VIPER-MCP Surfaces 106 Zero-Days and 67 CVEs Across 40,000 MCP Server Repos

Adversa AI·high signal

A June 2026 MCP security roundup reports VIPER-MCP swept roughly 40,000 MCP server repositories and produced 106 zero-day vulnerabilities and 67 CVEs, while Censys counted 12,520 internet-exposed MCP services with ~40% completely unauthenticated. Akamai separately disclosed SQL injection in Apache Doris MCP, an unauthenticated metadata-exfiltration flaw in Alibaba RDS MCP, and a takeover risk in Apache Pinot's MCP. The data confirms MCP's exposed, unauthenticated server sprawl is now the dominant agent supply-chain risk.