Fetching from the wire…
01
02
03
04
05
06
07
08
Top 5 · 2026-04-04 · source-backed
Thirty CVEs in sixty days. That's the MCP ecosystem's security track record for 2026 so far, and the severity is climbing.
Three disclosures dropped this week that should make anyone running agent infrastructure pause. First, PraisonAI, a popular multi-agent orchestration framework, got hit with five CVEs at once. The worst is CVE-2026-34938, a CVSS 10 sandbox bypass that chains to remote code execution on any version before 1.5.90. All three sandbox layers fail. The other four cover SQL injection via f-string thread IDs (CVE-2026-34934, CVSS 9.8), CLI command injection through the --mcp argument (CVE-2026-34935, CVSS 9.8), unauthenticated WebSocket agent control (CVE-2026-34952, CVSS 9.1), and a SubprocessSandbox escape via missing sh/bash blocklist (CVE-2026-34955, CVSS 8.8). This mirrors the CrewAI CVE cluster from last week. The pattern is clear: multi-agent framework sandboxing is systematically broken across the ecosystem.
Second, Azure AI Foundry got a CVSS 10 privilege escalation (CVE-2026-32213). No prior authentication required. Any network attacker can escalate to full admin over Azure AI Foundry resources. Microsoft says a fix is available through MSRC, but if you're running AI workloads on Azure AI Foundry and haven't patched, stop reading this and go patch.
Third, CVE-2026-32211 hit the Azure MCP Server itself at CVSS 9.1, plus CVE-2026-5322 for SQL injection in mcp-data-vis.
I've been saying this for weeks: MCP servers aren't development toys. They're network-exposed services. The security posture most teams apply to them, which is basically none, made sense when MCP was a local dev protocol. That phase is over. The vulnerability pattern has shifted from client-side tool poisoning and prompt injection to server-side authentication failures in production cloud services. That's a different threat class entirely.
What to do right now: audit every MCP server in your stack for authentication. Patch PraisonAI to 1.5.90+. Verify Azure AI Foundry patches. Treat your MCP endpoints like you'd treat a public API endpoint, because that's what they are.
Each link below shares sources, entities, or timing with this story.
The Model Context Protocol has a security problem that's no longer theoretical — it's statistical. Between January and February 2026, researchers filed 30+ CVEs against MCP servers, clients, and infrastructure. One package with nearly 500,000 downloads carried a CVSS 9.6 RCE....
The agent skills supply chain is under coordinated attack. Snyk's ToxicSkills audit found 36% of ClawHub's 3,984 skills contain prompt injection payloads, 13.4% have critical malware, and submission rates exploded 10x to 500+/day. This week alone: CVE-2026-2256 (CVSS 9.1) is a...
Six CVEs traced to AI-generated code in January. Fifteen in February. Thirty-five in March. Infosecurity Magazine reports the numbers, tracked by Georgia Tech's SSLab through their "Vibe Security Radar" project running since May 2025. The acceleration is clear and there's no s...
OX Security disclosed a systemic vulnerability on June 16 in core Model Context Protocol implementations that enables arbitrary command execution, exposing API keys, internal databases, and chat histories on any vulnerable MCP host. This isn't one bad server. It's a protocol-l...
Token Security's RSAC 2026 presentation documents an RCE chain in Microsoft's Azure MCP server that compromises entire cloud environments. 38% of 500+ public MCP servers have no authentication. Every tool parameter is an untrusted injection surface. Source
CVE-2026-33010 dropped March 20 with a CVSS 8.1, targeting mcp-memory-service — the open-source memory backend that a large number of multi-agent deployments use for persistent agent recall. The vulnerability is straightforward and devastating: when HTTP mode is enabled with a...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.