AI Threat Alert
Model Context Protocol (MCP) Security
MCP is rapidly becoming the standard way LLM agents call tools and fetch resources. Its attack surface is wide — and largely undocumented. This page tracks every MCP-related CVE we have analyzed.
100
MCP CVEs tracked
27
Critical severity
71
High severity
What is MCP?
The Model Context Protocol (MCP) is an open standard introduced by Anthropic in late 2024. It lets LLM-powered agents discover and invoke tools (file system, shell, HTTP, databases, third-party APIs) through a uniform client/server interface. By mid-2026 MCP is supported by Claude Desktop, Cursor, LangFlow, n8n, OpenAI Codex CLI, Gemini CLI, LiteLLM, PraisonAI, and dozens of community implementations.
MCP solves real fragmentation problems — but it also massively expands the attack surface of the LLM layer. Every MCP server is, in effect, a piece of remote-callable infrastructure that an agent will trust to execute commands and return data. Most MCP servers in the wild are written quickly, lightly audited, and run with broad privileges.
Common MCP attack patterns (observed in real CVEs)
1. Path traversal via tool arguments
MCP tool inputs (file paths, resource URIs) flow directly into fs.readFile or similar primitives. Without canonicalization, an agent prompt can read or write arbitrary files. Real-world impact: full RCE when the file written is a configuration with code-execution semantics.
2. SSRF via HTTP tools
MCP fetch tools that don't restrict target URLs let attackers reach 169.254.169.254 (cloud metadata), private VPC ranges, or internal services. We see SSRF chained with API key exfiltration in tools like n8n-mcp.
3. Credential leakage via HTTP transport logging
Many MCP servers default to verbose request logging. OAuth tokens, API keys, and session cookies end up in logs that downstream agents can read. Multiple CVEs we track exploit this exact pattern.
4. Owner-context spoofing and authorization bypass
MCP doesn't dictate authorization between client and server. Naive implementations trust the client-asserted identity, which a malicious tool can spoof. Result: privilege escalation across tenants.
5. Prompt-injection driven tool invocation chains
An attacker who controls any content surface the agent reads (web page, email, RAG document) can plant instructions that cause the agent to invoke MCP tools with attacker-controlled arguments — chaining what would otherwise be benign tools into a working exploit.
MCP-related CVEs we are tracking
| CVE | Severity | Headline | Published |
|---|---|---|---|
| CVE-2026-57124 | CRITICAL | PraisonAI: unauth RCE via MCP connect endpoint | Sep 14, 2026 |
| CVE-2026-57123 | CRITICAL | PraisonAI: unauthenticated MCP tool server enables RCE | Sep 14, 2026 |
| CVE-2026-85025 | CRITICAL | Langflow: unauth RCE via public MCP endpoints | Sep 10, 2026 |
| CVE-2026-45018 | CRITICAL | Chainlit: unauth RCE via MCP stdio cmd injection | Aug 25, 2026 |
| CVE-2026-73601 | CRITICAL | Flowise: RCE via Custom MCP node env var injection | Aug 13, 2026 |
| CVE-2026-12940 | CRITICAL | Langflow: unauth RCE via MCP env var injection | Jul 30, 2026 |
| CVE-2026-67429 | CRITICAL | flyto-core: arbitrary file write via bypassed path guard | Jul 30, 2026 |
| CVE-2026-9135 | CRITICAL | Langflow: code injection bypasses ToolGuard, enables RCE | Jul 17, 2026 |
