AI Threat Alert
Model Context Protocol (MCP) Security
MCP is rapidly becoming the standard way LLM agents call tools and fetch resources. Its attack surface is wide — and largely undocumented. This page tracks every MCP-related CVE we have analyzed.
100
MCP CVEs tracked
22
Critical severity
49
High severity
What is MCP?
The Model Context Protocol (MCP) is an open standard introduced by Anthropic in late 2024. It lets LLM-powered agents discover and invoke tools (file system, shell, HTTP, databases, third-party APIs) through a uniform client/server interface. By mid-2026 MCP is supported by Claude Desktop, Cursor, LangFlow, n8n, OpenAI Codex CLI, Gemini CLI, LiteLLM, PraisonAI, and dozens of community implementations.
MCP solves real fragmentation problems — but it also massively expands the attack surface of the LLM layer. Every MCP server is, in effect, a piece of remote-callable infrastructure that an agent will trust to execute commands and return data. Most MCP servers in the wild are written quickly, lightly audited, and run with broad privileges.
Common MCP attack patterns (observed in real CVEs)
1. Path traversal via tool arguments
MCP tool inputs (file paths, resource URIs) flow directly into fs.readFile or similar primitives. Without canonicalization, an agent prompt can read or write arbitrary files. Real-world impact: full RCE when the file written is a configuration with code-execution semantics.
2. SSRF via HTTP tools
MCP fetch tools that don't restrict target URLs let attackers reach 169.254.169.254 (cloud metadata), private VPC ranges, or internal services. We see SSRF chained with API key exfiltration in tools like n8n-mcp.
3. Credential leakage via HTTP transport logging
Many MCP servers default to verbose request logging. OAuth tokens, API keys, and session cookies end up in logs that downstream agents can read. Multiple CVEs we track exploit this exact pattern.
4. Owner-context spoofing and authorization bypass
MCP doesn't dictate authorization between client and server. Naive implementations trust the client-asserted identity, which a malicious tool can spoof. Result: privilege escalation across tenants.
5. Prompt-injection driven tool invocation chains
An attacker who controls any content surface the agent reads (web page, email, RAG document) can plant instructions that cause the agent to invoke MCP tools with attacker-controlled arguments — chaining what would otherwise be benign tools into a working exploit.
MCP-related CVEs we are tracking
| CVE | Severity | Headline | Published |
|---|---|---|---|
| CVE-2026-12940 | CRITICAL | Langflow: unauth RCE via MCP env var injection | Jul 30, 2026 |
| CVE-2026-67429 | CRITICAL | flyto-core: arbitrary file write via bypassed path guard | Jul 30, 2026 |
| CVE-2026-9135 | CRITICAL | Langflow: code injection bypasses ToolGuard, enables RCE | Jul 17, 2026 |
| CVE-2026-30623 | CRITICAL | LiteLLM: RCE via unsanitized MCP server config | Jul 15, 2026 |
| CVE-2026-54052 | CRITICAL | n8n-mcp: broken tenant isolation leaks workflow credentials | Jul 14, 2026 |
| CVE-2026-61459 | CRITICAL | mcp-server-kubernetes: arg injection exfils bearer token | Jul 10, 2026 |
| CVE-2026-50027 | CRITICAL | mcp-memory-service: auth bypass on document API | Jul 2, 2026 |
| CVE-2026-7663 | CRITICAL | Langflow: auth bypass in MCP transport exposes projects | Jun 30, 2026 |
| CVE-2025-71336 | CRITICAL | Flowise: unauthenticated RCE via Custom MCP endpoint | Jun 25, 2026 |
