Tracing MCP Security Vulnerabilities: Constructing and Analyzing an MCP Security Vulnerability Dataset

Summary

This paper builds a curated dataset of MCP vulnerabilities from CVE disclosures, filtering 119 retrieved records through February 2026 down to 24 validated cases. It reports that 87.5% are Critical or High severity and that injection and path traversal account for 66.7% of cases. The authors also release the dataset, reproducibility tooling and a maintenance workflow.

Topics

• Model Context Protocol

Related items

• LowHelp defend against memory poisoning in Amazon Bedrock AgentCore with multi-layer write validationSimilar attack · AWS Security Blog
• InfoCan the Confidence and Decisions of System 1 Models Be Trusted? An Explainability and Perturbation Audit of Jev-Style Decision ModelsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoHarness Matters: Measuring and Dissecting Security Resilience in Web AgentsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumTop MCP security resources — November 2026Similar attack · Adversa AI Blog
• InfoScaling Adaptive Prompt Injection Attacks with Agent SwarmsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)