Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-07-01 · high
CVE-2026-49257 scored a perfect CVSS 10.0, per Practical DevSecOps, covering SQL, schema, and mutation tools alike.
Why now: Practical DevSecOps' MCP security findings, including this CVE, were covered on July 1.
CVE-2026-49257 hands mcp-pinot's SQL, schema, and table-mutation tools to any unauthenticated caller, drawing a perfect CVSS score of 10.0, per Practical DevSecOps.
Anyone who can reach the server gets full read, write, and delete access to the data behind it, no credentials required. That's the top of the severity scale, assigned to tools built to mutate live tables.
The cause is ordinary. OAuth doesn't ship on by default, so the server answers unauthenticated requests with the same SQL and mutation tools a logged-in caller would get. With OAuth enabled, those tools require credentials again, the way they're supposed to.
Practical DevSecOps treats this as a pattern rather than a one-off bug. Its 2026 MCP security report calls shipping auth off by default the standard failure mode across MCP servers, not an edge case.
Most MCP CVEs this year will trace back to auth left off by default, not to broken code, and mcp-pinot's perfect severity score shows how bad that default can get. If you run mcp-pinot, turn OAuth on before anything else. If you run any MCP server, treat the shipped defaults as open until you've checked otherwise.
Each link below shares sources, entities, or timing with this story.
The Model Context Protocol has a security problem that's no longer theoretical — it's statistical. Between January and February 2026, researchers filed 30+ CVEs against MCP servers, clients, and infrastructure. One package with nearly 500,000 downloads carried a CVSS 9.6 RCE....
Bitdefender published the most alarming MCP security metric to date: 53% of open-source MCP server implementations rely on insecure static credentials while only 8.5% use OAuth. The report identifies five risk categories: opt-in (not default) security, supply chain poisoning,...
The single biggest cross-agent story this week isn't one CVE. It's that MCP became the dominant agent-hijack surface, and this is the defense that actually stops it. The pattern across a dozen findings: Sentry's MCP server weaponized via fake error events for an 85% agent-hija...
Ten days from spec to shipped client. That's fast even for this ecosystem. The MCP 2026-07-28 revision replaced the bidirectional stateful protocol with request/response. Every request now independently carries protocol version, client identity and capabilities. Cloudflare's t...
Thirty CVEs in sixty days. That's the MCP ecosystem's security track record for 2026 so far, and the severity is climbing. Three disclosures dropped this week that should make anyone running agent infrastructure pause. First, PraisonAI, a popular multi-agent orchestration fram...
OX Security disclosed a systemic vulnerability on June 16 in core Model Context Protocol implementations that enables arbitrary command execution, exposing API keys, internal databases, and chat histories on any vulnerable MCP host. This isn't one bad server. It's a protocol-l...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.