HighVulnerabilityLLM-specific

CVE-2025-34072: Anthropic Slack MCP Server data exfiltration via automatic link unfurling

Source: NVD(opens in a new tab)
Identifier: CVE-2025-34072
Published: July 2, 2025
Record updated: October 9, 2026

Known exploitation: Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS: 0.4%

Summary

CVE-2025-34072 is a data exfiltration flaw in Anthropic's deprecated Slack Model Context Protocol (MCP) Server, reached through automatic link unfurling. When an AI agent using the server processes untrusted data, it can be manipulated into posting messages with attacker-crafted hyperlinks that embed sensitive data. Slack's link preview bots (Slack-LinkExpanding, Slackbot, Slack-ImgProxy) then request the attacker-controlled URL, leaking private data with no user interaction.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Details

Scores and exploitation

EPSS: 0.4%Estimated probability that this CVE is exploited in the next 30 days, from the FIRST Exploit Prediction Scoring System. Read on November 4, 2026.

Weaknesses and techniques

Weakness (CWE): CWE-20
CWE-200
Attack pattern (CAPEC): CAPEC-116
AI threat technique (MITRE ATLAS): AML.T0051

Affected

Vendors: Anthropic

Classification

Attack type: Prompt injection,
PII leakage
Attack sophistication: Moderate
AI component targeted: Plugin
Impact: Confidentiality
Labels: security,
privacy

How this record was produced

Summaries, mitigations and labels on this page are generated automatically from the source. The linked source is authoritative. The source gives this advisory a description and no title, so the title above is a headline generated from the source text.

Original source: https://nvd.nist.gov/vuln/detail/CVE-2025-34072

First tracked: February 15, 2026 at 08:49 PM ET, from NVD/CVE Database

Classifier: claude-haiku-5-5, prompt v4

Classifier confidence: 93% (self-assessed)

Topics

Model Context Protocol

Summary

Mitigation

Topics

Related items