Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-05-25 · source-backed
A security researcher found vulnerabilities in MCP servers for Apache Doris (unintended SQL execution), Alibaba RDS (metadata exfiltration), and Apache Pinot (potential full takeover). Apache patched Doris. Alibaba declined to fix. Exposed MCP servers have nearly tripled to 1,467, with up to 200,000 vulnerable instances. Audit your MCP-connected database agents.
Each link below shares sources, entities, or timing with this story.
Akamai disclosed SQL injection in the Apache Doris MCP server, an unauthenticated metadata-exfiltration flaw in Alibaba's RDS MCP, and a potential takeover in Apache Pinot's MCP. The failure modes are boring and that's the point. Unsanitized SQL input, missing authentication,...
VIPER-MCP swept roughly 40,000 MCP server repos and produced 106 zero-days and 67 CVEs, while Censys counted 12,520 internet-exposed MCP services with about 40% completely unauthenticated (Adversa AI). Akamai separately disclosed SQL injection in Apache Doris MCP and unauthent...
The Model Context Protocol has a security problem that's no longer theoretical — it's statistical. Between January and February 2026, researchers filed 30+ CVEs against MCP servers, clients, and infrastructure. One package with nearly 500,000 downloads carried a CVSS 9.6 RCE....
OX Security disclosed a systemic vulnerability on June 16 in core Model Context Protocol implementations that enables arbitrary command execution, exposing API keys, internal databases, and chat histories on any vulnerable MCP host. This isn't one bad server. It's a protocol-l...
The agent skills supply chain is under coordinated attack. Snyk's ToxicSkills audit found 36% of ClawHub's 3,984 skills contain prompt injection payloads, 13.4% have critical malware, and submission rates exploded 10x to 500+/day. This week alone: CVE-2026-2256 (CVSS 9.1) is a...
Triple-stream retrieval (BM25 keyword, vector embeddings, knowledge-graph traversal) fused via Reciprocal Rank Fusion on the iii engine, with SQLite for state and an in-memory vector index, no external database. The economic claim: ~170K tokens/year (~$10) versus ~650K tokens...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.