Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-04-30 · source-backed
OX Security researchers found a design-level flaw in Anthropic's Model Context Protocol STDIO transport that turns MCP tool invocations into OS command execution via configuration-to-command injection. Affected projects include LiteLLM (CVE-2026-30623, patched), Agent Zero, and Flowise across Python, TypeScript, Java, and Rust. If you run MCP servers, audit your STDIO configurations immediately. This isn't a theoretical risk.
Each link below shares sources, entities, or timing with this story.
A single architectural decision, replicated across Python, TypeScript, Java, and Rust, sitting at the center of the protocol most agent builders now run. OX Security's research team disclosed a critical vulnerability in the official Model Context Protocol SDKs that enables arb...
OX Security disclosed a systemic vulnerability on June 16 in core Model Context Protocol implementations that enables arbitrary command execution, exposing API keys, internal databases, and chat histories on any vulnerable MCP host. This isn't one bad server. It's a protocol-l...
May 2026 produced CVEs for Oracle SQL injection, nginx-ui CVSS 9.8 full takeover, and code-mcp command injection. OX Security documented a systemic RCE flaw across packages with 150M+ downloads. Anthropic has said the behavior is "expected." That's their position. My position:...
Two new attack classes emerged: Anthropic's own official Git MCP server has three CVEs (CVE-2025-68143/44/45) enabling RCE via prompt injection. MCP Watch, a security scanner designed to audit MCP servers, itself contains a command injection (CVE-2025-66401). MCPJam Inspector...
CVE-2026-30623 allows arbitrary command injection through crafted server configurations if your LiteLLM proxy exposes MCP endpoints. Patch is available. Update immediately and audit any MCP configs accepting user-provided command strings.
Ten days from spec to shipped client. That's fast even for this ecosystem. The MCP 2026-07-28 revision replaced the bidirectional stateful protocol with request/response. Every request now independently carries protocol version, client identity and capabilities. Cloudflare's t...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.