| 1 |
AWS |
severity-high 9.8 (Critical) |
aws-mcp-server (CVE-2026-5058, CVE-2026-5059) |
Unauthenticated access to broker credentials; full cloud takeover possible |
Apr 2026 |
| 2 |
Microsoft (Azure) |
severity-high 9.8 (Critical) |
Microsoft product (ZDI-CAN-28042) |
RCE on any system running vulnerable MCP implementation |
Apr 2026 |
| 3 |
Anthropic |
severity-high 9.4 (Critical) |
Anthropic MCP Inspector (CVE-2025-49596) |
Full filesystem, API keys, and environment secrets exposed; 38k weekly downloads |
Jan 2026 |
| 4 |
Anthropic |
severity-high 9.3 (Critical) |
mem0 MCP (CVE-2026-59706) |
Unauthenticated config API returns LLM API keys in plaintext |
Jul 2026 |
| 5 |
Microsoft (Azure) |
severity-high 9.1 (Critical) |
Azure DevOps MCP (CVE-2026-32211) |
No authentication; unauthorized access to API keys, tokens, config data |
Apr 2026 |
| 6 |
Anthropic |
Critical (design flaw, no CVE) |
Anthropic MCP SDK (Python, TS, Java, Rust) |
RCE on ~200,000 servers; direct access to API keys, internal DBs, chat histories |
Apr 2026 |
| 7 |
OpenAI, Anthropic, Google |
Critical (no severity-high) |
OpenCode Console (legacy system breach) |
1.4% of users' provider keys exposed; $1,700+ unauthorized charges per user; linked to "distillation attack" |
Oct 17, 2026 |
| 8 |
Anthropic, OpenAI |
severity-high 8.8 (High) |
OpenClaw/Clawdbot (42,000+ exposed instances) |
API keys, Slack creds, Telegram bot tokens, full chat histories; 1,000+ unauthenticated MCP endpoints |
Jan 2026 |
| 9 |
Microsoft (Azure) |
severity-high 8.8 (High) |
Azure MCP Server Tools (CVE-2026-26118) |
SSRF sends managed identity token to attacker-controlled URL |
Mar 10, 2026 |
| 10 |
Anthropic |
severity-high 8.2 (High) |
rmcp (Rust SDK, CVE-2026-63127) |
OAuth credential theft via malicious server |
Sep 2026 |
| 11 |
OpenAI, Anthropic, Google |
severity-high 7.5 (High) |
MCP Python SDK (GHSA-qx49-fqc8-xw99) |
Malicious server steals client secret, auth code, PKCE proof key |
Sep 28, 2026 |
| 12 |
Google (Gemini) |
High (Tier 1: Single-Service Privilege Escalation) |
Public client-side code (2,863 live keys) |
API keys authenticate to Gemini; data access, $82,314 in unauthorized charges |
Feb 2026 |
| 13 |
AWS |
High |
Amazon Q Developer MCP config (CVE-2026-12957) |
Malicious repos auto-execute MCP commands; steals AWS credentials, SSH keys, K8s tokens |
Jun 2026 |
| 14 |
AWS |
High |
Amazon MQ MCP Server (CVE-2026-18655) |
Prompt injection obtains RabbitMQ broker credentials or OAuth access tokens |
Jul–Aug 2026 |
| 15 |
Cloudflare |
High |
cloudflare/mcp-server-cloudflare (auth bypass) |
Expired/invalid tokens return 403 instead of 401; scope elevation without re-auth |
Oct 22, 2026 |
| 16 |
Google, JPMorgan, Weaviate, France Gov, Indonesia Gov |
High |
Various MCP servers (SSRF class) |
SSRF to internal services; credential/token exposure |
Oct 2026 |
| 17 |
Anthropic |
severity-high 5.3 (Medium) |
Claude Code (CVE-2026-21852) |
API key exfiltration via attacker-controlled proxy; full team workspace exposed |
Jan–Feb 2026 |
| 18 |
OpenAI, Anthropic, AWS, generic cloud |
severity-high 5.9 (Medium) |
MCP Python SDK (CVE-2026-116685) |
Cross-origin redirect leaks X-API-Key headers and POST bodies |
Oct 2026 |
| 19 |
Anthropic, OpenAI, AI services |
N/A (aggregate research) |
82,000 public MCP config files on GitHub (Hush Security) |
12% of credential slots hardcoded; 24% non-expiring & broad-scope |
Sep–Oct 2026 |
| 20 |
Anthropic, OpenAI, AI services |
N/A (aggregate research) |
Public GitHub MCP files (GitGuardian, State of Secrets Sprawl 2026) |
24,008 unique secrets; 2,117 confirmed valid; AI-service secrets +81.5% YoY |
Mar 2026 |
| 21 |
Multiple vendors |
N/A (aggregate research) |
MCP config records (Flare audit) |
438 distinct credentials (218 after dedup) |
Oct 7, 2026 |
| 22 |
Postmark |
High (supply chain) |
postmark-mcp (malicious npm package) |
Stolen password resets, invoices, customer data; 1,643 downloads |
2026 |
| 23 |
Multiple (browser, cloud, Discord, SSH, crypto) |
High (supply chain) |
Fake Oura Ring MCP Server |
StealC malware: browser passwords, cloud tokens, SSH keys, crypto wallets |
Feb 2026 |
| 24 |
GitHub |
Critical |
GitHub MCP (malicious public issue) |
AI assistants hijacked to exfiltrate private repo data (salaries, plans) into public PRs |
2026 |
| 25 |
Multiple (bearer tokens, cookies) |
severity-high 3.7 (Low) |
mcp-from-openapi (CVE-2026-115750) |
Cross-origin redirect captures Authorization/Cookie headers |
Oct 2026 |