| CVE-2026-56274 | CRITICAL | Flowise: RCE via MCP server command validation bypass | Jun 23, 2026 |
| CVE-2026-7664 | CRITICAL | Langflow: auth bypass in MCP endpoint, CVSS 9.8 | Jun 22, 2026 |
| GHSA-j4f3-55x4-r6q2 | CRITICAL | praisonai: MCP HTTP server unauthenticated tool invocation | Jun 18, 2026 |
| GHSA-vmmj-pfw7-fjwp | CRITICAL | praisonai: sandbox escape gives RCE via codeMode tool | Jun 18, 2026 |
| GHSA-p75f-6fp4-p57w | CRITICAL | PraisonAI: unauthenticated RCE via MCP connect endpoint | Jun 18, 2026 |
| GHSA-x227-pf99-vffg | CRITICAL | praisonaiagents: unauthenticated MCP SSE server enables RCE | Jun 18, 2026 |
| CVE-2026-46339 | CRITICAL | 9router: unauthenticated RCE exposes LLM API keys | May 19, 2026 |
| CVE-2026-44336 | CRITICAL | PraisonAI: MCP path traversal escalates to full RCE | May 11, 2026 |
| GHSA-9qhq-v63v-fv3j | CRITICAL | PraisonAI: RCE via MCP command injection | Apr 17, 2026 |
| CVE-2026-40933 | CRITICAL | Flowise: RCE via MCP stdio command injection | Apr 16, 2026 |
| CVE-2025-61260 | CRITICAL | OpenAI Codex CLI: RCE via malicious MCP config files | Apr 14, 2026 |
| CVE-2026-27825 | CRITICAL | mcp-atlassian: Path Traversal enables file access | Mar 10, 2026 |
| CVE-2025-59528 | CRITICAL | Flowise: Unauthenticated RCE via MCP config injection | Sep 22, 2025 |
| GHSA-p7w7-4929-vpj5 | HIGH | Dynatrace MCP server: unauth HTTP data exfil via DQL | Jul 31, 2026 |
| CVE-2026-14538 | HIGH | Google mcp-toolbox: BigQuery allowedDatasets bypass | Jul 31, 2026 |
| CVE-2026-15829 | HIGH | MCP Toolbox: SQLi bypasses BigQuery allowedDatasets ACL | Jul 21, 2026 |
| CVE-2026-7755 | HIGH | Langflow: MCP config validation gap enables RCE | Jul 17, 2026 |
| CVE-2026-54449 | HIGH | LangBot: RCE via arbitrary STDIO MCP command | Jul 15, 2026 |
| CVE-2026-61427 | HIGH | PraisonAI: MCP server auth bypass by default | Jul 15, 2026 |
| CVE-2026-50158 | HIGH | yutu: arbitrary file write via MCP caption-download tool | Jul 14, 2026 |
| CVE-2026-62195 | HIGH | OpenClaw: MCP loopback auth bypass on owner tools | Jul 13, 2026 |
| GHSA-g5r6-gv6m-f5jv | HIGH | mcp-atlassian: path traversal leaks secrets via injection | Jul 10, 2026 |
| GHSA-wm45-qh3g-v83f | HIGH | mcp-atlassian: path traversal leaks server files+creds | Jul 10, 2026 |
| GHSA-52vm-mxx8-f227 | HIGH | Phantom MCP: unconfined output path enables file write | Jul 9, 2026 |
| CVE-2026-59723 | HIGH | Cline: missing Origin check on Hub enables RCE | Jul 8, 2026 |
| CVE-2026-59822 | HIGH | LiteLLM: MCP auth bypass via fabricated OAuth header | Jul 8, 2026 |
| CVE-2026-53518 | HIGH | better-auth: race condition mints duplicate OAuth tokens | Jul 7, 2026 |
| CVE-2026-49857 | HIGH | auth-fetch-mcp: SSRF bypass via IPv6 loopback | Jul 1, 2026 |
| CVE-2026-12773 | HIGH | litellm: auth bypass in MCP proxy, no credentials required | Jun 21, 2026 |
| GHSA-mrvx-jmjw-vggc | HIGH | mcp-searxng: SSRF via DNS rebinding in web_url_read | Jun 19, 2026 |
| GHSA-xcqx-9jf5-w339 | HIGH | mcp-searxng: DoS via unbounded URL response read | Jun 19, 2026 |
| GHSA-vcv2-r9jh-99m5 | HIGH | agentic-flow: MCP tool args enable OS command injection RCE | Jun 19, 2026 |
| CVE-2026-49357 | HIGH | line-desktop-mcp: unauthenticated HTTP exposes LINE chats | Jun 19, 2026 |
| GHSA-fq4x-789w-jg5h | HIGH | agenticmail: email prompt injection → bypassPermissions RCE | Jun 18, 2026 |
