Pattern: MCP Security Debt Hits Critical Mass — 30+ CVEs in 60 Days, Now Including CVSS 9.1 Cloud Service Flaws

TheHackerWire·high signal

The MCP ecosystem's security debt is accelerating: 30+ CVEs filed in the first 60 days of 2026, culminating in CVE-2026-32211 (Azure MCP Server, CVSS 9.1) and CVE-2026-5322 (SQL injection in mcp-data-vis). The pattern has shifted from client-side tool poisoning and prompt injection to server-side authentication failures in production cloud services. Builders running MCP servers should treat them as network-exposed services requiring authentication, not local development tools.