Threat Library

Agent-to-agent threats first — conventional coverage one click away.

Browse by hub: AI agent threats · Conventional watchlist · OWASP Agentic Top 10

TypeAll Prompt Injection Tool Poisoning Memory Poisoning Agent Worm Framework Vulnerability Protocol Vulnerability

Showing 1 of 1 threats

APIFold MCP Server Webhook Signature Validation Bypass Leading to Untrusted Data InjectionmediumAgent

MCPwebhooksignature-validationunauthenticated-writedata-poisoningRedisPostgreSQLAPIFoldASI04 · Agentic Supply ChainSurface: Tool LayerPropagation: Single Hop

A vulnerability in APIFold's auto-generated MCP server allows unauthenticated attackers to inject arbitrary JSON payloads via a webhook endpoint due to a missing signature validation configuration. These attacker-controlled payloads are stored and later served as trusted resource state to legitimate MCP clients, enabling a form of tool/data poisoning against downstream AI agents. The issue is fixed in a subsequent commit and requires no special access beyond knowledge of a server slug.

▾