Fetching from the wire…
01
02
03
04
05
06
07
08
Top 5 · 2026-06-17 · source-backed
OX Security disclosed a systemic vulnerability on June 16 in core Model Context Protocol implementations that enables arbitrary command execution, exposing API keys, internal databases, and chat histories on any vulnerable MCP host. This isn't one bad server. It's a protocol-level flaw, and it lands in the middle of a wave. VIPER-MCP swept around 40,000 repos and produced 67 CVEs. Akamai disclosed three database-MCP flaws. The NSA published lockdown guidance. Censys counted 12,520 internet-reachable MCP services, most of them unauthenticated.
Read that last number again. Twelve thousand MCP servers reachable from the open internet, most with no auth. MCP is the integration surface everyone's racing to adopt, the thing CircleCI, Microsoft, and Google all shipped against this week, and a big chunk of deployed instances are wide open.
It gets worse when you chain it. CISA added CVE-2026-42271 to its Known Exploited Vulnerabilities catalog amid confirmed in-the-wild attacks. It's a command-injection flaw, CVSS 8.7, in the LiteLLM gateway used by CrewAI, DSPy, Microsoft GraphRAG, and a long list of agent frameworks. Two MCP-preview endpoints accept full stdio server configs, command, args, env, and chaining that with the Starlette "BadHost" auth bypass, CVE-2026-48710, gets you unauthenticated remote code execution. That path leaks your model-provider API keys and opens lateral movement across your stack.
If you self-host an LLM gateway, this is your afternoon. Fixes shipped in LiteLLM v1.83.7 and Starlette 1.0.1+. Patch both. Then rotate every provider key that touched a vulnerable instance, because "confirmed in-the-wild" means assume compromise, not theoretical risk. Audit and authenticate every MCP server in your agent stack. The convenience of MCP, that anything can plug into anything, is exactly what makes it a near-perfect supply-chain target. We solved this in package management with signing and scanning. The MCP ecosystem is shipping integrations faster than it's shipping the security primitives to make them safe. Don't wait for the ecosystem to catch up. Lock yours down now.
Each link below shares sources, entities, or timing with this story.
Two AI toolchain CVEs hit CISA's Known Exploited Vulnerabilities catalog this week, and the attack chain connecting them is the kind of thing that should change how you think about supply chain trust. CVE-2026-33017: Langflow, the popular agent workflow builder, has an unauthe...
The Model Context Protocol has a security problem that's no longer theoretical — it's statistical. Between January and February 2026, researchers filed 30+ CVEs against MCP servers, clients, and infrastructure. One package with nearly 500,000 downloads carried a CVSS 9.6 RCE....
OX Security researchers found a design-level flaw in Anthropic's Model Context Protocol STDIO transport that turns MCP tool invocations into OS command execution via configuration-to-command injection. Affected projects include LiteLLM (CVE-2026-30623, patched), Agent Zero, an...
The agent skills supply chain is under coordinated attack. Snyk's ToxicSkills audit found 36% of ClawHub's 3,984 skills contain prompt injection payloads, 13.4% have critical malware, and submission rates exploded 10x to 500+/day. This week alone: CVE-2026-2256 (CVSS 9.1) is a...
Bitdefender published the most alarming MCP security metric to date: 53% of open-source MCP server implementations rely on insecure static credentials while only 8.5% use OAuth. The report identifies five risk categories: opt-in (not default) security, supply chain poisoning,...
Trend Micro's follow-up counted 1,467 publicly exposed MCP servers with CVSS 9.8 command-injection flaws in unofficial AWS and Azure MCP servers. Censys found 12,520 internet-accessible MCP services, most unauthenticated. An automated VIPER-MCP sweep of ~40,000 repos produced...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.