| CVE-2026-30623 | CRITICAL | LiteLLM: RCE via unsanitized MCP server config | Jul 15, 2026 |
| CVE-2026-54052 | CRITICAL | n8n-mcp: broken tenant isolation leaks workflow credentials | Jul 14, 2026 |
| CVE-2026-61459 | CRITICAL | mcp-server-kubernetes: arg injection exfils bearer token | Jul 10, 2026 |
| CVE-2026-50027 | CRITICAL | mcp-memory-service: auth bypass on document API | Jul 2, 2026 |
| CVE-2026-7663 | CRITICAL | Langflow: auth bypass in MCP transport exposes projects | Jun 30, 2026 |
| CVE-2025-71336 | CRITICAL | Flowise: unauthenticated RCE via Custom MCP endpoint | Jun 25, 2026 |
| CVE-2026-56274 | CRITICAL | Flowise: RCE via MCP server command validation bypass | Jun 23, 2026 |
| CVE-2026-7664 | CRITICAL | Langflow: auth bypass in MCP endpoint, CVSS 9.8 | Jun 22, 2026 |
| GHSA-j4f3-55x4-r6q2 | CRITICAL | praisonai: MCP HTTP server unauthenticated tool invocation | Jun 18, 2026 |
| GHSA-vmmj-pfw7-fjwp | CRITICAL | praisonai: sandbox escape gives RCE via codeMode tool | Jun 18, 2026 |
| GHSA-p75f-6fp4-p57w | CRITICAL | PraisonAI: unauthenticated RCE via MCP connect endpoint | Jun 18, 2026 |
| GHSA-x227-pf99-vffg | CRITICAL | praisonaiagents: unauthenticated MCP SSE server enables RCE | Jun 18, 2026 |
| CVE-2026-46339 | CRITICAL | 9router: unauthenticated RCE exposes LLM API keys | May 19, 2026 |
| CVE-2026-44336 | CRITICAL | PraisonAI: MCP path traversal escalates to full RCE | May 11, 2026 |
| GHSA-9qhq-v63v-fv3j | CRITICAL | PraisonAI: RCE via MCP command injection | Apr 17, 2026 |
| CVE-2026-40933 | CRITICAL | Flowise: RCE via MCP stdio command injection | Apr 16, 2026 |
| CVE-2025-61260 | CRITICAL | OpenAI Codex CLI: RCE via malicious MCP config files | Apr 14, 2026 |
| CVE-2026-27825 | CRITICAL | mcp-atlassian: Path Traversal enables file access | Mar 10, 2026 |
| CVE-2025-59528 | CRITICAL | Flowise: Unauthenticated RCE via MCP config injection | Sep 22, 2025 |
| CVE-2026-81941 | HIGH | Langflow: MCP stdio tool bypasses RCE lockdown | Sep 10, 2026 |
| CVE-2026-78575 | HIGH | Langflow: RCE via unsanitized MCP stdio server args | Sep 10, 2026 |
| CVE-2026-59176 | HIGH | functype-mcp-server: RCE via unsanitized pnpm install | Sep 9, 2026 |
| CVE-2026-75915 | HIGH | deepseek-tui: js_execution leaks parent secrets to LLM | Sep 4, 2026 |
| CVE-2026-75857 | HIGH | CodeWhale: shell approval bypass via interactive tool | Sep 4, 2026 |
| CVE-2026-75914 | HIGH | CodeWhale: symlink traversal leaks files via vision API | Sep 4, 2026 |
| CVE-2026-85666 | HIGH | OGX/Llama Stack: SSRF via MCP tool server_url | Sep 4, 2026 |
| CVE-2026-19591 | HIGH | Codex CLI: PowerShell parsing flaw bypasses approval, RCE | Sep 1, 2026 |
| CVE-2026-45019 | HIGH | Chainlit: unauth SSRF via MCP url/header injection | Aug 25, 2026 |
| CVE-2026-55580 | HIGH | mcp-shell: insecure defaults allow full shell RCE | Aug 25, 2026 |
| CVE-2026-55581 | HIGH | mcp-shell: bash allowlist bypass grants RCE, no auth | Aug 25, 2026 |
| CVE-2026-55582 | HIGH | mcp-shell: secure mode bypass via git alias RCE | Aug 25, 2026 |
| CVE-2026-55532 | HIGH | PraisonAI: Origin bypass CSRF enables prompt injection | Aug 25, 2026 |
| CVE-2026-77068 | HIGH | n8n: RCE via path traversal in MCP schema loader | Aug 20, 2026 |
| CVE-2026-75149 | HIGH | marimo: code injection via malicious MCP server config | Aug 19, 2026 |
| CVE-2026-75858 | HIGH | CodeWhale: rlm_eval RCE bypasses approval policy | Aug 18, 2026 |
