Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-23 · high
CVE-2026-75130 hits one of the most installed MCP servers in coding agents, and Upstash hasn't shipped a fix.
Why now: NVD published CVE-2026-75130 on August 18, and no fix was documented as of August 23.
Context7's MCP server exfiltrates .env files during a routine documentation lookup, per an NVD advisory published August 18. CVE-2026-75130 covers Upstash's Context7 through version 2.1.2, and Context7 is one of the most commonly installed MCP servers in coding agents. No fix is documented as of August 23.
The Custom AI Instructions feature serves unsanitized content through the MCP server. Poisoned instructions riding along with that content can exfiltrate credentials from environment files to an attacker-controlled service, then delete files.
NVD's own listing carries a CVSS 4.0 base score of 6.4 from VulnCheck, with high subsequent-system impact factored in. Secondary coverage quotes 9.0 under the older CVSS 3.1 scale for the same bug.
The trigger is a standard library documentation request, the same call Context7 exists to answer, not a malicious prompt or pasted-in script.
Upstash hasn't published a patch. A server-side sanitization fix and a configuration workaround pushed onto agent operators would leave very different amounts of exposure behind.
Each link below shares sources, entities, or timing with this story.
Go look at your ~/.claude/CLAUDE.md right now. Mine has internal package names, a build command with a host in it, and notes about which credentials live where. I wrote it assuming exactly one reader. RuntimeWire published traced request captures on August 9 showing Muse Code...
VulnCheck disclosed on August 24 that Continue CLI's headless and auto modes give the Bash tool blanket allow permission, leaving isCriticalCommand as the only guard. Its dangerous-path test matches /, ~, /usr, /etc, /bin and /sbin, so recursive deletion of /home, /root, /var,...
Ten days from spec to shipped client. That's fast even for this ecosystem. The MCP 2026-07-28 revision replaced the bidirectional stateful protocol with request/response. Every request now independently carries protocol version, client identity and capabilities. Cloudflare's t...
NVD posted nine advisories on August 25, clustering into one shape: a local server assuming a browser can't reach it. PraisonAI validated MCP origins with request_origin.startswith(allowed) against a localhost allowlist, so an attacker-registered localhost.attacker.com passes...
upstash/context7 (60,590 stars) shipped @upstash/[redacted] on August 7 on the 2026-07-28 protocol revision. HTTP serving is now stateless for both modern and legacy clients, and Redis-backed sessions are gone, which is a real operational simplification for anyone self-hosting...
Context7 by Upstash dynamically fetches version-specific docs for React, Next.js, Tailwind, and other libraries, injecting current API surfaces into your agent's context. In an ecosystem of 14,000+ MCP servers (governance now under the Linux Foundation's AAIF), Context7 stands...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.