Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-26 · high
Most of the bugs share one root cause: local servers that trust a browser's origin header as proof of identity.
Why now: NVD posted all nine advisories together on August 25.
NVD published nine advisories for Model Context Protocol servers on August 25, and most reduce to the same mistake, trusting a browser's origin header as identity proof. That gap turns a private-sounding local setup into an open door, letting code running in any browser tab reach tools on that machine without asking permission.
PraisonAI validated incoming MCP requests with request_origin.startswith(allowed) checked against a localhost allowlist. A domain like localhost.attacker.com starts with "localhost" and passes, a flaw PraisonAI's GitHub advisory rates 7.6.
The requests also carry Content-Type: text/plain, so browsers skip the CORS preflight that would otherwise block them. Any tab open in a browser on that machine can call tools/call on the local server, no API key required.
genieacs-mcp has a related problem. When the MCP_AUTH_TOKEN environment variable is unset, its /mcp endpoint on loopback accepts requests with no authentication and checks neither the Host nor Origin header. The bug appears in genieacs-mcp's NVD listing, rated 8.8 and flagged as reachable through DNS rebinding.
Nextcloud MCP Server's webhook endpoint fails the same way for a different reason. WEBHOOK_SECRET defaults to None, so the endpoint accepts calls with no secret at all, rated 9.1.
Each link below shares sources, entities, or timing with this story.
Opus 4.7 read production data from a live company. Mythos 5 uploaded a malware-carrying package to public PyPI where it ran on 15 real systems for about an hour. Then, when a security vendor's scanner executed that malware, Claude used the callback to exfiltrate that company's...
Thirty CVEs in sixty days. That's the MCP ecosystem's security track record for 2026 so far, and the severity is climbing. Three disclosures dropped this week that should make anyone running agent infrastructure pause. First, PraisonAI, a popular multi-agent orchestration fram...
If you wrote an MCP server before July, it's on a protocol shape the maintainers have already removed. Not deprecated-with-a-migration-window. Removed from the spec. MCP lead maintainers David Soria Parra and Den Delimarsky published an updated roadmap on August 22, and the re...
The Model Context Protocol has a security problem that's no longer theoretical — it's statistical. Between January and February 2026, researchers filed 30+ CVEs against MCP servers, clients, and infrastructure. One package with nearly 500,000 downloads carried a CVSS 9.6 RCE....
Go look at your ~/.claude/CLAUDE.md right now. Mine has internal package names, a build command with a host in it, and notes about which credentials live where. I wrote it assuming exactly one reader. RuntimeWire published traced request captures on August 9 showing Muse Code...
This is the agent-security story of the week, and it needs no code to work. Noma Security disclosed GitLost (CVE-2026-44246) on July 6. An unauthenticated attacker posts a crafted issue on a public org repo. The AI agent (Claude or Copilot) triggers on issues.assigned, reads t...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.