Other MCP servers and tools vulnerabilities and CVEs

CVE-2026-77361

obsidian-tc : Symlink read-ACL scope bypass via lexical path checks

CVE-2026-114126

Storybook dev server vulnerable to code injection from the local network

CVE-2026-113731

djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool

CVE-2026-114125

Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites

CVE-2026-111770

MCP TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another

GHSA-953h-535j-jg2v

agent-router: MCP session resume does not verify the embedded anti-hijacking subject; default Helm seed makes session IDs forgeable

CVE-2026-76894

ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)

CVE-2026-96620

Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution

CVE-2026-84316

Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)

CVE-2026-84317

Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)

CVE-2026-84318

Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE

CVE-2026-84319

Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context

CVE-2026-84360

Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools

CVE-2026-61427

PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface

CVE-2026-61435

PraisonAI: Call API localhost-only authentication bypass via spoofed Host header

CVE-2026-94486

Next.js has information disclosure in development server's Model Context Protocol endpoint

CVE-2026-105806

Payload: Improper access control for MCP API keys

GHSA-p23f-cm6q-2qp8

SiYuan MCP asset.upload Reads Arbitrary Absolute File Paths (Workspace Boundary Bypass)

GHSA-x8gv-g2g3-65fj

SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU (Bypass of CheckHostSSRF)

CVE-2026-86439

Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools

CVE-2026-61742

DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution

CVE-2026-61788

@bytebase/dbhub's read-only mode does not prevent database writes

CVE-2026-61612

@aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509

CVE-2026-61647

@roomi-fields/notebooklm-mcp has a path traversal in vault.batch tool that allows arbitrary file write outside intended vault directory

CVE-2026-77243

MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass

CVE-2026-77244

[mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token

CVE-2026-77246

MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path

CVE-2026-77247

MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters

CVE-2026-77248

MCP Atlassian: Unauthenticated arbitrary local file read via upload_attachment file_path, chained with missing auth on streamable-http transport

CVE-2026-77249

MCP Atlassian: Incomplete fix for GHSA-7r34-79r5-rcc9: redirect-based SSRF via unhooked requests session in Jira user-permission lookup

CVE-2026-77250

MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions

CVE-2026-77251

MCP Atlassian: JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER allow forbidden-project content exfiltration (one LIVE-proven on Atlassian Cloud)

CVE-2026-77253

MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files

CVE-2026-77255

MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issue

CVE-2026-77257

MCP Atlassian: HTTP upload tools accept arbitrary server-local file paths

CVE-2026-77258

MCP Atlassian: Arbitrary file read/exfiltration via upload_attachment missing validate_safe_path()

CVE-2026-77259

MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials

CVE-2026-77260

MCP Atlassian: Arbitrary local file READ via unconstrained file_path in upload_attachment (Confluence + Jira)

CVE-2026-77261

MCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branches

CVE-2026-77262

MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of GHSA-xjgw-4wvw-rgm4)

CVE-2026-77265

MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flow

CVE-2026-77266

MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read and exfiltration via MCP tool call

CVE-2026-77267

mcp-atlassian has an incomplete SSRF remediation

CVE-2026-77268

MCP Atlassian: Insecure File Permissions on OAuth Token Storage

CVE-2026-77269

MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read (incomplete fix for CVE-2026-27825)

CVE-2026-77270

MCP Atlassian: Arbitrary File Read via Upload Attachment Tools

CVE-2026-77271

MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of GHSA-xjgw-4wvw-rgm4)

CVE-2026-77272

MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler

CVE-2026-77274

MCP Atlassian: SSRF Protection Bypass

CVE-2026-58197

ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement

CVE-2026-77339

Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools

GHSA-jgh3-fggc-mcpm

Obot: Server-Side Request Forgery via remote MCP server URL

GHSA-xwmw-prc4-v3cr

Obot: OAuth Dynamic Client Registration Enables API Token Theft via Audience Confusion

CVE-2026-61560

@zereight/mcp-gitlab: Unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover

