Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-06-08 · source-backed
Trend Micro's follow-up counted 1,467 publicly exposed MCP servers with CVSS 9.8 command-injection flaws in unofficial AWS and Azure MCP servers. Censys found 12,520 internet-accessible MCP services, most unauthenticated. An automated VIPER-MCP sweep of ~40,000 repos produced 67 CVEs. Treat every remote MCP server as a remote-code-execution surface, not a tool list. Put auth in front of all of them and pull the unauthenticated ones off the public internet. Most operators still haven't.
Each link below shares sources, entities, or timing with this story.
The Model Context Protocol has a security problem that's no longer theoretical — it's statistical. Between January and February 2026, researchers filed 30+ CVEs against MCP servers, clients, and infrastructure. One package with nearly 500,000 downloads carried a CVSS 9.6 RCE....
OX Security disclosed a systemic vulnerability on June 16 in core Model Context Protocol implementations that enables arbitrary command execution, exposing API keys, internal databases, and chat histories on any vulnerable MCP host. This isn't one bad server. It's a protocol-l...
VIPER-MCP swept roughly 40,000 MCP server repos and produced 106 zero-days and 67 CVEs, while Censys counted 12,520 internet-exposed MCP services with about 40% completely unauthenticated (Adversa AI). Akamai separately disclosed SQL injection in Apache Doris MCP and unauthent...
Thirty CVEs in sixty days. That's the MCP ecosystem's security track record for 2026 so far, and the severity is climbing. Three disclosures dropped this week that should make anyone running agent infrastructure pause. First, PraisonAI, a popular multi-agent orchestration fram...
Full 10.0. Network vector, low complexity, no authentication, no user interaction, high impact on confidentiality, integrity and availability. CVE-2026-79696, published September 9, is a code injection flaw in adk web affecting Google's Agent Development Kit for Python 2.0.0 t...
Your read-only flag is a claim, not a guarantee. Two independent Postgres MCP servers proved it on September 4. Postgres MCP Pro got CVE-2026-85620 at CVSS 9.2. The bug is one line of reasoning in safe_sql.py: the validator checks function names on FuncCall AST nodes. A functi...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.