Threat Library

The Dash MCP server bound its network listener to loopback but failed to validate the Host header of incoming requests, allowing DNS rebinding attacks from a malicious webpage to reach the local server. An attacker-controlled page in a victim's browser could rebind a domain to 127.0.0.1 and invoke the server's tools using the victim's stored Dropbox credentials. The issue is limited to the network transport mode and was fixed by adding host-checking transport security.

tiger-slack's MCP HTTP transport failed to enable the SDK's built-in host allow-list/DNS-rebinding protection, allowing a malicious webpage visited by a user on the same machine to rebind a DNS name to the local MCP server's address and issue requests to it. This lets an attacker's browser-based script drive the locally running Slack MCP server on behalf of the victim, potentially reading or sending Slack data without authorization. The fix requires explicitly enabling the allow-list option, not just updating the dependency.

mcp-go's HTTP transports failed to validate the Host header on loopback-bound requests, allowing a malicious webpage in a user's browser to use DNS rebinding to reach a local MCP server and invoke its tools or read its resources. This breaks the security assumption that only trusted local software can talk to a loopback-bound MCP server. The issue is fixed in 0.56.0 via strict host validation.

Hatchet, a platform used to orchestrate AI agents and background workflows, contains a missing tenant-ownership check in its Dispatcher gRPC service. An authenticated attacker who can guess or enumerate another tenant's worker UUID can tamper with that worker's labels or forcibly disconnect it, causing integrity and availability impact on shared/multi-tenant deployments. Single-tenant deployments are not meaningfully affected.

This is a defensive research paper, not an active exploit: it identifies real trust-boundary gaps in the emerging W3C WebMCP proposal that let malicious web pages spoof tool ownership, manipulate tool lifecycles, and inject prompts via tool metadata/descriptions into browser-integrated LLM agents. The authors propose and empirically validate a dual-layer runtime (cryptographic tool provenance plus a quarantine/privileged agent split) that reduces these attack classes to near-zero success, while also disclosing a residual bypass via malicious tool names invoked before inspection.

The official MCP PHP SDK contains a flaw where its HTTP transport buffers Server-Sent Events data without any size limit, waiting indefinitely for a delimiter that a malicious server can simply withhold. A hostile or compromised MCP server (or a man-in-the-middle) can exploit this to crash or hang any connecting PHP-based MCP client through memory exhaustion, with no authentication or user interaction required.

The CKAN MCP Server's earlier SSRF fix only blocked the literal hostname 'localhost' and dotted IPv4/bracketed IPv6 loopback literals, but missed alternate hostname aliases like 'ip6-localhost' and 'ip6-loopback' that resolve to loopback addresses. A remote caller invoking CKAN tools (e.g. ckan_package_search, sparql_query) with a crafted server_url/base_url parameter could bypass the filter and force the server to make requests to internal or loopback network locations. This is a moderate-severity SSRF bypass affecting a specific tool integration, not a novel or high-impact agentic exploitation technique.

Lightdash's scheduled delivery feature lets a user-supplied webhook URL be posted to directly by the GoogleChat and MicrosoftTeams clients without applying the existing SSRF protection used for MCP server URLs. This allows an authenticated user to force the server to make requests to internal, loopback, or cloud metadata endpoints and infer reachability from logged error responses. It is a classic SSRF issue in a webhook delivery path rather than an attack on agent reasoning or an AI-specific exploit, though it touches the same URL-validation utility used to secure MCP server connections.

The 'AI Agent by SiteGround' WordPress plugin fails to verify the upload_files capability on a media upload endpoint tied to its AI/Gutenberg block editor features, allowing low-privileged Contributor-level accounts to upload arbitrary images to the media library despite normally lacking that permission. This is a classic broken access control flaw in a plugin's admin-ajax/REST handler rather than an attack on the AI model or agent reasoning itself, and requires authenticated access at Contributor level or above.