CVE-2026-61559

@zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery

CVE-2026-61568

@zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport

GHSA-5648-rgj9-v224

@zereight/mcp-gitlab has multiple safety-control bypasses: execute_graphql read-only + allow-list bypass, unauthenticated transports, session-exhaustion DoS

CVE-2026-59971

MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)

CVE-2026-59973

FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix

CVE-2026-59176

functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic Import

CVE-2026-75858

CodeWhale: rlm_eval auto-approves arbitrary Python execution, bypassing the user's approval policy (RCE)

CVE-2026-75914

CodeWhale: image_analyze follows workspace symlinks, leaking external file bytes

CVE-2026-75915

CodeWhale: js_execution leaks parent environment to model context via missing env scrub

CVE-2026-62681

Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)

CVE-2026-73844

CKAN MCP Server: Information disclosure via verbose error reflection

CVE-2026-73846

CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning

CVE-2026-62674

Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE

CVE-2026-73845

CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)

CVE-2026-55529

PraisonAI has an origin validation bypass in MCP HTTP Stream transport that allows browser-mediated unauthenticated tool execution on local MCP server

CVE-2026-55531

PraisonAI MCP HTTP server has unauthenticated unbounded session accumulation (memory exhaustion; session TTL never enforced)

CVE-2026-55532

PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server

CVE-2026-55546

qwed-mcp has Unsafe SymPy `parse_expr()` Remote Code Execution via Unsanitized Math Expression Input

CVE-2026-55557

browse-mcp has an arbitrary file write via unconfined download and state paths

CVE-2026-55580

mcp-shell — Security Disabled by Default in Bare-Binary Deploy Path + Shell Interpreter in Secure-Mode Allowlist

CVE-2026-55581

mcp-shell has a Secure Mode Allowlist Bypass via Default `/bin/bash` Executable

CVE-2026-55582

mcp-shell has a Secure Mode Allowlist Bypass via Git Shell Alias

CVE-2026-55604

@arikusi/deepseek-mcp-server has an Authorization Bypass Through User-Controlled Key

CVE-2026-55605

@arikusi/deepseek-mcp-server: Missing Authentication on Self-Hosted HTTP MCP Endpoint

CVE-2026-55609

consciousness-explorer / sublinear-time-solver MCP export_state has an arbitrary file write

CVE-2026-55637

genieacs-mcp: DNS rebinding reaches local GenieACS MCP Streamable HTTP transport

CVE-2026-55640

nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )

GHSA-vwf3-4xxj-qg6h

mcp-contextforge-gateway has Server-Side Template Injection (SSTI) leading to Remote Code Execution in `PromptService._render_template` via unsandboxed Jinja2 Environment

CVE-2026-53710

mcp-contextforge-gateway has RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server

CVE-2026-53957

Contentful MCP Server: export_space/import_space tools pass LLM-controlled `host`/`proxy` args to CMA client, redirecting server PAT to attacker-controlled endpoint

CVE-2026-53965

MCP PHP SDK: client HttpTransport SSE buffer (sseBuffer .= chunk) grows unbounded when server withholds the event delimiter

CVE-2026-54688

SearXNG MCP Server is Vulnerable to SSRF in web_url_read: the internal-address guard is disabled by default (MCP_HTTP_HARDEN off)

CVE-2026-54689

SearXNG MCP Server: Additional hardened-mode SSRF bypasses

GHSA-cc2g-gq8c-r332

grok-faf-mcp has an arbitrary local file read via unconfined `path` argument in FAF tools

GHSA-hjwh-xvfw-qrwj

SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses

GHSA-j4r7-8ph4-43g3

faf-mcp has an arbitrary local file read/write via unconfined `path` argument in FAF tools

GHSA-rr55-jp92-8wp2

claude-faf-mcp has an arbitrary local file read/write via unconfined `path` argument in FAF tools

CVE-2026-53766

chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots

GHSA-xhcr-cqfr-m3hv

atomic-agents-stack: HTTP MCP catalog accepts cleartext http and spawns catalog-supplied commands (MITM to RCE)

