Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-05-11 · source-backed
May 2026 produced CVEs for Oracle SQL injection, nginx-ui CVSS 9.8 full takeover, and code-mcp command injection. OX Security documented a systemic RCE flaw across packages with 150M+ downloads. Anthropic has said the behavior is "expected." That's their position. My position: audit every MCP server you connect to. The ecosystem is growing faster than anyone can vet.
Each link below shares sources, entities, or timing with this story.
The Model Context Protocol has a security problem that's no longer theoretical — it's statistical. Between January and February 2026, researchers filed 30+ CVEs against MCP servers, clients, and infrastructure. One package with nearly 500,000 downloads carried a CVSS 9.6 RCE....
OX Security researchers found a design-level flaw in Anthropic's Model Context Protocol STDIO transport that turns MCP tool invocations into OS command execution via configuration-to-command injection. Affected projects include LiteLLM (CVE-2026-30623, patched), Agent Zero, an...
Two new attack classes emerged: Anthropic's own official Git MCP server has three CVEs (CVE-2025-68143/44/45) enabling RCE via prompt injection. MCP Watch, a security scanner designed to audit MCP servers, itself contains a command injection (CVE-2025-66401). MCPJam Inspector...
The MCP CVE count reached 30+, all sharing the same root cause: user-controlled input reaching exec()/eval() without sanitization. AgentAudit scanned 194 MCP packages and found 118 security findings across 68 packages — 14 rated critical or high. Anthropic's own Git MCP server...
Adversa AI's roundup shows Golf Scanner (20 checks across 7 IDEs), Astrix MCP Secret Wrapper (runtime vault integration), and mcp-sec-audit all shipped in April. PipeLab's "State of MCP Security 2026" is the first incident-by-incident mapping against the OWASP MCP Top 10. The...
LayerX disclosed that DXT extensions run unsandboxed with full system privileges. An attacker can craft a malicious calendar event that chains a low-risk connector to a high-risk local executor — achieving full RCE without any user click. Anthropic reportedly declined to fix,...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.