Why MCP servers keep shipping familiar vulnerabilities
MCP servers expose file access, network requests, and other tools to an AI client. Vulnerabilities in those servers can give an attacker the same access.
Recent MCP server disclosures include command injection, path traversal, SSRF, and missing authentication. The MCPwnfluence disclosure below illustrates two of these failures.
The impact depends on the server process's permissions and the systems it can reach.
MCPwnfluence: the wake-up call
On February 26, Pluto Security disclosed MCPwnfluence, two vulnerabilities in mcp-atlassian that can enable unauthenticated code execution in an exposed deployment.
Arbitrary File Write via Path Traversal
The download_attachment tool accepts attacker-controlled file paths without validation. An attacker can write malicious content to any location on the filesystem, ~/.bashrc, ~/.ssh/authorized_keys, cron directories.
Unauthenticated SSRF via Custom Headers
The server accepts arbitrary URLs via HTTP headers, turning the MCP server into an SSRF proxy. Attackers can reach cloud metadata endpoints (169.254.169.254), scan internal services, and map the victim's network.
The attack chain is devastatingly simple:
Local Network
CVE-2026-27826
CVE-2026-27825
Root
Two HTTP requests from your local network. Coffee shop WiFi just became dangerous for developers running MCP servers.
mcp-atlassian binds to 0.0.0.0 by default with no authentication. The developers assumed it would only be accessed locally by the AI client. Attackers made no such assumption.
The five attack patterns
MCP deployments need review of both server vulnerabilities and the instructions carried by tool metadata and results. These are distinct risks:
1. Tool poisoning
Malicious instructions hidden in tool descriptions. The AI reads the description to understand what the tool does, and executes whatever instructions are embedded there.
2. Prompt injection via external data
Attacks embedded in GitHub issues, Slack messages, database records. The agent fetches "data" that's actually an attack payload.
3. Trust bypass
Exploiting "approve once, trust forever" permission models. One legitimate approval creates a persistent backdoor for future malicious requests.
4. Supply Chain attacks
Malicious MCP servers in package registries. Typosquatting, dependency confusion, and compromised maintainer accounts.
5. Cross-tenant exposure
Shared infrastructure breaking isolation. One tenant's agent can access another tenant's data through MCP server misconfigurations.
OWASP agentic top 10 mapping
The following OWASP categories help explain the consequences of these server and integration failures.
| OWASP risk | Connection to MCP deployments |
|---|---|
| ASI02, Tool Misuse and Exploitation | An attacker invokes legitimate tools for unauthorized file access or outbound requests. |
| ASI04, Agentic Supply Chain Vulnerabilities | A vulnerable third-party server introduces risk into every agent workflow that depends on it. |
| ASI05, Unexpected Code Execution | An unrestricted file write can place code where the host will execute it. |
Why this is happening
The MCP ecosystem grew fast. Really fast. Anthropic released the spec in November 2024. By March 2026, there are thousands of MCP servers in the wild.
Integration code needs the same path validation, authentication, and process isolation as other network services.
Every major platform shift creates a security gap. Web applications in the 2000s. Mobile apps in the 2010s. Cloud infrastructure in the late 2010s. Now it's agentic AI infrastructure in the 2020s. The attack techniques are the same, the attack surface is new.
What needs to change
For MCP Server Developers:
- Bind to localhost by default, not 0.0.0.0
- Require authentication for all operations
- Validate and sanitize all file paths
- Log every action for audit trails
- Implement proper sandboxing
For Organizations Deploying MCP:
- Inventory all MCP servers in your environment
- Audit network exposure and authentication
- Monitor for unusual agent behavior patterns
- Implement least-privilege permissions
- Keep servers updated, many CVEs already have patches
For the Ecosystem:
- Security reviews before publishing to registries
- Standardized security baselines for MCP servers
- Runtime monitoring and enforcement layers
- Coordinated vulnerability disclosure processes
The reckoning
30 CVEs in 60 days isn't a blip. It's the beginning.
The MCP ecosystem will continue to grow. Agents will gain more capabilities. The attack surface will expand. The question isn't whether there will be more vulnerabilities, it's whether the ecosystem can mature its security practices faster than attackers can exploit the gaps.
The security industry spent 20 years learning how to secure web applications. We don't have 20 years for agentic AI. The adoption curve is too steep, the capabilities are too powerful, and the stakes are too high.
The reckoning has arrived. The question is what we do about it.
Rogue Security provides runtime protection for agentic AI systems. Our embedded micro-SLMs enforce security policies before execution, blocking threats before they can execute. Learn more about securing your AI agents.