CVE-2026-53708

ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)

CVE-2026-55156

Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints

CVE-2026-55157

Token Optimizer MCP: OS command injection in smart_user via username in get-user-info

CVE-2026-55071

MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`

CVE-2026-54785

gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode

GHSA-p7w7-4929-vpj5

`@dynatrace-oss/dynatrace-mcp-server` has Unauthenticated HTTP MCP Tool Invocation

GHSA-pqh8-p93p-2rx7

@dynatrace-oss/dynatrace-mcp-server has a DQL injection via parameters not documented as DQL

GHSA-xrmj-5g4g-8987

@dynatrace-oss/dynatrace-mcp-server has a workflow template injection via create_workflow_for_notification

CVE-2026-63118

MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection

CVE-2026-63119

MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)

CVE-2026-67427

Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted

CVE-2026-67428

Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF to internal/metadata)

CVE-2026-67429

Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)

CVE-2026-67430

MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood

CVE-2026-67431

MCP Ruby SDK: Ruby SSE Session Poisoning

CVE-2026-67432

MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport

GHSA-pc2w-4mq8-32qw

@dynatrace-oss/dynatrace-mcp-server's create_dynatrace_notebook missing the human-approval gate

CVE-2026-47427

GitHub MCP Server has Nil Pointer Dereference DoS in completion/complete Handler

CVE-2026-16584

AWS API MCP Server Security Policy Bypass via Startup Initialization Failure

CVE-2026-66004

BlenderMCP path traversal in download_polyhaven_asset allows arbitrary file writes

CVE-2026-54547

meta-ads-mcp: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token

CVE-2026-54549

meta-ads-mcp: Server-Side Request Forgery (SSRF) in `upload_ad_image` via Unrestricted `image_url` Fetch

CVE-2026-54561

mcp-memory-keeper: Arbitrary local file read in context_import via unvalidated filePath

GHSA-rjwr-m7qx-3fjr

oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code

CVE-2026-54449

LangBot: Authenticated RCE Via MCP Configuration

CVE-2026-54504

@andrea9293/mcp-documentation-server: Web UI API binds to all interfaces without authentication by default

CVE-2026-58196

ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation)

GHSA-62gx-5q78-wrvx

obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} — arbitrary host file read/write/delete

CVE-2026-50125

MKP: Unbounded Pod Log Read via Attacker-Controlled `limitBytes`/`tailLines` Causes Memory Exhaustion

CVE-2026-50158

yutu: Arbitrary File Write via MCP `caption-download` Tool

CVE-2026-54052

n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments

CVE-2026-54446

NetLicensing-MCP: Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode

CVE-2026-55608

n8n-MCP: Incorrect authorization can expose default-scope workflow version backups in multi-tenant HTTP mode

CVE-2026-61459

mcp-server-kubernetes argument injection can expose Kubernetes cluster credentials

CVE-2026-73498

mcp-atlassian: Arbitrary file read via missing path validation in confluence_upload_attachment

GHSA-489g-7rxv-6c8q

MCP Atlassian: DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826)

GHSA-wm45-qh3g-v83f

mcp-atlassian: Arbitrary server-side file read via attachment upload

GHSA-382c-vx95-w3p5

Gittensory: Missing contributor-scoped access control on profile endpoint and MCP tool leaks miner financial data

GHSA-52vm-mxx8-f227

Phantom: Arbitrary file write and decode-bomb DoS via unconfined MCP tool paths

CVE-2026-53509

@aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060)

CVE-2026-53518

@better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitive

GHSA-86j7-9j95-vpqj

Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp

GHSA-q855-8rh5-jfgq

ha-mcp: Add-on settings and policy routes are reachable without authentication at the bare root path

CVE-2026-55435

Suspended Coder users retain access to AI Bridge LLM proxy endpoints

CVE-2026-50027

mcp-memory-service: Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/Delete

CVE-2026-52830

fast-mcp-telegram: Bearer token path traversal bypasses reserved Telegram session protection