| CVE-2026-75060 | HIGH | PyCharm: unauthenticated Jupyter MCP tools enable RCE | Aug 17, 2026 |
| CVE-2026-72768 | HIGH | n8n: SSRF bypass in MCP Client node exposes internal hosts | Aug 11, 2026 |
| CVE-2026-9077 | HIGH | Langflow: MCP config write bypasses localhost restriction | Aug 5, 2026 |
| CVE-2026-8446 | HIGH | Langflow: OAuth auth bypass on MCP composer endpoint | Aug 5, 2026 |
| CVE-2026-17626 | HIGH | Langflow: Docker MCP volume-mount flaw exposes host files | Aug 5, 2026 |
| CVE-2026-17623 | HIGH | Langflow: MCP config command injection allows RCE | Aug 5, 2026 |
| GHSA-p7w7-4929-vpj5 | HIGH | Dynatrace MCP server: unauth HTTP data exfil via DQL | Jul 31, 2026 |
| CVE-2026-14538 | HIGH | Google mcp-toolbox: BigQuery allowedDatasets bypass | Jul 31, 2026 |
| CVE-2026-15829 | HIGH | MCP Toolbox: SQLi bypasses BigQuery allowedDatasets ACL | Jul 21, 2026 |
| CVE-2026-7755 | HIGH | Langflow: MCP config validation gap enables RCE | Jul 17, 2026 |
| CVE-2026-54449 | HIGH | LangBot: RCE via arbitrary STDIO MCP command | Jul 15, 2026 |
| CVE-2026-61427 | HIGH | PraisonAI: MCP server auth bypass by default | Jul 15, 2026 |
| CVE-2026-50158 | HIGH | yutu: arbitrary file write via MCP caption-download tool | Jul 14, 2026 |
| CVE-2026-62195 | HIGH | OpenClaw: MCP loopback auth bypass on owner tools | Jul 13, 2026 |
| GHSA-g5r6-gv6m-f5jv | HIGH | mcp-atlassian: path traversal leaks secrets via injection | Jul 10, 2026 |
| GHSA-wm45-qh3g-v83f | HIGH | mcp-atlassian: path traversal leaks server files+creds | Jul 10, 2026 |
| GHSA-52vm-mxx8-f227 | HIGH | Phantom MCP: unconfined output path enables file write | Jul 9, 2026 |
| CVE-2026-59723 | HIGH | Cline: missing Origin check on Hub enables RCE | Jul 8, 2026 |
| CVE-2026-59822 | HIGH | LiteLLM: MCP auth bypass via fabricated OAuth header | Jul 8, 2026 |
| CVE-2026-53518 | HIGH | better-auth: race condition mints duplicate OAuth tokens | Jul 7, 2026 |
| CVE-2026-49857 | HIGH | auth-fetch-mcp: SSRF bypass via IPv6 loopback | Jul 1, 2026 |
| CVE-2026-12773 | HIGH | litellm: auth bypass in MCP proxy, no credentials required | Jun 21, 2026 |
| GHSA-mrvx-jmjw-vggc | HIGH | mcp-searxng: SSRF via DNS rebinding in web_url_read | Jun 19, 2026 |
| GHSA-xcqx-9jf5-w339 | HIGH | mcp-searxng: DoS via unbounded URL response read | Jun 19, 2026 |
| GHSA-vcv2-r9jh-99m5 | HIGH | agentic-flow: MCP tool args enable OS command injection RCE | Jun 19, 2026 |
| CVE-2026-49357 | HIGH | line-desktop-mcp: unauthenticated HTTP exposes LINE chats | Jun 19, 2026 |
| GHSA-fq4x-789w-jg5h | HIGH | agenticmail: email prompt injection → bypassPermissions RCE | Jun 18, 2026 |
| GHSA-4qq2-2j2x-x62c | HIGH | praisonai: MCP auth bypass exposes agent tools | Jun 18, 2026 |
| GHSA-j7qx-p75m-wp7g | HIGH | PraisonAI: path traversal exposes arbitrary host files | Jun 18, 2026 |
| GHSA-vmf9-xx9w-86wx | HIGH | PraisonAI: DNS rebinding exposes MCP agent tools | Jun 18, 2026 |
| CVE-2026-53840 | HIGH | OpenClaw: credential exfiltration via MCP header forwarding | Jun 16, 2026 |
| CVE-2026-53814 | HIGH | OpenClaw: privilege escalation via hook-triggered MCP scope | Jun 11, 2026 |
| CVE-2026-46519 | HIGH | mcp-server-kubernetes: auth bypass enables full cluster RCE | May 21, 2026 |
| GHSA-hv85-774v-26fg | HIGH | auth-fetch-mcp: SSRF + disk-exfil via unvalidated tool URLs | May 19, 2026 |
