This page is part of our MCP Security Center, within The MCP Guide. Want a second opinion on your setup? Request a free MCP readiness review.
This tracker lists notable MCP security incidents and vulnerabilities, each confirmed on a primary source: a GitHub security advisory, the NVD, a vendor bulletin or the researcher's own write-up. Each entry gives the date, the affected product, what happened, the fix and a link. It is not exhaustive, and it was last checked on 28 October 2026.
It is not exhaustive by design. A keyword search of the NVD for "Model Context Protocol," run through the NVD API on 28 October 2026, returned 155 CVE records. That search also misses records that never use the phrase, such as the mcp-remote flaw below. We picked entries that teach something useful or affect widely used software.
Use the tracker to spot patterns, check your own software, and brief your team. Always read the linked source before acting, since advisories get updated.
Key Takeaways
- The most common pattern in 2026 advisories is an HTTP mode with weak or no authentication, often exposing the operator's own credentials.
- Official SDKs have had flaws too, including DNS rebinding protection that was off by default before late 2025.
- Several of the most cited "incidents" were research demonstrations of prompt injection, not bugs in the server code.
- At least one malicious MCP package impersonated a real company and copied users' emails.
- Nearly every fix was "upgrade to version X," so knowing your versions is the first defense.
- Dates below are the date the primary source was published, which can differ from the NVD publication date.
How we built this tracker
We included an entry only if we opened a primary source for it. News articles, vendor "top threats" lists and search snippets did not count. Where a CVE exists, we name it. Where sources disagree on a version number, we say so.
Severity scores are left out on purpose. Scores differ between scoring systems and between the NVD and the reporting project. Read the advisory for the current score.
Research disclosures and incidents
These entries are demonstrations or incidents without a single code fix, or where the fix was to stop using something.
| Date | Product | What happened | Fix or response | Source |
|---|---|---|---|---|
| 1 Apr 2025 | MCP clients generally | Researchers showed "tool poisoning": hidden instructions in a tool description led an agent to read SSH keys and config files and pass them out. Also described rug pulls and tool shadowing. | Show full tool descriptions; pin versions with hashes; enforce boundaries between servers | Invariant Labs |
| 26 May 2025 | GitHub MCP server (with an AI agent) | A prompt injection in a public GitHub issue led an agent to pull data from the user's private repositories into a public pull request. The authors say it is "not a flaw in the GitHub MCP server code itself." | Limit the agent to one repository per session; monitor agent tool calls | Invariant Labs |
| 24 Jun 2025 | Anthropic's reference Slack MCP server (archived) | A prompt-injected agent could post a link containing secrets; Slack's link preview then sent the data to the attacker. Later recorded as CVE-2025-34072. | No patch; the server was archived on 29 May 2025. Stop using it or disable link unfurling locally. | Embrace The Red |
| 8 Jul 2025 | Supabase MCP server (with Cursor) | A support ticket carrying hidden instructions led the assistant to read an integration_tokens table under the service_role and post it into the ticket thread. | Use read_only=true, scope to one project, keep secrets out of the assistant's reach | General Analysis |
| 25 Sep 2025 | Fake "postmark-mcp" npm package | A package impersonating Postmark added a backdoor in version 1.0.16 that blind-copied emails to an outside server. Postmark says it had no involvement. | Remove the package, check email logs, rotate credentials sent by email | Postmark |
CVEs in MCP software, 2025
| Date | CVE and product | What happened | Fix | Source |
|---|---|---|---|---|
| 13 Jun 2025 | CVE-2025-49596, MCP Inspector | No authentication between the Inspector client and its proxy, so unauthenticated requests could launch commands over stdio (remote code execution). | 0.14.1 | GitHub advisory |
| 1 Jul 2025 | CVE-2025-53109 and CVE-2025-53110, Filesystem reference server | Symlinks, and paths sharing a prefix with an allowed folder, could reach files outside allowed directories. | 2025.7.01 (npm version numbers differ between the advisory and the NVD) | GitHub advisory |
| 9 Jul 2025 | CVE-2025-6514, mcp-remote | A malicious server could return a crafted authorization_endpoint that ran OS commands on the user's machine; fully demonstrated on Windows. | 0.1.16 | JFrog |
| 1 Aug 2025 | CVE-2025-54136, Cursor | An already-approved MCP config could be swapped for a malicious command without a new prompt. | 1.3 | GitHub advisory |
| 2 Aug 2025 | CVE-2025-54135, Cursor | Through prompt injection, the agent could create a missing .cursor/mcp.json without approval, adding a malicious server. | 1.3.9 | GitHub advisory |
| 7 Oct 2025 | CVE-2025-53967, Framelink Figma MCP server | Command injection in a curl fallback built from unsanitized URL and header values. | 0.6.3 | Imperva |
| 2 Dec 2025 | CVE-2025-66414, official TypeScript SDK | DNS rebinding protection was not on by default for local HTTP servers without authentication. stdio not affected. | 1.24.0 | GitHub advisory |
| 2 Dec 2025 | CVE-2025-66416, official Python SDK | Same issue for FastMCP HTTP servers on localhost. | 1.23.0 | GitHub advisory |
| 17 Dec 2025 | CVE-2025-68143, mcp-server-git (reference) | The git_init tool accepted any path, making any reachable directory a target for later git operations. | 2025.9.25 (tool removed) | GitHub advisory |
CVEs in MCP software, 2026 (to 28 October)