GHSA-f9ff-5x35-7gfw

Grackle: Fail-open authorization in the MCP tool layer lets scoped agents perform cross-task and cross-session mutations (IDOR)

CVE-2026-49856

@jshookmcp/jshook: ICMP probe and traceroute skip local-network SSRF authorization

CVE-2026-49857

auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback

CVE-2026-49986

Cortex has Untrusted Project Bootstrap Code Execution via `CLAUDE_PROJECT_DIR`

CVE-2026-49988

repomix: attach_packed_output can bypass file-read secret scanning for supported local files

CVE-2026-50143

Apify Model Context Protocol (MCP) server: Actor MCP path authority injection leaks Apify token

CVE-2026-58168

DeepTutor missing MCP tool authorization allows non-admin users to invoke unrestricted tools

CVE-2026-11720

MCP Toolbox HTTP tool path parameters allow traversal to unintended endpoints

CVE-2026-49257

mcp-pinot: Unauthenticated tool invocation via default oauth_enabled=False + host 0.0.0.0 bind

CVE-2026-49291

mcp-memory-service: OAuth read-only clients can write and delete memories through MCP tools/call

CVE-2026-49357

Streamable HTTP mode exposes LINE Desktop read/send tools without MCP authentication

GHSA-rp72-5v5q-2446

@cardano402/mcp-server missing spending limits, LAN-exposed HTTP transport, and SSRF via catalog.server.url

CVE-2026-48529

GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion

CVE-2026-57300

Jenkins MCP Server Plugin missing a permission check

CVE-2026-9073

foreman-mcp-server Inserts Sensitive Information into Log File

CVE-2025-66336

Apache Doris MCP Server is vulnerable to SQL Injection via metadata query path

CVE-2026-46611

Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack

CVE-2026-48814

Network-AI: CVE-2026-46701 fix incomplete — empty default secret still authorizes all requests

CVE-2026-55837

dbt MCP Server: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens

GHSA-mrvx-jmjw-vggc

SearXNG MCP Server: DNS-resolved Private Hostname SSRF in `web_url_read`

GHSA-mxjx-28vx-xjjj

Network-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions

GHSA-v52w-28xh-v562

Kozou: Unauthenticated MCP HTTP server and bundled dev-stack hardening (DNS-rebinding, request-body limits, read-only reads, default network exposure)

GHSA-vcv2-r9jh-99m5

Agentic-Flow: OS Command Injection in agentic-flow MCP server tools via unsanitized tool-parameter interpolation into execSync

GHSA-x975-rgx4-5fh4

appium-mcp: Unescaped Locator Data XSS in MCP-UI Resource (createLocatorGeneratorUI)

GHSA-xcqx-9jf5-w339

SearXNG MCP Server: Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read`

CVE-2026-0755

gemini-mcp-tool vulnerable to OS command injection and @file exfiltration via prompt quoting (CVE-2026-0755)

CVE-2026-11717

googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken)

CVE-2026-11718

googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken)

CVE-2026-11719

MCP Toolbox for Databases: authenticated authorization bypass

CVE-2026-55887

Docker MCP Gateway: Argument injection via OCI image label YAML

CVE-2026-57112

PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools

CVE-2026-57124

PraisonAI: Missing Authentication for Critical Function and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai

CVE-2026-57134

npm PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation

CVE-2026-57139

npm PraisonAI MCPServer exposes unauthenticated HTTP tools/call

CVE-2026-57496

netlicensing-mcp: REST Path Traversal Bypasses Token Redaction

CVE-2026-53765

Chrome DevTools for agents: daemon.pid write follows symlinks in /tmp fallback runtime directory

CVE-2026-11624

MCP Toolbox for Databases has an Origin Validation Error

CVE-2026-48039

Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token

CVE-2026-47751

Claude Code Action: Malicious MCP Server Configuration in PRs Enables Remote Code Execution and Secret Exfiltration

