Threat Library

The WhatsApp MCP server's local bridge API (port 8080) had no authentication, no Host header validation, and allowed arbitrary file paths in message attachments. This let any local process, sibling MCP server, or even a malicious webpage (via DNS rebinding) send WhatsApp messages as the paired user and exfiltrate sensitive local files like SSH keys as WhatsApp attachments. It is fixed in v0.2.1 with bearer token auth, host allow-listing, and path confinement.

The MCP Python SDK's experimental task management feature failed to bind tasks to the session that created them, allowing any connected client to list, read, cancel, or consume messages for tasks belonging to other clients. This is a broken access control / IDOR-style flaw that breaks the trust boundary between concurrent MCP sessions on the same server. It is fixed in version 1.27.2.

The MCP Python SDK's SSE and stateful Streamable HTTP transports route messages to sessions based solely on a session ID, without checking that the requesting client is the same authenticated principal who created that session. Any bearer-token-authenticated client that learns or guesses a valid session ID can inject JSON-RPC messages into another user's active session, effectively hijacking it. This is a serious cross-tenant authorization flaw fixed in version 1.27.2.

PraisonAI versions before 4.6.78 default to running the MCP HTTP-stream server without any API key or authentication, meaning anyone who can reach the endpoint can list and invoke all exposed tools. The server also fails to validate tool-call arguments against the advertised schema, compounding the risk of malformed or malicious inputs reaching tool handlers. Exploitation requires the operator to have bound the server to a network-accessible address rather than the safe localhost default.

An unauthenticated attacker can abuse the Grafana MCP Server by injecting a crafted X-Grafana-URL header, tricking the server into acting as a proxy that leaks its own privileged Grafana service-account token. This same flaw allows server-side request forgery against internal networks and cloud metadata endpoints, giving attackers a path to full credential theft and internal reconnaissance without needing any prior authentication.

The AWS HealthLake MCP Server fails to validate that pagination URLs returned via the next_token parameter point back to the legitimate HealthLake endpoint, enabling an authenticated user to redirect the server's outbound requests to an attacker-controlled endpoint. This can leak AWS temporary security credentials used by the MCP server, giving an attacker a foothold to access AWS resources tied to those credentials. Fixed in version 0.0.14.

The DeepSeek MCP Server fails to bind session IDs to authenticated users or transport sessions, allowing any caller to enumerate active sessions and hijack another user's conversation context. This lets an attacker read and continue a victim's private chat history, exposing sensitive data and enabling impersonation within the session. The flaw is patched in version 1.7.0.