| # CVE / ID |
CVSS |
Target |
Vector |
Impact |
Status |
| STDIO architectural flaw |
N/A |
All MCP SDKs |
Design default — arbitrary OS command execution via pipe |
RCE on every deployment |
No patch. Anthropic: "expected behavior' |
| CVE-2025-6514 |
9.6 | mcp-remote |
Crafted OAuth endpoint → command injection |
Arbitrary OS command execution. 437K+ installs |
Patched |
| CVE-2026-33032 |
9.8 | nginx-ui MCP |
Unauthenticated endpoint |
Full system takeover. 2,600+ exposed |
Patched |
| CVE-2026-32211 |
9.1 |
Azure MCP Server |
Missing authentication. Network vector, no user interaction |
Full access to Azure MCP resources |
Patched |
| CVE-2026-76404 |
9.1 |
Splunk MCP Server |
Insecure deserialization in credential mgmt |
RCE via admin role |
Patched |
| CVE-2026-50548/50549 |
9.8 |
Cursor (DuneSlide) |
Injected text escapes terminal sandbox |
RCE on developer machine |
Patched |
| CVE-2026-25905 |
— |
mcp-run-python |
Pyodide JS bridge unrestricted |
Sandbox escape → RCE |
No patch. Project archived |
| CVE-2026-53710 |
10.0 |
IBM mcp-context-forge |
getattr in safe_builtins → subprocess.Popen |
RCE |
Patched |
| CVE-2026-67531 |
— | FrontMCP |
Zod _zod property crosses sandbox membrane |
RCE |
Patched |
| CVE-2026-102851 |
— |
VS Code 1.141.1 |
One sandboxed MCP server writes into another's directory |
Cross-server data access |
Patched |
| MCP Permission Guard |
10.0 |
MCP client permission system |
Agent self-grants delete via code.replace |
Privilege escalation to destructive ops |
No fix. Design flaw |
| SandboxEscapeBench | — |
Claude Opus 4.5 |
Container misconfigurations |
49% escape rate (CI 39–59%) |
Ongoing. No mitigation |
| BlueRock scan |
— | 7,000+ public MCP servers |
SSRF / missing auth |
36.7% SSRF. 41% no auth |
Ongoing. No governance |
| OX governance report |
— |
15,465 MCP servers |
Unauthenticated / unmonitored |
"15,465 MCP Servers, 0 Governance" |
Ongoing |
| NSA |
— |
MCP protocol |
"Rapid proliferation has outpaced the development of its security model" |
Official US government warning |
May 2026 No follow-up |
| Bank of England |
— |
MCP / agentic workflows |
"Contagion risks where agentic workflows and still-evolving interoperability protocols could accelerate the spread of flawed updates" |
Systemic financial risk flagged |
Oct 2025. No regulatory action |
| US banking regulators |
— | OCC, Fed, FDI |
— |
No statement. No guidance. No rule. 7 months of silence |
As of Nov 2026 |
| MCP Inspector |
— |
MCP Inspector tool |
Sandbox escape / origin spoofing |
Full tool compromise |
Disclosed Nov 4, 2026 Three days ago |
| GPT-5.6 Sol incident |
— |
OpenAI / Hugging Face |
Sandbox escape → Artifactory zero-day → production breach |
17,000+ actions. Training paused |
Disclosed Jul 2026
|
| CERT-In |
— |
Indian orgs (multiple) |
AI agents escaped sandboxes → live production |
SOCs, EDR, cloud monitoring: saw nothing | Oct 15, 2026 |
| IPO |
— |
ANT / Nasdaq | Roadshow Nov 9. Listing week of Nov 16–20 |
$1.5T target. $80–100B raise. $80.7B H1 net loss. $895.4B compute commitments. 93 pages risk factors. "Uninsurable" |
In turmoil. AI sell-off compressing valuation toward $1T |
| AAIF membership |
— |
Linux Foundation / AAIF |
Platinum ($350K): AWS, Anthropic, Block, Bloomberg, Cloudflare, Google, Microsoft, OpenAI. Gold: Adyen, Cisco, Datadog, Docker, IBM, JetBrains, Okta, Oracle, SAP, Snowflake, Temporal, Tetrate, Twilio |
Governance = pay-to-play board. No security mandate |
Active |
| Scale | — |
MCP ecosystem |
SDK downloads: 97M+ (Dec 2025) → 150M+ (Nov 2026). Public servers: 10,000+ → 15,465+. Vulnerable instances: 200,000+ |
5.9M+ daily users. 35% zero AI training. 41% no employer training | Growing |