CVE-2026-11529

MySQL MCP Server is Vulnerable to SQL Injection Through its mysql URI Handler

CVE-2026-47250

MCP Server Kubernetes: kubectl-generic flag injection enables Kubernetes bearer token exfiltration

CVE-2026-47708

MCP-for-Stata: Command injection via log_file_name parameter in Stata command wrapper

CVE-2026-10692

Code Index MCP is vulnerable to Uncontrolled Resource Consumption

CVE-2026-50287

@agenticmail/mcp Missing Authentication for Critical Function

CVE-2026-47394

PraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate

CVE-2026-9739

MCP Toolbox for Databases vulnerable to DNS rebinding attacks

CVE-2026-46519

MCP Server Kubernetes: Tool Access Control Bypass via Presentation-Layer Filtering Without Execution-Layer Enforcement

CVE-2026-46701

Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret

CVE-2026-48989

Windows-MCP: HTTP transports expose unauthenticated PowerShell control with wildcard CORS

CVE-2026-45781

MCP Registry: OCI validator skips ownership check on upstream rate limits

CVE-2026-45805

PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE

CVE-2026-46341

Apify Model Context Protocol (MCP) server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching

GHSA-4gph-2hhr-5mwg

Envoy AI Proxy - MCP Message Smuggling Vulnerability

GHSA-7hgr-7h44-33w2

CamoFox MCP: Unauthenticated HTTP MCP browser-control surface

GHSA-g53w-w6mj-hrpp

MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path

GHSA-hv85-774v-26fg

auth-fetch-mcp: SSRF and disk exfiltration via unvalidated auth_fetch and download_media URLs

CVE-2026-45582

n8n-MCP: Workflow telemetry sanitizer could retain partial values from URL-shaped node parameters

CVE-2026-45609

Spring AI MCP Security: Unvalidated URL Fetching (SSRF)

CVE-2026-45707

n8n-MCP: Multi-tenant MCP requests fall back to process-level n8n credentials when tenant headers are absent or incomplete

GHSA-fvh2-gm75-j4j7

dynoxide: DNS rebinding and cross-origin CSRF via MCP HTTP transport

CVE-2026-44968

dbt MCP Server has an Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters

CVE-2026-44969

dbt MCP Server Logs Tool Arguments Including SQL Queries and Credentials in Plaintext Without Redaction When File Logging Is Enabled

CVE-2026-44970

dbt MCP Server Transmits All MCP Tool Arguments Including Raw SQL and --vars Credentials to dbt Labs Telemetry by Default Without Redaction

GHSA-g39v-cvjh-8fpf

Home Assistant MCP Server: YAML config backups written under www/ are served unauthenticated at /local/

GHSA-wf8q-wvv8-p8jf

@samanhappy/mcphub: SSE Endpoint Accepts Arbitrary Username from URL Path Without Authentication, Enabling User Impersonation

GHSA-vw82-7fv8-r6gp

Obot has an authorization bypass in /mcp-connect/{id} that allows any authenticated user to use any registered MCP server

CVE-2025-65719

Open Source Kubectl MCP Server vulnerable to arbitrary code execution via user interaction with crafted HTML page

CVE-2026-30635

automagik-genie has a command injection vulnerability

CVE-2026-44336

PraisonAI MCP `tools/call` path-traversal => RCE via Python `.pth` injection

CVE-2026-44895

@yoda.digital/gitlab-mcp-server's SSE transport has no authentication and wildcard CORS, exposing all 86 GitLab tools

GHSA-v6wj-c83f-v46x

@profullstack/mcp-server vulnerable to OS Command Injection in domain_lookup Module

CVE-2026-44694

n8n-mcp webhook and API client paths has an authenticated SSRF

GHSA-52cq-7v8r-62c6

gmaps-mcp's unauthenticated HTTP transport allows unlimited Google Maps API calls at operator expense

GHSA-8g7g-hmwm-6rv2

n8n-mcp affected by path traversal, redirect-following SSRF, and telemetry payload exposure

