Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-06-05 · source-backed
VIPER-MCP swept roughly 40,000 MCP server repos and produced 106 zero-days and 67 CVEs, while Censys counted 12,520 internet-exposed MCP services with about 40% completely unauthenticated (Adversa AI). Akamai separately disclosed SQL injection in Apache Doris MCP and unauthenticated metadata exfiltration in Alibaba RDS MCP. We speed-ran every mistake of the early API era, except faster and with tool-execution attached. If you run a remote MCP server and it doesn't have auth in front of it, that's the bug. Fix it today.
Each link below shares sources, entities, or timing with this story.
Akamai disclosed SQL injection in the Apache Doris MCP server, an unauthenticated metadata-exfiltration flaw in Alibaba's RDS MCP, and a potential takeover in Apache Pinot's MCP. The failure modes are boring and that's the point. Unsanitized SQL input, missing authentication,...
OX Security disclosed a systemic vulnerability on June 16 in core Model Context Protocol implementations that enables arbitrary command execution, exposing API keys, internal databases, and chat histories on any vulnerable MCP host. This isn't one bad server. It's a protocol-l...
Trend Micro's follow-up counted 1,467 publicly exposed MCP servers with CVSS 9.8 command-injection flaws in unofficial AWS and Azure MCP servers. Censys found 12,520 internet-accessible MCP services, most unauthenticated. An automated VIPER-MCP sweep of ~40,000 repos produced...
This is the one that should make you check your own setup tonight. June MCP-security roundups flag roughly 12,520 internet-exposed MCP services, about 40% of them with no authentication at all. On top of that, Adversa AI's TrustFall and SymJack research shows that Claude Code,...
The NSA released authoritative MCP security guidance this month, walking through the protocol's inverted client-server pattern, unverified task propagation between chained servers, and arbitrary-code-execution exposure (Adversa AI). When the NSA ships design guidance for your...
A security researcher found vulnerabilities in MCP servers for Apache Doris (unintended SQL execution), Alibaba RDS (metadata exfiltration), and Apache Pinot (potential full takeover). Apache patched Doris. Alibaba declined to fix. Exposed MCP servers have nearly tripled to 1,...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.