| DATE | CVE | CVSS | VENDOR | SOURCE (VICTIM) | VULN | IMPACT |
|---|---|---|---|---|---|---|
| Nov 9 | CVE-2026-123809 | 4.2 | Dynatrace MCP Server | create_workflow_for_notification writes that value verbatim into a persistent Dynatrace e-mcp (< 2.0.0) workflow |
The tool interpolates caller-controlled teamName, problemType, & channel values into a Dynatrace workflow without sanitizing Jinja2 expressions, letting an attacker inject template code that executes when the workflow runs. |
Template Injection, allowing data exfiltration via Slack |
| Nov 9 | CVE-2026-123810 | 4.3 | Dynatrace MCP Server | SQL InjectionAffects dynatrace-mcp (<2.1.1,) allowing manipulation of DQL query structures to bypass certain restrictions |
Crafted inputs can close string literals, append pipeline stages, or comment out the remaining intended query, allowing callers to bypass field selection, time-window, and result-display limits in tools marked readOnlyHint. |
The issue does not grant data access beyond the configured token's existing execute_dqlcapability, but it breaks the narrower auto-approved tool contract |
| Nov 9 | CVE-2026-123811 | 7.5 | Dynatrace MCP Server | dynatrace-oss/dynatrace-mcp package (<2.0.0) |
Missing Authentication, enabling unauthorized access to logs and notebooks Confidentiality: High exposure of logs, security events, and user sessions via unauthenticated execute_dql calls |
The flaw (CWE-306, Missing Authentication for Critical Functionality) occurs when the server is started with the --httpoption: it accepts |
| Nov 9 | CVE-2026-123812 | 7.5 | Dynatrace MCP Server | dynatrace-oss/dynatrace-mcp package (<1.8.7) |
Missing Authorization, allowing persistent malicious notebook creation, located in the src/index.ts,file |
The flaw allows an attacker to create tenant-visible notebooks containing malicious Markdown or DQL content due to a missing authorization check that bypasses the requestHumanApproval gate used by other write tools |
| Nov 8 | — | — | Glow Labs | All MCP operators using AI coding agents | "MCPhantom" research (Help Net Security): AI coding agents install deprecated MCP servers from archived/dead repos. In 98% of sessions, agent filled package name from model training data. In 2%, user asked by name. High-severity flaws in those servers will never be patched. | Research disclosure. No quantified victim count. Pattern is permanent — every new agent session can re-introduce a dead server. |
| Nov 8 | CVE-2026-107441 vs CVE-2026-7273 | — | — | Systems that applied the "fix" | Published patch for CVE-2026-7273 fixes a different bug than the active exploit (CVE-2026-107441) relies on. Systems that applied the documented fix remain fully exploitable. | — |
| Nov 8 | CVE-2026-18484 | — | IBM ContextForge MCP Gateway 1.0.0–1.0.11 | Improper slug normalization → tool name collisions → DoS 6.5 Medium | — | — |
| Nov 7 | CVE-2026-102610 | 6.4 | fast-agent | Any network client reaching port 8000 | Unauthenticated HTTP transport on 0.0.0.0:8000. /mcp endpoint exposed without auth. Network clients can invoke all registered tools. | All network clients on the segment. No auth, no token, no origin check. |
| Nov 7 | CVE-2026-123851 | 5.4 | JetBrains Junie | Junie GitHub Action users | Prompt injection bypass via HTML-encoded characters in GitHub Action. Circumvents protection layer. | Junie GitHub Action < 1.6.4 |
| Nov 6 | CVE-2026-123675 | 8.3 | OpenBMB | OpenBMB Internet of Agents users | Code injection in Code Executor Tool (im_client/agents/tools/code_executor.py, execute_code function). Manipulation of filename/lang argument → arbitrary code execution. Remote, no auth, no interaction. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L | ≤ commit 9d78e88. No public PoC. Not in KEV. Status: Deferred. |
| Nov 6 | CVE-2026-123676 | 5.3 | OpenBMB | OpenBMB Internet of Agents users | Related flaw in same codebase (same commit range). | — |
| Nov 5 | CVE-2026-123272 | 5.1 | mark3labs mcp-go | Any mcp-go user with OAuth | Origin validation error in OAuthHandler.fetchServerMetadata: malicious MCP server declares arbitrary resources in well-known metadata → authorization server issues tokens for unintended resources. Attacker replays tokens against that resource. Fixed v1.2.1. | < 1.2.1. No exploitation evidence. Not in KEV. No public PoC. |