GHSA-j7h9-2jh7-g967

mcp-ssh-tool has file transfer path policy bypass and bearer token comparison hardening

CVE-2026-42080

PPTAgent: Arbitrary File Write via `save_generated_slides`

CVE-2026-42260

open-websearch has SSRF in `fetchWebContent` MCP tool: bracketed IPv6 literals and non-resolving hostname check bypass `isPrivateOrLocalHostname`

CVE-2026-43901

wireshark-mcp vulnerable to arbitrary file write via export_objects when WIRESHARK_MCP_ALLOWED_DIRS is not configured

CVE-2026-44220

ciguard: discover_pipeline_files follows symlinks out of scan root

GHSA-8pqq-224h-x875

ogham-mcp had credentials embedded in published PyPI sdists -- Neon postgres URLs and Voyage API key

CVE-2026-7738

@puchunjie/doc-tools-mcp has a Path Traversal Issue

CVE-2026-7600

yii2-mcp-server has a Command Injection Issue

CVE-2026-42449

n8n-mcp's IPv4-mapped IPv6 addresses bypass SSRF protection in validateUrlSync(), enabling full SSRF for SDK embedders

CVE-2026-7446

mcp-server-semgrep has a Command Injection issue

CVE-2026-7159

mkdocs-mcp-plugin has a Path Traversal issue

CVE-2026-7206

sqlite-mcp has an Injection issue

CVE-2026-7212

notes-mcp has a Path Traversal issue

CVE-2026-7149

kaggle-mcp has a Path Traversal issue

CVE-2026-7150

auto-favicon has a Server-Side Request Forgery issue

CVE-2026-7158

mcp-url-downloader has a Server-Side Request Forgery issue

CVE-2026-42282

n8n-MCP: Sensitive MCP tool-call arguments logged on authenticated requests in HTTP mode

CVE-2026-41495

n8n-MCP Logs Sensitive Request Data on Unauthorized /mcp Requests

CVE-2025-66335

Apache Doris MCP Server vulnerable to SQL Injection via improper query context neutralization

CVE-2026-35402

Neo4j Labs MCP Servers: SSRF and Data Modification via read_only Mode Bypass Through CALL Procedures

CVE-2026-41497

PraisonAI has an incomplete fix for CVE-2026-34935 - OS Command Injection

CVE-2026-39313

MCP-Framework: Unbounded memory allocation in readRequestBody allows denial of service via HTTP transport

CVE-2026-30625

Upsonic: remote code execution vulnerability in its MCP server/task creation functionality

CVE-2026-39884

MCP Server Kubernetes has an Argument Injection in port_forward tool via space-splitting

CVE-2026-40576

excel-mcp-server has a Path Traversal issue

GHSA-p4h8-56qp-hpgv

SSH/SCP option injection allowing local RCE in @aiondadotcom/mcp-ssh

CVE-2026-34476

Apache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header in MCP Server

CVE-2026-5059

aws-mcp has a Command Injection Remote Code Execution Vulnerability

CVE-2026-40159

PraisonAI Vulnerable to Sensitive Environment Variable Exposure via Untrusted MCP Subprocess Execution

GHSA-75hx-xj24-mqrw

n8n-mcp has unauthenticated session termination and information disclosure in HTTP transport

CVE-2026-5832

api-lab-mcp vulnerable to SSRF

CVE-2026-5833

awwaiid mcp-server-taskwarrior vulnerable to command injection

CVE-2026-31040

stata-mcp has insufficient validation of user-supplied Stata do-file content that can lead to command execution

CVE-2026-39885

mcp-from-openapi is Vulnerable to SSRF via $ref Dereferencing in Untrusted OpenAPI Specifications