This is an academic security assessment (not an active exploit) measuring how susceptible the DeepSeek Harness agent is to indirect prompt injection delivered through tool outputs, files, and other content channels. Using a controlled benchmark of 14,560 executions, researchers found meaningful but bounded attack success rates (up to ~25.5% for hidden Unicode payloads in file mode), indicating real but not universal susceptibility. The study is defensive/evaluative in nature and provides a methodology and dataset rather than a live threat.

This is an academic security assessment (not an active exploit) measuring how susceptible the DeepSeek Harness agent is to indirect prompt injection delivered through tool outputs, files, and other untrusted content channels. Using the AI-Infra-Guard testing framework, researchers found measurable but moderate attack success rates (up to ~25.5% for hidden Unicode payloads in file mode), indicating real but partial resistance gaps rather than a fully broken system. The findings are useful for hardening DSH's handling of tool results and untrusted content before it reaches model context or triggers actions.

This is an academic survey (not an active exploit) analyzing how existing agent-security weaknesses become far more dangerous when AI agents use MCP tools and skills to sign and execute transactions on public blockchains. The authors argue that irreversibility, private-key signing authority, autonomous operation, and multi-step transaction composition turn normally recoverable agent failures into permanent financial loss, and find current defenses stop fewer than 30% of attacks. Since this is a research synthesis rather than a disclosed vulnerability or in-the-wild attack, severity is rated medium/informational for defenders rather than critical.

This is an academic research paper (not an active exploit) introducing a benchmark, MobileWorldSafety, that measures how susceptible LLM-powered Android GUI agents are to environmental/indirect prompt injection embedded in app content. The study found attack success rates of 40.4%-66.9% across six agents, indicating a real and significant class of vulnerability, though the artifact itself is a defensive research tool rather than a live threat.

ArcadeDB's MCP server tool set_server_setting only checks a global allowAdmin flag rather than the calling user's actual role, allowing any authenticated read-only user to modify server-wide configuration when allowAdmin is enabled. This lets a low-privileged user tamper with GlobalConfiguration or trigger denial of service. The fix in 26.8.1 adds proper per-caller role enforcement.

This is an academic research paper (not an active exploit) empirically studying how the structure of a code workspace -- directory depth, file modularity, injection location, and surrounding context -- affects the success rate of indirect prompt injection attacks against agentic coding assistants. The findings are useful defensively: they show that highly modular codebases and certain security-cue framing reduce attack success, informing how organizations should test and harden coding agents that ingest third-party code.

MLflow versions 3.13.0 through 3.14.x are missing an authorization check on the log-inputs API endpoint, letting any authenticated user inject fabricated dataset lineage records into another user's ML run without holding UPDATE permission. This undermines trust in experiment metadata and lineage tracking, which many AI agent pipelines rely on for provenance and reproducibility, but it does not itself provide remote code execution or full account takeover. The issue is fixed in MLflow 3.15.0.

The mcp-florence2 MCP server contains a server-side request forgery vulnerability in its get_images function, allowing a remote attacker to supply a malicious 'src' argument that causes the server to make unauthorized HTTP requests. This could be used to probe internal networks, access cloud metadata endpoints, or interact with internal services reachable by the MCP server. A public exploit exists, increasing the urgency of remediation.

The CKAN MCP Server had a flaw where request parameters were serialized into cache keys using unescaped delimiter characters (&, =, |), allowing different logical queries to produce identical cache keys. An attacker could exploit this collision to poison the shared cache with attacker-controlled data that gets served back to a victim making a distinct, legitimate query.

The CKAN MCP Server's data quality tools validate the server_url parameter using a prefix-only regular expression intended to restrict requests to dati.gov.it, but the check can be bypassed with suffix-host or userinfo tricks in the URL. This allows an attacker to redirect the MCP tool's outbound request to an attacker-controlled host and return spoofed data to the agent as if it came from the trusted source.

Trigger.dev's run replay API looks up task runs by a friendly ID without checking that the run belongs to the caller's environment/tenant, allowing any valid API key holder to replay another tenant's agent task run. This lets an attacker consume victim compute resources and repeat side effects of that run, and in combination with a separate object-store path-traversal bug, potentially inject attacker-controlled payload bytes into the victim's replayed task. The issue is fixed in 4.5.0-rc.4.