Skip to content
The Injection_
LIVE
LIVElast sweep next in--:--:--

[ RSS ][ JSON ][ llms.txt ]

MCP (Model Context Protocol)

Also called: Model Context Protocol · MCP servers

MCP, the Model Context Protocol, is an open standard for connecting AI assistants and agents to tools and data through servers that expose functions, resources and prompts. It is widely used, so MCP servers, clients, SDKs and registries are now a major part of the AI attack surface.

How it works

An MCP client gives the model a list of tools from each connected server, and the model decides what to call. Risks include malicious or compromised servers, poisoned tool descriptions, servers with excessive access, weak authentication and OAuth flaws in SDKs, and registries where names or domains can be taken over.

How to defend

Install servers from trusted publishers, pin versions, review tool descriptions and permissions, keep the official SDKs updated, and isolate servers that touch sensitive systems.

Real cases 6 stories

  1. MED

    Vulnerability · VulnCheck · CVE-2026-108865 · CVSS 8.8

    MCP source review: at least 16 unpatched CVEs in three days

    A static source-review campaign by two researchers has produced at least 16 MCP CVEs published October 10 to 12, 2026. The second wave reaches application MCP servers, an inference server sandbox and sub-agent permissions. None lists a fix.

  2. MED

    Vulnerability · Splunk · CVE-2026-76286 · CVSS 5.3

    Splunk MCP Server: a custom tool's URL could capture a user's token

    Splunk MCP Server below 1.2.1 could send the Splunk platform authentication token of whoever ran a custom API tool to the URL configured for that tool. Splunk fixed it in 1.2.1 and rates the issue 5.3, medium.

  3. MED

    Vulnerability · Grafana Labs · CVE-2026-89039 · CVSS 6.5

    mcp-k6: a Grafana MCP prompt returned any file the server could read

    CVE-2026-89039 is an arbitrary file read in mcp-k6, Grafana's experimental k6 MCP server, where the convert_playwright_script prompt returned the contents of any file the server's user could read. Grafana fixed it in 0.7.0.

  4. HIGH

    Vulnerability · Model Context Protocol · CVE-2026-104850 · CVSS 7.5

    MCP TypeScript SDK: OAuth client could leak credentials to servers

    CVE-2026-104850 in the MCP TypeScript SDK let a malicious MCP server pick the authorization server that receives a client's OAuth refresh tokens and client secrets. Fixed in @modelcontextprotocol/sdk 1.31.0 and client 2.2.0.

  5. INFO

    Research · Google Threat Intelligence Group

    Google GTIG: half of 2026 AI flaws hit agent orchestration

    Google Threat Intelligence Group tracked 2,076 vulnerabilities in AI software from January 2025 to August 2026, more than 1,500 of them in 2026, and says agent orchestration frameworks account for half of them.

  6. HIGH

    Supply chain · AIR Security

    MCPJacking: 155 hijackable servers in the official MCP registry

    MCPJacking is an attack on MCP registry entries whose domains have expired. AIR Security found 155 such servers in the official MCP registry, re-registered the domains and gained remote prompt execution on agents that trusted them.