CVE-2026-39974

n8n-mcp has authenticated SSRF via instance-URL header in multi-tenant HTTP mode

CVE-2026-35568

Java-SDK has a DNS Rebinding Vulnerability

CVE-2026-5602

@nor2/heim-mcp vulnerable to command injection

CVE-2026-5603

@elgentos/magento2-dev-mcp vulnerable to command injection

CVE-2026-35394

@mobilenext/mobile-mcp: Arbitrary Android Intent Execution via mobile_open_url

CVE-2026-5323

a11y-mcp: Server-Side Request Forgery (SSRF) vulnerability in A11yServer function

CVE-2026-5327

fast-filesystem-mcp is vulnerable to command injection through handleGetDiskUsage function

CVE-2026-34939

PraisonAI Has ReDoS via Unvalidated User-Controlled Regex in MCPToolIndex.search_tools()

CVE-2026-34953

PraisonAI Has Authentication Bypass via OAuthManager.validate_token()

GHSA-w2fm-25vw-vh7f

mcp-handler has a tool response leak across concurrent client sessions ('Race Condition')

CVE-2026-34227

Sliver One-Click Remote Access: Insecure CORS & Unauthenticated MCP Interface

CVE-2026-33032

nginx-ui's Unauthenticated MCP Endpoint Allows Remote Nginx Takeover

CVE-2026-34237

MCP Java SDK has a Hardcoded Wildcard CORS (Access-Control-Allow-Origin: *)

CVE-2026-33946

MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay

CVE-2026-33980

Azure Data Explorer MCP Server: KQL Injection in multiple tools allows MCP client to execute arbitrary Kusto queries

CVE-2026-33989

@mobilenext/mobile-mcp alllows arbitrary file write via Path Traversal in mobile screen capture tools

GHSA-647h-p824-99w7

@grackle-ai/mcp has a workspace authorization bypass in its knowledge_search MCP tool

GHSA-wvr4-3wq4-gpc5

MCP Connect has unauthenticated remote OS command execution via /bridge endpoint

CVE-2026-33060

SSRF in @aborruso/ckan-mcp-server via base_url allows access to internal networks

CVE-2026-4270

AWS API MCP File Access Restriction Bypass

CVE-2026-32111

ha-mcp OAuth 2.1 DCR mode enables network reconnaissance via an error oracle

CVE-2026-32112

ha-mcp has XSS via Unescaped HTML in OAuth Consent Form

CVE-2026-32247

Graphiti vulnerable to Cypher Injection via unsanitized node_labels in search filters

CVE-2026-26118

Azure MCP Server has Server-Side Request Forgery issue that allows authorized attacker to elevate privileges over a network

CVE-2026-27825

MCP Atlassian has an arbitrary file write leading to arbitrary code execution via unconstrained download_path in confluence_download_attachment

CVE-2026-27826

MCP Atlassian has SSRF via unvalidated X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headers

CVE-2026-30861

WeKnora has Remote Code Execution (RCE) via Command Injection in MCP Stdio Configuration Validation

CVE-2026-33010

mcp-memory-service's Wildcard CORS with Credentials Enables Cross-Origin Memory Theft

CVE-2026-30856

WeKnora Vulnerable to Tool Execution Hijacking via Ambigous Naming Convention In MCP client and Indirect Prompt Injection

CVE-2026-29787

mcp-memory-service Vulnerable to System Information Disclosure via Health Endpoint

CVE-2026-3484

MCP NMAP Server has an Injection vulnerability

CVE-2026-27203

eBay API MCP Server Affected by Environment Variable Injection

CVE-2026-1721

Cloudflare Agents is Vulnerable to Reflected Cross-Site Scripting in the AI Playground's OAuth callback handler

GHSA-w5cr-2qhr-jqc5

Cloudflare Agents has a Reflected Cross-Site Scripting (XSS) vulnerability in AI Playground site

CVE-2026-25904

MCP Run Python Deno Sandbox Misconfiguration Allows SSRF Attacks via Localhost Access

CVE-2026-25905

MCP Run Python has a Sandbox Escape & Server Takeover Vulnerability

CVE-2026-2130

mcp-maigret vulnerable to command injection

CVE-2026-2178

xcode-mcp-server vulnerable to Command Injection

CVE-2026-25650

MCP-Salesforce's arbitrary attribute access leads to disclosure of Salesforce auth token

CVE-2026-25546

godot-mcp has Command Injection via unsanitized projectPath

CVE-2026-23744

REC in MCPJam inspector due to HTTP Endpoint exposes

CVE-2026-22686

enclave-vm Vulnerable to Sandbox Escape via Host Error Prototype Chain

CVE-2026-22785

orval MCP client is vulnerable to a code injection attack.

