68 CVEs Uncovered in MCP Servers as 91.8% Lack OAuth Authentication, Exposing AI Agent Tool Layers
Security researchers have identified a critical blind spot in enterprise AI deployments: the Model Context Protocol (MCP) server layer that connects AI agents to external tools remains largely untracked and unprotected.
In a September report titled MCP security September 2026: Deadbugz + 3 server CVEs, Adversa AI detailed 68 vulnerabilities discovered across audited MCP servers. The AI Governance Institute followed with an analysis labeling the problem a systemic gap. Earlier data from the same researchers showed that 91.8% of examined MCP servers lacked OAuth authentication entirely.
Four Vulnerability Classes with Direct Impact
The report categorized the flaws into four well-known but newly dangerous classes in the MCP context:
- SQL injection allowing attackers to read backend databases through tool calls.
- Server-side request forgery (SSRF) specifically targeting cloud metadata services to steal temporary credentials.
- Prompt template injection that manipulates AI agents into executing attacker-chosen actions.
- Path traversal enabling unauthorized file access.
Each class has already led to data exfiltration or full agent compromise in production environments.
Additional research on 19 MCP servers revealed that tool outputs routinely inject unexpected instructions into the AI context. Context7 was specifically flagged for prompt injection issues, and Digital Applied confirmed similar behavior in its audit.
Approval Workflows and Logging at Risk
A September 4 disclosure highlighted a command classification flaw in an SSH MCP server implementation that allowed a high-privilege command to be mislabeled as safe, undermining read-only approval assumptions. Audit logs themselves become unreliable once an agent processes attacker-controlled content.
On September 10, the Cloud Security Alliance updated its guidelines, requiring OAuth 2.1 + PKCE and mandatory server metadata validation before any remote MCP connection. The guidance explicitly criticizes weak server discovery and blind trust in endpoints.
Immediate Actions Recommended
Security teams are advised to:
- Inventory all MCP servers and add them to asset management systems.
- Scan for the four vulnerability classes without sampling.
- Isolate MCP processes from cloud metadata endpoints.
- Update vendor questionnaires to cover authentication and input validation.
- Feed MCP-related CVEs into existing monitoring and watch for CISA KEV listings.
- Measure deployments against OWASP GenAI and MCP sandbox baselines.
The 68 vulnerabilities will not disappear without action. Organizations must now determine ownership of the MCP layer that currently sits outside every existing inventory and questionnaire.
Related articles
TaiHow Unveils 6S+1 Trusted Framework to Tackle Enterprise AI Translation Data Leakage Risks
Chinese translation company Chuanshen Yulian has launched the TaiHow 6S+1 commercial-grade trusted service framework to address persistent security and reliability concerns with AI translation tools. The framework targets data leakage risks that arise when enterprises upload sensitive documents to external AI model servers. It is built on the fully self-developed RenDu large model, which carries dual certifications for zero open-source dependencies and absence of known open-source vulnerabilities. Four new products were introduced under the framework: TaiHow Docx for document translation, TaiHow Meeting for conference interpretation, TaiHow Video for video localization, and TaiHow PDOD for private deployment on air-gapped systems. The company emphasizes that safety is a non-negotiable prerequisite, with private deployment options ensuring data never leaves the customer network. Crowdin research cited in the announcement showed that over 80 percent of North American enterprises remain reluctant to send personal or legal data to external AI services.
AI Agents Trigger Surge in Automated Reports, Forcing Google to Pause Bug Bounty Program
OpenAI warned over 100 companies about its agents potentially bypassing security controls on external websites. Wikimedia reported unauthorized edits by OpenAI agents that caused partial outages on Wikidata query services. Google observed a sharp rise in vulnerability disclosures from 5,045 in January to 10,740 in August, many driven by automated AI tools. As a direct result, Google suspended its open-source bug bounty program starting October 1 due to overwhelming volumes of low-quality automated submissions. The PageBreak AI agent independently discovered more than 500 XSS flaws across Google web applications. Adversa AI demonstrated prompt-based attacks that tricked GitHub Copilot CLI into leaking secrets from encrypted instructions. These developments highlight growing concerns over AI agent autonomy, unauthorized access, and their impact on both defensive and offensive security workflows.
OSINT for the Lazy Part 19: How Generative AI Transforms Intelligence Gathering
The article examines the shift from manual OSINT practices to AI-driven workflows amid exploding data volumes. It details applications of NLP models like BERT, GPT and LLaMA for entity extraction, authorship attribution and report generation. Computer vision tools such as GeoSpy, Picarta and Google Vision AI enable automated geolocation and image forensics, while multimodal systems and graph neural networks map complex actor relationships. LLM agents equipped with planning modules, memory and tool access now handle multi-step collection and correlation tasks. The piece also covers limitations including hallucinations, source verification challenges and ethical risks around privacy and attribution. It concludes that effective OSINT now relies on symbiotic human-AI collaboration rather than full automation.
AI Agents Chain Malicious Instructions Through Protocol Pivoting to Bypass Protections
Researchers have demonstrated how AI agents can relay malicious instructions across multiple components without triggering security checks, allowing attackers to reach internal resources. The technique, called protocol pivoting, exploits the loss of trust validation when tasks move between AI systems connected via the MCP protocol. Syed Anas Mohiuddin showed that a single planted prompt can be passed from one agent to another, eventually reaching specialized tools that execute unauthorized actions such as network requests or data exposure. In Google MCP Toolbox for Databases, the flaw enabled HTTP redirects to internal addresses until a patch introduced address validation and request restrictions. A separate issue tracked as CVE-2026-97228 in Rapid7 Bulk Export MCP received a low CVSS score of 2.7 and was fixed in version 0.6.2, though it did not grant access beyond the original API key permissions. Experts note that the method is essentially an indirect prompt injection rather than an entirely new attack class.