Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-08-28 · source-backed
NVD published CVE-2026-81091 through 81102 plus 81735 at 17:20 UTC on August 27, with GitHub advisories confirming same-day publication rather than backlog indexing (NVD). Eight are an HTTP transport that binds broadly or never enables the DNS-rebinding host allow-list the underlying MCP SDK already provides: pg-aiguide, tiger-slack, tiger-gh-mcp-server, Dash, mcp-go, mcp-router, Telnyx and UI-TARS-desktop. The SDKs ship the guard opt-in and server authors are uniformly not opting in, which makes this a default-selection failure rather than eight independent mistakes. If you maintain an MCP server, the fix is enabling the allow-list you already have.
Each link below shares sources, entities, or timing with this story.
NVD posted nine advisories on August 25, clustering into one shape: a local server assuming a browser can't reach it. PraisonAI validated MCP origins with request_origin.startswith(allowed) against a localhost allowlist, so an attacker-registered localhost.attacker.com passes...
The Model Context Protocol has a security problem that's no longer theoretical — it's statistical. Between January and February 2026, researchers filed 30+ CVEs against MCP servers, clients, and infrastructure. One package with nearly 500,000 downloads carried a CVSS 9.6 RCE....
GitHub added allowedMcpServers and deniedMcpServers keys to enterprise Copilot managed settings on August 6, configured to fail closed on malformed config, then followed on August 7 with a usage API exposing totals_by_3rd_party_agent for per-agent spend attribution (digitalapp...
StreamableHTTPServer.ServeHTTP and SSEServer.ServeHTTP accepted any request arriving over loopback regardless of the host it named (NVD). This one matters more than the individual server CVEs beside it because mcp-go is a widely used Go SDK, so every stdio-to-HTTP server built...
Ten days from spec to shipped client. That's fast even for this ecosystem. The MCP 2026-07-28 revision replaced the bidirectional stateful protocol with request/response. Every request now independently carries protocol version, client identity and capabilities. Cloudflare's t...
Two new attack classes emerged: Anthropic's own official Git MCP server has three CVEs (CVE-2025-68143/44/45) enabling RCE via prompt injection. MCP Watch, a security scanner designed to audit MCP servers, itself contains a command injection (CVE-2025-66401). MCPJam Inspector...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.