE-2026-77261 | HIGH | mcp-atlassian: SSRF via unvalidated redirects | Sep 22, 2026 |
| CVE-2026-77260 | HIGH | MCP Atlassian: path traversal in upload_attachment | Sep 22, 2026 |
| CVE-2026-77271 | HIGH | MCP Atlassian: path traversal enables code execution | Sep 22, 2026 |
| CVE-2026-77242 | HIGH | MCP Atlassian: DNS rebinding bypasses SSRF protection | Sep 22, 2026 |
| CVE-2026-77243 | HIGH | MCP Atlassian: missing authz lets clients call hidden tools | Sep 22, 2026 |
| CVE-2026-77251 | HIGH | MCP Atlassian: project/space filter bypass exposes data | Sep 22, 2026 |
| CVE-2026-77267 | HIGH | MCP Atlassian: SSRF via header URLs bypasses prior fix | Sep 22, 2026 |
| CVE-2026-77258 | HIGH | MCP Atlassian: path traversal exposes server files | Sep 22, 2026 |
| CVE-2026-77274 | HIGH | mcp-atlassian: SSRF via backslash URL parsing confusion | Sep 22, 2026 |
| CVE-2026-61647 | HIGH | NotebookLM MCP: path traversal enables arbitrary file write | Sep 21, 2026 |
| CVE-2026-58197 | HIGH | ToolHive: default network profile enables MCP lateral movement | Sep 18, 2026 |
| GHSA-5648-rgj9-v224 | HIGH | mcp-gitlab: GraphQL read-only bypass, auth gaps, DoS | Sep 15, 2026 |
| CVE-2026-91932 | HIGH | Flowise: MCP cwd validation bypass enables RCE | Sep 15, 2026 |
| CVE-2026-91931 | HIGH | Flowise: RCE via npx in Custom MCP node | Sep 15, 2026 |
| CVE-2026-57134 | HIGH | PraisonAI: MCP auth bypass via unchecked Basic/OAuth | Sep 15, 2026 |
| CVE-2026-57112 | HIGH | PraisonAI: DNS rebinding exposes MCP SSE tool calls | Sep 15, 2026 |
| CVE-2026-73496 | HIGH | MCP Atlassian: path traversal enables server file disclosure | Sep 14, 2026 |
| CVE-2026-81941 | HIGH | Langflow: MCP stdio tool bypasses RCE lockdown | Sep 10, 2026 |
| CVE-2026-78575 | HIGH | Langflow: RCE via unsanitized MCP stdio server args | Sep 10, 2026 |
| CVE-2026-75915 | HIGH | deepseek-tui: js_execution leaks parent secrets to LLM | Sep 4, 2026 |
| CVE-2026-75857 | HIGH | CodeWhale: shell approval bypass via interactive tool | Sep 4, 2026 |
| CVE-2026-75914 | HIGH | CodeWhale: symlink traversal leaks files via vision API | Sep 4, 2026 |
| CVE-2026-85666 | HIGH | OGX/Llama Stack: SSRF via MCP tool server_url | Sep 4, 2026 |
| CVE-2026-19591 | HIGH | Codex CLI: PowerShell parsing flaw bypasses approval, RCE | Sep 1, 2026 |
| CVE-2026-45019 | HIGH | Chainlit: unauth SSRF via MCP url/header injection | Aug 25, 2026 |
| CVE-2026-55580 | HIGH | mcp-shell: insecure defaults allow full shell RCE | Aug 25, 2026 |
| CVE-2026-55581 | HIGH | mcp-shell: bash allowlist bypass grants RCE, no auth | Aug 25, 2026 |
| CVE-2026-55582 | HIGH | mcp-shell: secure mode bypass via git alias RCE | Aug 25, 2026 |
| CVE-2026-55532 | HIGH | PraisonAI: Origin bypass CSRF enables prompt injection | Aug 25, 2026 |
| CVE-2026-77068 | HIGH | n8n: RCE via path traversal in MCP schema loader | Aug 20, 2026 |
| CVE-2026-75149 | HIGH | marimo: code injection via malicious MCP server config | Aug 19, 2026 |
| CVE-2026-75858 | HIGH | CodeWhale: rlm_eval RCE bypasses approval policy | Aug 18, 2026 |
| CVE-2026-75060 | HIGH | PyCharm: unauthenticated Jupyter MCP tools enable RCE | Aug 17, 2026 |
| CVE-2026-72768 | HIGH | n8n: SSRF bypass in MCP Client node exposes internal hosts | Aug 11, 2026 |
| CVE-2026-9077 | HIGH | Langflow: MCP config write bypasses localhost restriction | Aug 5, 2026 |
| CVE-2026-8446 | HIGH | Langflow: OAuth auth bypass on MCP composer endpoint | Aug 5, 2026 |
| CVE-2026-17626 | HIGH | Langflow: Docker MCP volume-mount flaw exposes host files | Aug 5, 2026 |
| CVE-2026-17623 | HIGH | Langflow: MCP config command injection allows RCE | Aug 5, 2026 |
| GHSA-p7w7-4929-vpj5 | HIGH | Dynatrace MCP server: unauth HTTP data exfil via DQL | Jul 31, 2026 |
| CVE-2026-14538 | HIGH | Google mcp-toolbox: BigQuery allowedDatasets bypass | Jul 31, 2026 |
| CVE-2026-15829 | HIGH | MCP Toolbox: SQLi bypasses BigQuery allowedDatasets ACL | Jul 21, 2026 |
| CVE-2026-7755 | HIGH | Langflow: MCP config validation gap enables RCE | Jul 17, 2026 |
How to protect MCP deployments
- Inventory every MCP server in your stack. Treat them like web services, not "just config". Each is a remote code-execution surface for your agents.
- Sandbox the host process. Run MCP servers in containers with read-only filesystems where possible, dropped capabilities, and network policies limiting egress.
- Sanitize every tool argument as untrusted. Canonicalize paths before file access. Validate URLs against an allow-list before HTTP fetches. Reject IPs in private/metadata ranges.
- Disable verbose request logging by default. If logging is needed, redact OAuth bearer tokens, cookies, and Authorization headers at the transport layer.
- Implement explicit authorization. Don't trust the client-asserted owner/tenant. Authenticate the MCP client and check it against an access policy on every invocation.
- Constrain prompt-injection blast radius. Treat any content the agent reads as adversarial. Require human-in-the-loop confirmation for tool invocations that touch sensitive resources.
- Track upstream CVEs. The MCP ecosystem moves fast. Subscribe to our feed to catch new MCP CVEs as they are published.