CVE-2025-67364

fast-filesystem-mcp has a Path Traversal vulnerability

CVE-2025-69256

serverless MCP Server vulnerable to Command Injection in list-projects tool

CVE-2025-65513

Fetch MCP Server has a Server-Side Request Forgery (SSRF) vulnerability

CVE-2025-64443

Docker MCP Plugin and Docker MCP Gateway have DNS Rebinding vulnerability when running in sse or streaming mode

CVE-2025-66404

mcp-server-kubernetes has potential security issue in exec_in_pod tool

CVE-2025-66401

MCP Watch has a Critical Command Injection in cloneRepo allows Remote Code Execution (RCE) via malicious URL

CVE-2025-66454

arcade-mcp-server Has Default Hardcoded Worker Secret That Allows Full Unauthorized Access to All HTTP MCP Worker Endpoints

CVE-2025-58337

Apache Doris-MCP-Server: Improper Access Control results in bypassing a "read-only" mode

CVE-2025-64132

Jenkins MCP Server Plugin does not perform permission checks in multiple MCP tools

CVE-2025-53967

figma-developer-mcp vulnerable to command injection in get_figma_data tool

CVE-2025-59163

vet MCP Server SSE Transport DNS Rebinding Vulnerability

CVE-2025-59834

Command Injection in adb-mcp MCP Server

CVE-2025-61685

Mastra Docs MCP Server `@mastra/mcp-docs-server` Leads to Information Exposure

CVE-2025-10619

@sequa-ai/sequa-mcp has Command Injection vulnerability

CVE-2025-59333

@executeautomation/database-server does not properly restrict access, bypassing a "read-only" mode

CVE-2025-59155

HackMD MCP Server has Server-Side Request Forgery (SSRF) vulnerability

CVE-2025-59376

mcp-kubernetes-server has a Command Injection vulnerability

CVE-2025-59377

mcp-kubernetes-server has an OS Command Injection vulnerability

CVE-2025-10193

Neo4j Cypher MCP server is vulnerable to DNS rebinding

CVE-2025-54994

@akoskm/create-mcp-server-stdio is vulnerable to MCP Server Command Injection through `exec` API

CVE-2025-58358

mcp-markdownify-server vulnerable to command injection in pptx-to-markdown tool

CVE-2025-9654

AiondaDotCom mcp-ssh command injection vulnerability in SSH operations

CVE-2025-9262

wong2 mcp-cli Command Injection Vulnerability

CVE-2025-54073

mcp-package-docs vulnerable to command injection in several tools

CVE-2025-53832

@translated/lara-mcp vulnerable to command injection in import_tmx tool

CVE-2025-53818

GitHub Kanban MCP Server vulnerable to Command Injection

CVE-2025-53355

MCP Server Kubernetes vulnerable to command injection in several tools

CVE-2025-53372

Node.js Sandbox MCP Server vulnerability can lead to Sandbox Escape via Command Injection

CVE-2025-53107

@cyanheads/git-mcp-server vulnerable to command injection in several tools

CVE-2025-52573

iOS Simulator MCP Command Injection allowed via exec API

CVE-2025-5273

Markdownify MCP Server allows attackers to read arbitrary files

CVE-2025-5276

Markdownify MCP Server allows Server-Side Request Forgery (SSRF) via the Markdownify.get() function

CVE-2025-4143

@cloudflare/workers-oauth-provider missing validation of redirect_uri on authorize endpoint

CVE-2025-4144

@cloudflare/workers-oauth-provider PKCE bypass via downgrade attack