| GHSA-4qq2-2j2x-x62c | HIGH | praisonai: MCP auth bypass exposes agent tools | Jun 18, 2026 |
| GHSA-j7qx-p75m-wp7g | HIGH | PraisonAI: path traversal exposes arbitrary host files | Jun 18, 2026 |
| GHSA-vmf9-xx9w-86wx | HIGH | PraisonAI: DNS rebinding exposes MCP agent tools | Jun 18, 2026 |
| CVE-2026-53840 | HIGH | OpenClaw: credential exfiltration via MCP header forwarding | Jun 16, 2026 |
| CVE-2026-53814 | HIGH | OpenClaw: privilege escalation via hook-triggered MCP scope | Jun 11, 2026 |
| CVE-2026-46519 | HIGH | mcp-server-kubernetes: auth bypass enables full cluster RCE | May 21, 2026 |
| GHSA-hv85-774v-26fg | HIGH | auth-fetch-mcp: SSRF + disk-exfil via unvalidated tool URLs | May 19, 2026 |
| CVE-2026-45707 | HIGH | n8n-mcp: tenant isolation bypass, operator RCE risk | May 18, 2026 |
| CVE-2026-45350 | HIGH | open-webui: missing authz allows admin tool hijacking | May 14, 2026 |
| GHSA-m99r-2hxc-cp3q | HIGH | Flowise MCP: 3-path blocklist bypass enables server RCE | May 14, 2026 |
| GHSA-8g7g-hmwm-6rv2 | HIGH | n8n-mcp: path traversal + SSRF exposes n8n API keys | May 8, 2026 |
| CVE-2026-42271 | HIGH | LiteLLM: RCE via MCP test endpoint command injection | May 8, 2026 |
| CVE-2026-42079 | HIGH | PPTAgent: eval injection enables RCE via LLM prompt injection | May 5, 2026 |
| GHSA-r6xh-pqhr-v4xh | HIGH | openclaw: MCP owner-context spoofing, privilege escalation | May 4, 2026 |
| CVE-2026-42449 | HIGH | n8n-mcp: SSRF bypass via IPv6 leaks API keys | Apr 30, 2026 |
| GHSA-v4p8-mg3p-g94g | HIGH | litellm: RCE via MCP test endpoints privilege bypass | Apr 25, 2026 |
| GHSA-cvrr-qhgw-2mm6 | HIGH | Flowise: unauthenticated RCE via FILE-STORAGE bypass | Apr 16, 2026 |
| CVE-2026-30617 | HIGH | LangChain-ChatChat: RCE via unauthenticated MCP interface | Apr 15, 2026 |
| GHSA-p4h8-56qp-hpgv | HIGH | mcp-ssh: argument injection enables LLM-driven local RCE | Apr 14, 2026 |
| GHSA-75hx-xj24-mqrw | HIGH | n8n-mcp: unauthenticated HTTP endpoints enable DoS + recon | Apr 10, 2026 |
| CVE-2026-39974 | HIGH | n8n-MCP: SSRF exposes cloud metadata via MCP headers | Apr 9, 2026 |
| GHSA-4ggg-h7ph-26qr | HIGH | n8n-mcp: authenticated SSRF leaks cloud metadata | Apr 8, 2026 |
| CVE-2026-35394 | HIGH | mobile-mcp: intent injection enables device control via AI agent | Apr 4, 2026 |
| CVE-2026-29872 | HIGH | awesome-llm-apps MCP Agent: cross-session credential theft | Mar 30, 2026 |
| CVE-2026-33989 | HIGH | @mobilenext/mobile-mcp: path traversal via AI agent tool | Mar 27, 2026 |
| CVE-2026-27826 | HIGH | mcp-atlassian: SSRF allows internal network access | Mar 10, 2026 |
| CVE-2026-0621 | HIGH | mcp_typescript_sdk: security flaw enables exploitation | Jan 5, 2026 |
| CVE-2025-66404 | HIGH | mcp-server-kubernetes: Command Injection enables RCE | Dec 3, 2025 |
| GHSA-xrmj-5g4g-8987 | MEDIUM | Dynatrace MCP: Jinja injection creates persistent exfil | Jul 31, 2026 |
| GHSA-pqh8-p93p-2rx7 | MEDIUM | Dynatrace MCP server: DQL injection bypasses read-tool caps | Jul 31, 2026 |
| CVE-2026-66005 | MEDIUM | Jan: CORS misconfig exposes local LLM API to network | Jul 24, 2026 |
| GHSA-vhf8-cg2h-cg3p | MEDIUM | n8n: MCP Client SSRF bypasses egress protection | Jul 22, 2026 |
| CVE-2026-65594 | MEDIUM | n8n: authz bypass hijacks other users' MCP workflows | Jul 22, 2026 |
| CVE-2026-62208 | MEDIUM | OpenClaw: Auth header leak via MCP SSE redirects | Jul 17, 2026 |
