Threat Library

The Nextcloud MCP Server's webhook endpoint lacks authentication by default because a required secret defaults to None, letting any network attacker send forged requests. These forged requests can delete or force re-indexing of another user's semantic search embeddings in Qdrant, effectively destroying or manipulating the AI assistant's retrieval memory. This is a critical, unauthenticated remote vulnerability fixed in version 0.117.2.

PraisonAI's local MCP HTTP Stream server uses a flawed startswith() check to validate the HTTP Origin header, allowing an attacker-controlled domain like 'localhost.evil.example' to pass as if it were 'localhost'. A malicious webpage visited by a victim can exploit this to send unauthenticated tools/call requests directly to the victim's local MCP server, invoking any exposed tool without an API key.

Lightdash's scheduled delivery feature lets a user-supplied webhook URL be posted to directly by the GoogleChat and MicrosoftTeams clients without applying the existing SSRF protection used for MCP server URLs. This allows an authenticated user to force the server to make requests to internal, loopback, or cloud metadata endpoints and infer reachability from logged error responses. It is a classic SSRF issue in a webhook delivery path rather than an attack on agent reasoning or an AI-specific exploit, though it touches the same URL-validation utility used to secure MCP server connections.

This is an academic survey (not an active exploit) analyzing how existing agent-security weaknesses become far more dangerous when AI agents use MCP tools and skills to sign and execute transactions on public blockchains. The authors argue that irreversibility, private-key signing authority, autonomous operation, and multi-step transaction composition turn normally recoverable agent failures into permanent financial loss, and find current defenses stop fewer than 30% of attacks. Since this is a research synthesis rather than a disclosed vulnerability or in-the-wild attack, severity is rated medium/informational for defenders rather than critical.

An unauthenticated SSRF vulnerability exists in MLflow's webhook test endpoint that allows attackers to bypass URL validation using HTTP redirects. Attackers can craft a webhook pointing to a benign-looking URL that redirects to internal services or cloud metadata endpoints, then retrieve the response including sensitive credentials. This affects any AI agent or ML pipeline built on vulnerable MLflow versions, exposing cloud infrastructure secrets.

The CKAN MCP Server had a flaw where request parameters were serialized into cache keys using unescaped delimiter characters (&, =, |), allowing different logical queries to produce identical cache keys. An attacker could exploit this collision to poison the shared cache with attacker-controlled data that gets served back to a victim making a distinct, legitimate query.

An MCP server (mcp-dominican-layer) exposes a PDF-parsing tool that accepts a remote URL without adequate validation, allowing an attacker to force the server to make arbitrary outbound requests (SSRF). This could be used to probe internal networks, hit cloud metadata endpoints, or interact with internal services reachable from the MCP host. The vendor has not responded to the disclosure and a public exploit exists, increasing near-term risk for any deployment using this component.

An MCP server component (mcp-rdf-explorer 1.0.0) contains a server-side request forgery vulnerability in its explore_url tool function, allowing a remote attacker to make the server issue arbitrary HTTP requests by manipulating the url argument. A public exploit exists and the vendor has not responded to disclosure, leaving the issue unpatched.

Researchers found that encrypted chain-of-thought blocks returned by major LLM providers (Anthropic, OpenAI, Google) are interchangeable across sessions, users, and models within the same provider, allowing a weaker model to be tricked into decrypting and outputting another model's private reasoning in plaintext. This enables extraction of proprietary reasoning, recovery of PII/credentials from publicly shared session logs, exposure of hazardous content hidden in reasoning, and invisible prompt injection into agentic pipelines. This is a genuine, disclosed architectural vulnerability with demonstrated real-world impact.

The Meta Ads MCP server (prior to v1.0.109) fails to enforce authentication on Streamable HTTP requests, allowing any network-reachable caller to invoke privileged Meta Ads tool handlers. When these calls fail downstream, the server leaks the operator's Meta access token by embedding it in the raw request URL returned within the JSON-RPC error response, giving attackers full account takeover potential.

A server-side request forgery (SSRF) vulnerability was found in MissionSquad mcp-api versions up to 1.11.9, specifically in the dynamic client registration handling code. A remote attacker can exploit this flaw to make the MCP server issue unauthorized requests to internal or arbitrary network destinations. The issue is fixed in version 1.11.10.

IBM Langflow's implementation of the MCP resources/read request fails to sanitize file paths, allowing an attacker to use URL-encoded path traversal sequences to read arbitrary files on the server. This exposes sensitive data including other users' uploaded documents, the JWT signing secret, the SQLite database, and environment variables, which could enable full account takeover or further compromise.

IBM Langflow versions 1.0.0 through 1.10.3 have an authentication bypass in the MCP composer endpoint that occurs when the default setting mcp_composer_enabled=true is combined with OAuth-based project authentication. This allows an attacker to circumvent intended access controls on MCP composer functionality, potentially gaining unauthorized access to project resources or agent workflows.

This is a large-scale academic security assessment (not an active exploit report) finding that thousands of publicly reachable Model Context Protocol (MCP) servers are deployed with weak or absent security controls. Researchers found high rates of missing authentication, exposed shell execution tools, SSRF against cloud metadata endpoints, SQL injection, and prompt template injection across hundreds of confirmed production servers. The findings represent systemic ecosystem-wide risk rather than a single vulnerability in one product.

This is an academic measurement study of the official MCP registry, not an active exploit or vulnerability disclosure. The researchers show that periodic, drift-ranked re-auditing of server descriptions poorly covers actual description changes over time, and recommend content-hash-based revalidation instead. No attack technique, malicious payload, or exploited weakness is described.

better-auth's OIDC provider and MCP plugin fail to validate the URI scheme of registered OAuth redirect_uris, allowing an attacker to register a javascript: URI that gets echoed back to the consent page. If the consent UI navigates to this URI unsafely, attacker JavaScript executes in the authorization server's origin, potentially hijacking victim sessions. This is a classic web input-validation flaw made newly relevant because it affects the auth layer underlying MCP server deployments, extending its blast radius to agent tool-authorization flows.

The MCP Ruby SDK's StreamableHTTP transport failed to bind session IDs to the client/owner that created them, so anyone who obtains a valid session ID (via theft, leakage in logs/URLs, or interception) could issue tools/call requests that execute with the victim's authenticated session context. This allows an attacker to impersonate a legitimate user or agent and trigger tool actions on their behalf without needing credentials.

The MCP Ruby SDK's HTTP transport failed to validate Host or Origin headers before version 0.23.0, allowing a malicious website to use DNS rebinding to reach a locally running MCP server from a victim's browser. This lets an attacker invoke tools exposed by the local MCP server without authorization, effectively bypassing the same-origin trust boundary that localhost services normally rely on.

The alibabacloud-rds-openapi-mcp-server binds its MCP endpoint to all network interfaces by default, allowing any network-adjacent attacker to reach and invoke its exposed tools without proper access restriction. This is a configuration/deployment flaw rather than a novel exploit technique, but it can let unauthorized parties trigger RDS-related MCP tools if the server is reachable. Severity is moderate given the CVSS score of 5.8 and the dependency on network exposure and lack of authentication for actual exploitation.

Researchers identify 33 protocol-level vulnerabilities across three leading agentic commerce platforms, achieving a 100% attack success rate independent of the AI model used, with three vulnerabilities chaining into a full payment hijack. This is a research paper (not an active exploit in the wild) demonstrating that agent-to-commerce-service protocols, not model behavior, are the primary structural risk in agentic payment systems.