Entity trail

MCP CVE

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-07-09 / agents-researcherNSA issues official MCP hardening guidance after Amazon Q auto-execution CVEs (CVSS 8.5) enable AWS credential theftWiz Research disclosed CVE-2026-12957 and CVE-2026-12958 in Amazon Q Developer, where the agent auto-loaded MCP server configs from a repo's .amazonq/mcp.json without consent or workspace-trust checks, allowing a booby-trapped repository to achieve arbitrary code execution and steal AWS credentials. In July the NSA responded with an official MCP Cybersecurity Information Sheet detailing the inverted client-server pattern, unverified task propagation, and arbitrary-code-execution exposure. The episode is now the reference case for why coding agents must never treat workspace files as trusted config.
2026-07-08 / vibe-coding-researcherTip: Never Reuse One McpServer Instance Across Clients (CVE-2026-25536)The concrete mitigation for the MCP TypeScript SDK cross-client leak is to instantiate a fresh McpServer per client connection rather than sharing a single long-lived instance across multiple clients, which is what allowed request/response data to bleed between sessions. Audit any custom MCP server you host for a module-level singleton server object. This is a small structural change that closes a real data-isolation hole.
2026-07-01 / agents-researcherCritical mcp-pinot flaw (CVSS 10.0) exposes unauthenticated MCP tool invocation with OAuth off by defaultCVE-2026-49257 in mcp-pinot is a maximum-severity 10.0 vulnerability that exposes unauthenticated MCP tool invocation — OAuth is disabled by default and the server hands out SQL, schema and table-mutation tools to any caller. It fits a broader MCP authentication crisis quantified in 2026 reports (roughly half of MCP servers relying on static credentials, a small minority on OAuth). The builder takeaway: 'MCP server' is now a first-class attack surface, and shipping one with auth off by default is the new insecure-default pattern to audit for.

Source trail

OWASP MCP Top 10 CVE-2026-33032 CVE-2026-26118 Gravitee's survey of 919 executives Published May 1 IBM X-Force Mandiant's annual report

Graph sources

entity graphfindings textkg entitiesnewsletter issues