| Date | CVE and product | What happened | Fix | Source |
|---|---|---|---|---|
| 4 Feb 2026 | CVE-2026-25536, official TypeScript SDK | Reusing one server or transport across clients could send one client's responses to another. | 1.26.0 | GitHub advisory |
| 24 Feb 2026 | CVE-2026-27825, mcp-atlassian | A download tool wrote to any path, allowing arbitrary file writes and code execution. | 0.17.0 | GitHub advisory |
| 15 May 2026 | CVE-2026-13341, Kong Konnect MCP server | Attacker-controlled analytics fields, returned to the AI unfiltered, enabled indirect prompt injection. | 1.0.0 | GitHub advisory |
| 20 May 2026 | CVE-2026-48039, meta-ads-mcp | HTTP mode ran tools without authentication and could leak the operator's access token in error responses. | 1.0.109 | GitHub advisory |
| 19 Jun 2026 | CVE-2026-58201, Lokka (Microsoft 365 MCP server) | A crafted path could send an Azure bearer token to an unintended host. | 2.1.2 | GitHub advisory |
| 21 Jun 2026 | CVE-2026-59971, MySQL MCP Server | SSE mode had no authentication, bound to all interfaces and lacked DNS rebinding protection, allowing unauthenticated SQL. | 0.4.2 | GitHub advisory |
| 22 Jun 2026 | CVE-2026-61560, @zereight/mcp-gitlab | SSE mode exposed all tools without authentication; a file-read tool could expose the GitLab token. | 2.1.27 (advisory awaiting reporter confirmation) | GitHub advisory |
| 10 Jul 2026 | CVE-2026-77244, mcp-atlassian | HTTP transport accepted any token and fell back to the operator's own Jira and Confluence credentials. | 0.22.0 | GitHub advisory |
| 14 Jul 2026 | CVE-2026-15643, AWS HealthLake MCP server | SSRF through a crafted pagination token could send AWS temporary credentials to an attacker. | 0.0.14 | AWS bulletin |
| 21 Jul 2026 (NVD) | CVE-2026-65056, mcp-webresearch | A page-visit tool did not block internal or cloud metadata addresses (SSRF). | No fix documented; upstream repository archived | Researcher write-up |
| 4 Sep 2026 | CVE-2026-93982, OpenPanel | MCP tokens passed in URL query strings were written to plaintext logs. | No patched version listed | GitHub advisory |
| 30 Sep 2026 | CVE-2026-104850, official TypeScript SDK | The OAuth client let a malicious MCP server choose which authorization server received stored credentials. | 1.31.0 (1.x) or @modelcontextprotocol/client 2.2.0; rotate secrets if exposed | GitHub advisory |
| 2 Oct 2026 | CVE-2026-111767, official TypeScript SDK | Experimental tasks were not tied to the session that created them, so clients sharing a task store could read or cancel each other's tasks. | 1.32.0 | GitHub advisory |
Patterns worth acting on
Reading these sources side by side shows a few repeat themes.
- Unauthenticated HTTP modes. The MySQL, GitLab, Meta Ads and Atlassian entries all involve a network mode that skipped authentication. The Streamable HTTP spec says servers "SHOULD implement proper authentication for all connections." See exposed local MCP servers.
- Fallback to the operator's credentials. When a caller had no token, several servers used the operator's own token. That turns a missing check into full account access.
- DNS rebinding and localhost. Both official SDKs and at least one server had gaps here. See DNS rebinding and local MCP servers.
- Command injection. mcp-remote and the Figma server built shell commands from untrusted input. See command injection in local MCP servers.
- Prompt injection plus powerful tools. The GitHub, Supabase and Slack cases needed no classic code bug. In the Kong case, the fix was to neutralize untrusted data before returning it to the AI. See prompt injection through tool results.
- SSRF and token leaks. The AWS, Lokka and mcp-webresearch entries let an attacker steer requests or credentials to the wrong host.
How to use this tracker
- List the MCP servers, SDKs and clients you run, with versions.
- Compare them against the tables and against each project's own Security tab.
- Upgrade anything below a fixed version. If no fix exists, remove or isolate the software.
- Rotate credentials where an advisory says exposure was possible.
- Re-check monthly. New MCP advisories were still appearing weekly in October 2026.
Our MCP security checklist turns these lessons into ongoing controls.
Next step
Not sure whether any of these affect you? Our MCP readiness audit checks the versions you run against known advisories and flags what to fix first. More guides are in the MCP security center.
Frequently asked questions
Is this a complete list of MCP vulnerabilities?
No. An NVD keyword search alone returned 155 records for "Model Context Protocol" on 28 October 2026, and it misses records that use other wording. This page lists selected, sourced entries. Search the NVD and each project's advisories for anything you run.
Why are some well-known incidents missing?
We left out anything we could not confirm on a primary source we opened. For example, we did not find the affected vendor's own post for every widely reported incident. Coverage in the press alone was not enough.
Are official MCP SDKs safe to use?
They are maintained, and their flaws are published and fixed, which is a good sign. The TypeScript and Python SDKs both had advisories in this tracker. Keep them updated like any other dependency.
Why do dates differ from the NVD?
We list the date the primary source was published. NVD records often appear days or weeks later. Where only the NVD date was available, the table says so.
Does a CVE mean a server is unsafe to use?
Not on its own. A published, fixed CVE shows the project responds to reports. The risk is running a version below the fix, or a project that never fixes reported issues.
How often is this tracker updated?
It was last checked on 28 October 2026. Treat it as a snapshot and check the linked advisories for the latest status.
