#MCP
All CosmicBytez Labs articles tagged #MCP, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-105793: Command Injection in Microsoft UFO's Mobile MCP Server via Unsanitized ADB Key Codes
A flaw in Microsoft UFO's mobile MCP server lets attackers inject arbitrary ADB shell commands on connected Android devices.
- Security
CVE-2026-105697: Langflow MCP Stdio RCE — Incomplete Fix Reopens Remote Code Execution
Langflow's 1.9.0 MCP Stdio RCE fix was incomplete — the same bash -c exec flaw stayed reachable until 1.10.3, which removed the shell entirely.
- Security
CVE-2026-105740: Langflow Authenticated RCE via MCP Stdio Transport
Authenticated Langflow users could run arbitrary OS commands by adding a malicious MCP Stdio server; the command hit bash -c exec unsanitized.
- Security
CVE-2026-102911: Critical OS Command Injection in pi-llm-wiki's MCP Capture Tool
Critical CVSS 9.9 OS command injection in pi-llm-wiki's wiki_capture_source MCP tool via the url argument; fixed in v0.11.8.
- Security
CVE-2026-101065: Obot AI Agent Platform Ships With Authentication Disabled by Default
Obot's documented Docker quickstart boots with auth off and the Docker socket mounted in, letting any network caller reach the host. CVSS 9.8.
- Security
CVE-2026-101084: Obot Authorization Bypass Lets Any User Reach Restricted MCP Servers
Obot's /mcp-connect gateway skipped access-control checks before v0.21.1, letting any authenticated user invoke restricted MCP tools. CVSS 9.6.
- News
Anthropic Turns Claude Into an AI Marketplace With 2,000+ Plugins and Connectors
Anthropic launched the Claude Marketplace with 2,000+ plugins, connectors, and partner agents, plus a submission portal for developers.
- Security
Critical SSRF in GitLab MCP Server Leaks Private Tokens to Attackers
CVE-2026-61559 lets attackers redirect @zereight/mcp-gitlab's outbound API calls via a request header, leaking victim GitLab tokens to attacker hosts.
- Security
GitLab MCP Server Open to DNS Rebinding, Full Account Takeover
CVE-2026-61568 (CVSS 9.6) lets a malicious webpage use DNS rebinding to reach a victim's local GitLab MCP server and hijack their GitLab account.
- Security
CVE-2026-57123: PraisonAI MCP Server Exposes Unauthenticated Tool Access
PraisonAI's MCP tools server binds to 0.0.0.0 with no auth or origin checks, letting any reachable client invoke shell and file tools.
- Security
CVE-2026-85025: Langflow MCP Endpoint Flaw Enables Unauthenticated RCE
Langflow OSS 1.0.0-1.11.5 lets unauthenticated attackers run arbitrary code via public MCP project endpoints due to broken session isolation.
- Security
CVE-2026-62316: Microsoft UFO MCP Server DNS Rebinding and SSRF via Missing Host Validation
CVSS 8.8: Microsoft's UFO framework MCP server binds to localhost but skips Host/Origin header checks, enabling DNS rebinding and SSRF attacks. Fixed in 3.0.8.
- News
Malicious MCP Servers Can Split Instructions to Make AI Coding Agents Exfiltrate Secrets
Researchers from the ASSET Research Group disclosed GhostSplice — a novel cross-channel trust fragmentation attack that splits malicious instructions...
- Security
CVE-2026-19516: SSRF in mcp-grafana Allows Arbitrary Outbound Requests
A critical server-side request forgery vulnerability in mcp-grafana lets callers hijack the MCP server's outbound HTTP requests via a caller-supplied...
- Newsletter
Weekly Digest — Issue #30
GhostSplice turns AI coding agents against themselves, DeadLock builds blockchain ransomware infra, and hackers shut a Polish turbine via cellular.
- News
Weekly Recap: AI Goes Rogue, Metabase 0-Day, MCP Supply-Chain Attacks, and Router Backdoors
This week's security roundup covers agentic AI containment failures, a critical Metabase zero-day, malicious MCP plugins targeting AI assistants, and...
- News
The Network Has Become the Control Plane for AI Security
As AI agents, copilots, and LLM-powered applications proliferate across enterprise environments, traditional packet-inspection firewalls are blind to the...
- News
Ruflo MCP Flaw Lets Unauthenticated Attackers Run Commands and Poison AI Memory
A maximum-severity flaw (CVE-2026-59726, CVSS 10.0) in the Ruflo open-source agent harness for Claude Code and OpenAI Codex allows unauthenticated remote...
- News
2-Click Cursor Exploit Enables Dev Environment Takeover
DeepJack: two clicks in Cursor IDE silently installs a malicious MCP server with full user privileges, stealing source code and secrets. Unpatched in July 2026.
- Security
CVE-2026-46339: 9Router Unauthenticated Plugin Registration & MCP Command Execution
A critical CVSS 10 vulnerability in 9Router AI router versions 0.4.30–0.4.36 allows unauthenticated attackers to register custom plugins and execute...
- Security
CVE-2026-52830: fast-mcp-telegram Path Traversal Enables Bearer Token Bypass
A critical path traversal vulnerability in the fast-mcp-telegram Telegram MCP Server allows attackers to bypass Bearer token authentication and read...
- Security
CVE-2026-8719: WordPress AI Engine Plugin Privilege
A missing WordPress capability check in the AI Engine plugin's MCP OAuth bearer-token path allows any authenticated user to escalate privileges to...
- Security
CVE-2026-6942: radare2-mcp OS Command Injection via Shell
A critical OS command injection vulnerability in radare2-mcp 1.6.0 and earlier allows remote attackers to execute arbitrary commands by bypassing the...
- News
Anthropic MCP Design Vulnerability Enables RCE, Threatening
Cybersecurity researchers have discovered a critical by-design weakness in the Model Context Protocol architecture that enables arbitrary command...
- Security
CVE-2025-69902: Critical Command Injection in kubectl-mcp-server
A critical command injection vulnerability in kubectl-mcp-server allows unauthenticated attackers to execute arbitrary OS commands through unsanitized...
- Project
Claude Code for IT Operations: Building a Multi-Project
Transform Claude Code from a chatbot into a DevOps co-pilot. Set up CLAUDE.md templates, custom hooks, reusable agents, deployment skills, and MCP server...
- News
Trojanized MCP Server Deploys StealC Infostealer Targeting
A SmartLoader campaign distributes a trojanized Model Context Protocol (MCP) server disguised as Oura Health's legitimate tool, deploying StealC...