| CVE-2026-47751 | MEDIUM | Claude Code Action: RCE via malicious PR .mcp.json config | Jul 16, 2026 |
| CVE-2026-55608 | MEDIUM | n8n-mcp: cross-tenant leak of workflow backups | Jul 14, 2026 |
| GHSA-489g-7rxv-6c8q | MEDIUM | mcp-atlassian: DNS-rebind bypass revives header SSRF | Jul 10, 2026 |
| CVE-2026-59207 | MEDIUM | n8n: MCP tool bypasses credential domain allowlist | Jul 9, 2026 |
| CVE-2026-55435 | MEDIUM | Coder AI Bridge: suspended user auth bypass | Jul 6, 2026 |
| GHSA-qh2f-99mv-mrcf | MEDIUM | OpenClaw: exec denylist bypass in bundled MCP loopback | Jul 2, 2026 |
| GHSA-9c3v-684m-579c | MEDIUM | OpenClaw: MCP SSE redirect leaks Authorization headers | Jul 1, 2026 |
| CVE-2026-58057 | MEDIUM | Flowise: NODE_OPTIONS denylist bypass allows RCE | Jun 28, 2026 |
| CVE-2026-12798 | MEDIUM | litellm: SSRF in MCP OpenAPI spec loader endpoint | Jun 21, 2026 |
| CVE-2026-12774 | MEDIUM | litellm: SSRF in MCP server exposes cloud metadata | Jun 21, 2026 |
| CVE-2026-53820 | MEDIUM | OpenClaw: exec denylist bypass via MCP session-spawn | Jun 12, 2026 |
| CVE-2026-53818 | MEDIUM | OpenClaw: MCP loopback auth bypass enables policy evasion | Jun 11, 2026 |
| CVE-2026-47250 | MEDIUM | mcp-server-kubernetes: flag injection steals K8s tokens | Jun 5, 2026 |
| CVE-2026-9468 | MEDIUM | cline-mcp-memory-bank: path traversal in memory init | May 25, 2026 |
| CVE-2026-45582 | MEDIUM | n8n-mcp: telemetry leak exposes workflow URL secrets | May 18, 2026 |
| CVE-2026-42282 | MEDIUM | n8n-MCP: credential logging exposes OAuth tokens in HTTP mode | May 8, 2026 |
| CVE-2026-43901 | MEDIUM | wireshark-mcp: path traversal enables arbitrary file write via MCP | May 5, 2026 |
| GHSA-7jm2-g593-4qrc | MEDIUM | openclaw: config guard bypass, persistent settings mutation | Apr 25, 2026 |
| GHSA-qrp5-gfw2-gxv4 | MEDIUM | openclaw: tool policy bypass via bundled MCP/LSP tools | Apr 25, 2026 |
| GHSA-mj59-h3q9-ghfh | MEDIUM | openclaw: env var injection via MCP stdio config | Apr 25, 2026 |
| GHSA-wg4g-395p-mqv3 | MEDIUM | n8n-mcp: credential exposure via HTTP transport logging | Apr 25, 2026 |
| CVE-2026-41495 | MEDIUM | n8n-mcp: bearer tokens exposed in HTTP transport logs | Apr 23, 2026 |
| CVE-2026-6599 | MEDIUM | Langflow: MCP config injection via X-Forwarded-For header | Apr 20, 2026 |
How to protect MCP deployments
- Inventory every MCP server in your stack. Treat them like web services, not "just config". Each is a remote code-execution surface for your agents.
- Sandbox the host process. Run MCP servers in containers with read-only filesystems where possible, dropped capabilities, and network policies limiting egress.
- Sanitize every tool argument as untrusted. Canonicalize paths before file access. Validate URLs against an allow-list before HTTP fetches. Reject IPs in private/metadata ranges.
- Disable verbose request logging by default. If logging is needed, redact OAuth bearer tokens, cookies, and Authorization headers at the transport layer.
- Implement explicit authorization. Don't trust the client-asserted owner/tenant. Authenticate the MCP client and check it against an access policy on every invocation.
- Constrain prompt-injection blast radius. Treat any content the agent reads as adversarial. Require human-in-the-loop confirmation for tool invocations that touch sensitive resources.
- Track upstream CVEs. The MCP ecosystem moves fast. Subscribe to our feed to catch new MCP CVEs as they are published.