| CVE-2026-45707 | HIGH | n8n-mcp: tenant isolation bypass, operator RCE risk | May 18, 2026 |
| CVE-2026-45350 | HIGH | open-webui: missing authz allows admin tool hijacking | May 14, 2026 |
| GHSA-m99r-2hxc-cp3q | HIGH | Flowise MCP: 3-path blocklist bypass enables server RCE | May 14, 2026 |
| GHSA-8g7g-hmwm-6rv2 | HIGH | n8n-mcp: path traversal + SSRF exposes n8n API keys | May 8, 2026 |
| CVE-2026-42271 | HIGH | LiteLLM: RCE via MCP test endpoint command injection | May 8, 2026 |
| CVE-2026-42079 | HIGH | PPTAgent: eval injection enables RCE via LLM prompt injection | May 5, 2026 |
| GHSA-r6xh-pqhr-v4xh | HIGH | openclaw: MCP owner-context spoofing, privilege escalation | May 4, 2026 |
| CVE-2026-42449 | HIGH | n8n-mcp: SSRF bypass via IPv6 leaks API keys | Apr 30, 2026 |
| GHSA-v4p8-mg3p-g94g | HIGH | litellm: RCE via MCP test endpoints privilege bypass | Apr 25, 2026 |
| GHSA-cvrr-qhgw-2mm6 | HIGH | Flowise: unauthenticated RCE via FILE-STORAGE bypass | Apr 16, 2026 |
| CVE-2026-30617 | HIGH | LangChain-ChatChat: RCE via unauthenticated MCP interface | Apr 15, 2026 |
| GHSA-p4h8-56qp-hpgv | HIGH | mcp-ssh: argument injection enables LLM-driven local RCE | Apr 14, 2026 |
| GHSA-75hx-xj24-mqrw | HIGH | n8n-mcp: unauthenticated HTTP endpoints enable DoS + recon | Apr 10, 2026 |
| CVE-2026-39974 | HIGH | n8n-MCP: SSRF exposes cloud metadata via MCP headers | Apr 9, 2026 |
| GHSA-4ggg-h7ph-26qr | HIGH | n8n-mcp: authenticated SSRF leaks cloud metadata | Apr 8, 2026 |
| CVE-2026-35394 | HIGH | mobile-mcp: intent injection enables device control via AI agent | Apr 4, 2026 |
| CVE-2026-29872 | HIGH | awesome-llm-apps MCP Agent: cross-session credential theft | Mar 30, 2026 |
| CVE-2026-33989 | HIGH | @mobilenext/mobile-mcp: path traversal via AI agent tool | Mar 27, 2026 |
| CVE-2026-27826 | HIGH | mcp-atlassian: SSRF allows internal network access | Mar 10, 2026 |
| CVE-2026-0621 | HIGH | mcp_typescript_sdk: security flaw enables exploitation | Jan 5, 2026 |
| CVE-2025-66404 | HIGH | mcp-server-kubernetes: Command Injection enables RCE | Dec 3, 2025 |
| CVE-2026-9186 | MEDIUM | Langflow: header spoof bypasses MCP config write guard | Sep 4, 2026 |
| CVE-2026-73846 | MEDIUM | ckan-mcp-server: cache key collision enables poisoning | Sep 3, 2026 |
How to protect MCP deployments
- Inventory every MCP server in your stack. Treat them like web services, not "just config". Each is a remote code-execution surface for your agents.
- Sandbox the host process. Run MCP servers in containers with read-only filesystems where possible, dropped capabilities, and network policies limiting egress.
- Sanitize every tool argument as untrusted. Canonicalize paths before file access. Validate URLs against an allow-list before HTTP fetches. Reject IPs in private/metadata ranges.
- Disable verbose request logging by default. If logging is needed, redact OAuth bearer tokens, cookies, and Authorization headers at the transport layer.
- Implement explicit authorization. Don't trust the client-asserted owner/tenant. Authenticate the MCP client and check it against an access policy on every invocation.
- Constrain prompt-injection blast radius. Treat any content the agent reads as adversarial. Require human-in-the-loop confirmation for tool invocations that touch sensitive resources.
- Track upstream CVEs. The MCP ecosystem moves fast. Subscribe to our feed to catch new MCP CVEs as they are published.