| Nov 5 | CVE-2026-111771 | 6.8 | @modelcontextprotocol/sdk (TS) | Anthropic (official SDK); all multi-service IdP tenants | Server-side bearer auth: aud claim never validated. Valid token issued for Service-A accepted by MCP-Server-B. Confused deputy on audience. Affects @modelcontextprotocol/sdk 1.6.0–1.32.0, @modelcontextprotocol/server 2.0.0–2.3.0, @modelcontextprotocol/express 2.0.0–2.0.2, @modelcontextprotocol/server-legacy 2.0.0–2.3.1. Fixed 1.32.0 / 2.3.0 / 2.0.2 / 2.3.1. | Auth0/Keycloak/Okta single-IdP orgs = cross-service impersonation. Applications already validating aud in verifyAccessToken() are NOT affected. Enabling only the SDK's audience check without app-level validation → all requests get 401 (breaks existing deployments). |
| Nov 5 | — | — | Security Boulevard | 514 MCP server operators | "Why MCP Security Disclosure Is Broken — And What the Industry Needs": 514 publicly reachable MCP servers scanned, 38% expose tools with zero authentication. 7 Feb CVEs all unauth RCE, 3 identical root cause, 1 reported Jul 2025 → published as 0-day 6 months later, no patch. | 514 scanned; 38% unauthenticated. Systemic disclosure failure documented. |
| Nov 3 | CVE-2026-76894 | 3.1 | CKAN MCP Server | CKAN MCP users | Insufficient verification of data authenticity in DataStore table UI. | < 0.4.112 |
| Nov 3 | CVE-2026-61560 (commentary) | 9.8 | mcp-gitlab | Any org running mcp-gitlab with a valid GitLab token | SC World "The MCP server nobody inventoried": commentary on CVE-2026-61560. Simple bug, but token grants access to every repository, CI/CD variable, and deploy key the token owner can reach. Maintainer shipped fix June 22 (v2.1.27: refuses non-localhost without auth token, unprivileged user, blocks file-read path). CVE record not published until Sept 15. 3-month gap between fix and CVE publication. | CVSS 9.8. Detection template written Sept 2026. Server still un-inventoried in many orgs as of Nov 3. |
| Nov 3 | CVE-2026-33252 (context) | — | modelcontextprotocol/go-sdk | Anthropic (official Go SDK) | SC World mentions: Go SDK accepted cross-site requests without checking origin. Protocol version confusion issue (GitHub #363, commit Nov 2, labeled high Nov 3): vulnerable code read protocol version from request context instead of server's authoritative field. Attacker manipulates context → incorrect protocol handling rules / version-specific security check bypass → protocol downgrade. | Fix: use server's protocolVersion field directly instead of deriving from context. |
| Nov 3 | CVE-2026-63118 (context) | — | MCP Ruby SDK | Ruby SDK users | SC World mentions: Ruby SDK lacked DNS-rebinding protection. | — |
| Nov 3 | — | — | Glow Labs | All MCP operators using AI coding agents | Help Net Security publishes "MCPhantom" (same as Nov 8 row — article dated Nov 3, picked up in Nov 8 roundup). | — |
| Nov 2 | CVE-2026-115563 | 7.5 | mcp (Python SDK) | Anthropic (official SDK); all OAuth-using MCP clients | Token endpoint trust: SDK does not consistently establish that stored credentials (client_id, client_secret, refresh_token) belong to the authorization server behind the selected token endpoint. Malicious MCP server influences where credential-bearing request is sent. RFC 8414 §3.3 issuer-matching not validated on every discovery path. Refresh token makes this particularly serious — it's not just an HTTP parameter, it's a long-lived credential. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | Python mcp 1.9.1–1.29.1; 2.0.0a1–<2.2.0. Fixed 1.30.0 / 2.2.0. PR #3398. |
| Nov 2 | CVE-2026-104850 | 7.5 | @modelcontextprotocol/sdk (TS) | Anthropic (official SDK); all OAuth-using MCP clients | Same class as 115563 but TypeScript: malicious MCP server names attacker authorization server → client sends client_secret, refresh token, signed client assertion to attacker. Issuer-confusion + credential-binding failure. GHSA-6qxp-vccf-f47h. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | TS SDK 1.12.0–1.30.1; client 2.0.0–2.1.x. Fixed 1.31.0 / 2.2.0. PR #2888 (1.x), PR #2887 (2.x). |